Available tools (early access)

Use the PingOne Remote Model Context Protocol (MCP) Server to connect your artificial intelligence (AI) client to PingOne through a PingOne-hosted remote endpoint. After you configure a supported client and sign on with PingOne OAuth 2.0, you can use MCP tools to work on PingOne administrative tasks directly from your AI client.

You don’t need to install or maintain a local MCP server. PingOne hosts and manages the service, giving you a single entry point for headless administration and centrally managed updates.

The PingOne Remote MCP Server exposes available tools organized into functional categories.

You don’t need to know the individual tool names. Describe what you want in natural language and your AI agent automatically selects the right tool.

Category	What you can do
Environments	List, create, update environments, and manage their enabled services.
Populations	Create and manage user populations.
Applications	Full CRUD for OpenID Connect (OIDC), SAML, and worker applications, plus grants, policies, attribute mappings, secrets, push credentials, and role assignments.
Resources	Create and manage OAuth 2.0 protected resources and their scopes.
Users	Create, update, and manage users, including passwords, MFA, and account lockout.
DaVinci	Work with DaVinci flows, applications, connectors, variables, forms, and execution history.

Environments

List accessible environments or manage their configuration and enabled services.

Tool Description

Tool	Description
`listEnvironments`	Lists PingOne environments accessible to the authenticated user. Use to discover environments by name or status when you do not have an environmentId. Call getEnvironment when you already have the ID and need the full configuration.
`getEnvironment`	Returns an environment’s full configuration, including its enabled services (Bill of Materials). Use when you already have the environmentId. Call listEnvironments first to find it by name or status.
`createEnvironment`	Creates a new sandbox PingOne environment. Use when provisioning a fresh environment for development or testing. Cannot create production environments — those must be created via the admin console.
`updateEnvironment`	Updates an environment, its enabled services (Bill of Materials). Use to rename an environment, promote a sandbox to production, change its license, or change its enabled services. The region cannot be changed. Call getEnvironment first and resend the complete set, since omitted services are removed; use createEnvironment to provision a new one instead.

listEnvironments

Lists PingOne environments accessible to the authenticated user. Use to discover environments by name or status when you do not have an environmentId. Call getEnvironment when you already have the ID and need the full configuration.

getEnvironment

Returns an environment’s full configuration, including its enabled services (Bill of Materials). Use when you already have the environmentId. Call listEnvironments first to find it by name or status.

createEnvironment

Creates a new sandbox PingOne environment. Use when provisioning a fresh environment for development or testing. Cannot create production environments — those must be created via the admin console.

updateEnvironment

Updates an environment, its enabled services (Bill of Materials). Use to rename an environment, promote a sandbox to production, change its license, or change its enabled services. The region cannot be changed. Call getEnvironment first and resend the complete set, since omitted services are removed; use createEnvironment to provision a new one instead.

Example prompts

"List all my PingOne environments"
"Create a sandbox environment called Dev Testing in the NA geography"
"What services are enabled in my environment?"
"Enable PingOne MFA in my sandbox environment"

Populations

Create and manage populations to organize users within an environment.

Tool Description

Tool	Description
`listPopulations`	Lists populations in an environment. Use to discover populations by name when you do not have a populationId. Call getPopulation when you already have the ID and need the full configuration.
`createPopulation`	Creates a new population in an environment. Use when provisioning a group to organize users. Do not use to modify an existing population — use updatePopulation instead.
`getPopulation`	Returns a population’s full configuration. Use when you already have the populationId. Call listPopulations first to find it by name.
`updatePopulation`	Updates a population by full replacement, and assigns its default identity provider. Call getPopulation first and resend the complete object, since omitted fields are cleared. Do not use to create a population; use createPopulation instead.
`deletePopulation`	Permanently deletes a population. Refuses non-empty and default populations. Use dryRun to verify the target before committing.

listPopulations

Lists populations in an environment. Use to discover populations by name when you do not have a populationId. Call getPopulation when you already have the ID and need the full configuration.

createPopulation

Creates a new population in an environment. Use when provisioning a group to organize users. Do not use to modify an existing population — use updatePopulation instead.

getPopulation

Returns a population’s full configuration. Use when you already have the populationId. Call listPopulations first to find it by name.

updatePopulation

Updates a population by full replacement, and assigns its default identity provider. Call getPopulation first and resend the complete object, since omitted fields are cleared. Do not use to create a population; use createPopulation instead.

deletePopulation

Permanently deletes a population. Refuses non-empty and default populations. Use dryRun to verify the target before committing.

Example prompts

"List all populations in my environment"
"Create a new population called External Users"
"Update the description of the Employees population"

Applications

Register and configure OIDC, SAML, worker, and catalog template applications. Manage their grants, authentication policies, attribute mappings, push credentials, client secrets, and role assignments.

Core application management

Tool Description

Tool	Description
`listApplications`	Lists applications in the environment. Use to discover applications by name, type, or protocol when you do not have an applicationId. Call getApplication when you already have the ID and need the full configuration. Returns 1 - 1000 results per page (default 20).
`getApplication`	Returns the full configuration of a single application plus every sub-resource scoped to it: metadata, masked secret and rotation state, attribute mappings, flow policy assignments, grants, push credentials, role assignments, and sign-on policy assignments. Use when you already have the applicationId. Call listApplications first to find it by name, type, or protocol. A sub-resource the caller lacks permission for is omitted and reported in `partialFailures` rather than failing the whole call.
`createApplication`	Creates a new application. Subtype selects the configuration surface: oidc_web_app, oidc_native, oidc_single_page, oidc_worker, oidc_device_authorization, saml, or template_app. Grant-type defaults are injected automatically. SAML supports raw xmlMetadata import as an alternative to structured fields. Use subtype "template_app" to create from a catalog template; call listApplicationCatalog first to choose the template and see what it requires.
`updateApplication`	Updates an existing application. Handles read-merge-write internally; pass only the fields that change. Pass null to clear a field; arrays are replaced in full, not merged. type and protocol cannot be changed. Also dispatches sub-resource writes via operations: attribute mappings, flow-policy assignments, sign-on-policy assignments, grants, push credentials, role assignments, secret rotation, and metadata. Operations may be sent together with base-app fields in the same call; every operation and the base-app update run concurrently, and each reports its own success or failure independently.
`deleteApplication`	Permanently deletes an application. Refuses system-managed applications (Admin Console, Portal, Self-Service). Use dryRun to verify the target before committing.
`listApplicationCatalog`	Browse the PingOne application catalog of prebuilt integration templates, or inspect a chosen template to see what it requires before creating from it. Use to find a template and gather its configuration, then call createApplication with subtype "template_app". Not for listing already-created applications; use listApplications for that. Returns 1 - 1000 results per page.

listApplications

Lists applications in the environment. Use to discover applications by name, type, or protocol when you do not have an applicationId. Call getApplication when you already have the ID and need the full configuration. Returns 1 - 1000 results per page (default 20).

getApplication

Returns the full configuration of a single application plus every sub-resource scoped to it: metadata, masked secret and rotation state, attribute mappings, flow policy assignments, grants, push credentials, role assignments, and sign-on policy assignments. Use when you already have the applicationId. Call listApplications first to find it by name, type, or protocol. A sub-resource the caller lacks permission for is omitted and reported in partialFailures rather than failing the whole call.

createApplication

Creates a new application. Subtype selects the configuration surface: oidc_web_app, oidc_native, oidc_single_page, oidc_worker, oidc_device_authorization, saml, or template_app. Grant-type defaults are injected automatically. SAML supports raw xmlMetadata import as an alternative to structured fields. Use subtype "template_app" to create from a catalog template; call listApplicationCatalog first to choose the template and see what it requires.

updateApplication

Updates an existing application. Handles read-merge-write internally; pass only the fields that change. Pass null to clear a field; arrays are replaced in full, not merged. type and protocol cannot be changed. Also dispatches sub-resource writes via operations: attribute mappings, flow-policy assignments, sign-on-policy assignments, grants, push credentials, role assignments, secret rotation, and metadata. Operations may be sent together with base-app fields in the same call; every operation and the base-app update run concurrently, and each reports its own success or failure independently.

deleteApplication

Permanently deletes an application. Refuses system-managed applications (Admin Console, Portal, Self-Service). Use dryRun to verify the target before committing.

listApplicationCatalog

Browse the PingOne application catalog of prebuilt integration templates, or inspect a chosen template to see what it requires before creating from it. Use to find a template and gather its configuration, then call createApplication with subtype "template_app". Not for listing already-created applications; use listApplications for that. Returns 1 - 1000 results per page.

Example prompts

"List all applications in my environment"
"Create a single-page app called My SPA with redirect URI http://localhost:3000/callback"
"Create a worker application from the Salesforce template in the catalog"
"What grants does the My API app have?"
"Add the openid and email scopes to the My App grant for the PingOne API resource"
"Rotate the client secret for My Worker App and keep the old one valid for 24 hours"
"Assign the Identity Data Admin role to My Worker App for environment xyz"

Resources

Create and manage OAuth 2.0 protected resources representing APIs that applications request access to.

Tool Description

Tool	Description
`listResources`	Lists all resources in an environment, the protected APIs that applications request access to. Use to find a resource by name when you do not have a resourceId, or to resolve the resourceId for createApplicationGrant. Call getResource when you already have the ID and need the full configuration.
`getResource`	Returns a single resource, optionally with its scopes, attributes, and masked client secret. Use when you already have the resourceId, including to capture current state before updating. Call listResources first if you only know the resource by name.
`createResource`	Creates a new custom resource representing a protected API. Only custom resources can be created; the built-in OpenID Connect and PingOne API resources already exist. Do not use to modify an existing resource, use updateResource instead.
`updateResource`	Changes a custom resource and its scopes, attributes, and client secret in one call, including removing individual scopes and attributes. Built-in system resources cannot be changed. Use only to modify an existing resource; use createResource to make a new one, and deleteResource only to remove the whole resource. Operations are not atomic: on a partial failure, retry only the items that failed.
`deleteResource`	Permanently deletes a custom resource and its scopes. Refuses the built-in OpenID Connect and PingOne API resources. Use dryRun to verify the target before committing.

listResources

Lists all resources in an environment, the protected APIs that applications request access to. Use to find a resource by name when you do not have a resourceId, or to resolve the resourceId for createApplicationGrant. Call getResource when you already have the ID and need the full configuration.

getResource

Returns a single resource, optionally with its scopes, attributes, and masked client secret. Use when you already have the resourceId, including to capture current state before updating. Call listResources first if you only know the resource by name.

createResource

Creates a new custom resource representing a protected API. Only custom resources can be created; the built-in OpenID Connect and PingOne API resources already exist. Do not use to modify an existing resource, use updateResource instead.

updateResource

Changes a custom resource and its scopes, attributes, and client secret in one call, including removing individual scopes and attributes. Built-in system resources cannot be changed. Use only to modify an existing resource; use createResource to make a new one, and deleteResource only to remove the whole resource. Operations are not atomic: on a partial failure, retry only the items that failed.

deleteResource

Permanently deletes a custom resource and its scopes. Refuses the built-in OpenID Connect and PingOne API resources. Use dryRun to verify the target before committing.

Example prompts

"List all resources in my environment"
"Create a new resource called My API with audience https://api.example.com"
"Add read and write scopes to My API resource"
"What scopes does the PingOne API resource have?"

Users

Create, read, update, and manage users in an environment, including their passwords, MFA enrollment, and account status.

Tool Description

Tool	Description
`listUsers`	Searches users in an environment when the userId is unknown. Call getUser instead when you already have the ID. Returns 1 - 200 results per page (default 100).
`getUser`	Reads one user, optionally bundling related state (MFA, password, roles, groups, consents, linked accounts, sessions) that would otherwise take separate calls. Use when you already have the userId. Call listUsers first if you only know the user by name or attribute.
`createUser`	Creates a new user in an environment, optionally requiring email verification. Use when provisioning a new user; use updateUser to modify an existing one.
`updateUser`	Changes a user’s profile or any of their relationships in one call: enable or disable, account lock, identity provider, population, admin and application roles, groups, agreement consents, linked external accounts, sessions. Use for any user change except MFA (use updateUserMfa) and passwords (use updateUserPassword). Call listRoles first if you do not already have the admin role you intend to grant. Operations are not atomic: on a partial failure, retry only the items that failed.
`deleteUser`	Permanently deletes a user, along with their MFA devices, sessions, and role assignments. Use to remove a user outright; use updateUser to lock an account you may want to restore.
`updateUserMfa`	Changes a user’s MFA configuration: enablement, temporary bypass, enrolled devices, and device pairing keys. This is the only tool that can change MFA; updateUser cannot. Call getUser first to read the current MFA state.
`updateUserPassword`	Forces a password change at next sign-on, unlocks a locked-out password, or sends the user a recovery code to redeem themselves. This is the only tool that operates on passwords; updateUser cannot.
`updateUser`	Changes a user’s profile or any of their relationships in one call: enable or disable, account lock, identity provider, population, admin and application roles, groups, agreement consents, linked external accounts, sessions. Use for any user change except MFA (use updateUserMfa) and passwords (use updateUserPassword). Call listRoles first if you do not already have the admin role you intend to grant. Operations are not atomic: on a partial failure, retry only the items that failed.

listUsers

Searches users in an environment when the userId is unknown. Call getUser instead when you already have the ID. Returns 1 - 200 results per page (default 100).

getUser

Reads one user, optionally bundling related state (MFA, password, roles, groups, consents, linked accounts, sessions) that would otherwise take separate calls. Use when you already have the userId. Call listUsers first if you only know the user by name or attribute.

createUser

Creates a new user in an environment, optionally requiring email verification. Use when provisioning a new user; use updateUser to modify an existing one.

updateUser

Changes a user’s profile or any of their relationships in one call: enable or disable, account lock, identity provider, population, admin and application roles, groups, agreement consents, linked external accounts, sessions. Use for any user change except MFA (use updateUserMfa) and passwords (use updateUserPassword). Call listRoles first if you do not already have the admin role you intend to grant. Operations are not atomic: on a partial failure, retry only the items that failed.

deleteUser

Permanently deletes a user, along with their MFA devices, sessions, and role assignments. Use to remove a user outright; use updateUser to lock an account you may want to restore.

updateUserMfa

Changes a user’s MFA configuration: enablement, temporary bypass, enrolled devices, and device pairing keys. This is the only tool that can change MFA; updateUser cannot. Call getUser first to read the current MFA state.

updateUserPassword

Forces a password change at next sign-on, unlocks a locked-out password, or sends the user a recovery code to redeem themselves. This is the only tool that operates on passwords; updateUser cannot.

updateUser

Example prompts

"Find all users with @example.com email addresses"
"Create a test user with username testuser1 in the Employees population"
"Force a password reset for user abc@example.com"
"Disable MFA for user xyz@example.com for 30 minutes"
"Unlock the account for user abc123"
"List users who have been locked out"

Provisioning

Tool Description

Tool	Description
`listProvisioningConnections`	Lists provisioning connections (stores) in an environment. Use to discover connection IDs and statuses. Set includeActions to true to retrieve the full configuration including advanced action settings per connection. Call getProvisioningConnection when you already have the ID and need the full detail.
`getProvisioningConnection`	Returns the full configuration of a single provisioning connection, including advanced action settings (user create/update/disable, group sync, membership sync). Call listProvisioningConnections first to find the connection ID by name.
`updateProvisioningConnection`	Enables or disables a provisioning connection. Before enabling non-internal connections, a connectivity test is run — the enable is rejected if unreachable. Use listProvisioningConnections to find the connection ID and check its current status first.
`listProvisioningRules`	Lists provisioning rules in an environment. Use to discover rule IDs by name, direction, or active state. Call getProvisioningRule when you already have the ID and need the full configuration including attribute mappings; attribute mapping retrieval requires getProvisioningRule.
`getProvisioningRule`	Returns the full configuration of a single provisioning rule, including all attribute mappings. Call listProvisioningRules first to find the rule ID by name. Use this before updating a rule to inspect its current state.
`createProvisioningRule`	Creates or clones a provisioning rule (always inactive; enable via updateProvisioningRule). To clone: provide sourceRuleId — use listProvisioningRules to find it. To create: provide direction — OUTBOUND requires targetStoreId, INBOUND requires sourceStoreId; use listProvisioningConnections to find IDs. The opposing store ID is resolved automatically.
`updateProvisioningRule`	Updates a provisioning rule. Only supplied fields are changed; omitted fields are left as-is. Enabling a rule (active: true) validates that both the source and target connections are ACTIVE and that the rule has a user filter configured. Use listProvisioningRules to find the rule ID.
`deleteProvisioningRule`	Permanently and irreversibly deletes a provisioning rule and all its attribute mappings. The rule does not need to be deactivated first. Fails if another rule references this one as a parent (Workday writeback rules must be deleted before their parent inbound rule). Use dryRun to verify the target before committing. Call listProvisioningRules to find the rule ID.
`syncProvisioningRule`	Triggers a sync on a provisioning rule. mode "full" replicates all users from source to target (interrupts any in-progress sync); mode "partial" applies only changes since the last poll (LdapGateway source connections only, environment-wide). The rule must be active. Use listProvisioningRules to find the rule ID.

listProvisioningConnections

Lists provisioning connections (stores) in an environment. Use to discover connection IDs and statuses. Set includeActions to true to retrieve the full configuration including advanced action settings per connection. Call getProvisioningConnection when you already have the ID and need the full detail.

getProvisioningConnection

Returns the full configuration of a single provisioning connection, including advanced action settings (user create/update/disable, group sync, membership sync). Call listProvisioningConnections first to find the connection ID by name.

updateProvisioningConnection

Enables or disables a provisioning connection. Before enabling non-internal connections, a connectivity test is run — the enable is rejected if unreachable. Use listProvisioningConnections to find the connection ID and check its current status first.

listProvisioningRules

Lists provisioning rules in an environment. Use to discover rule IDs by name, direction, or active state. Call getProvisioningRule when you already have the ID and need the full configuration including attribute mappings; attribute mapping retrieval requires getProvisioningRule.

getProvisioningRule

Returns the full configuration of a single provisioning rule, including all attribute mappings. Call listProvisioningRules first to find the rule ID by name. Use this before updating a rule to inspect its current state.

createProvisioningRule

Creates or clones a provisioning rule (always inactive; enable via updateProvisioningRule). To clone: provide sourceRuleId — use listProvisioningRules to find it. To create: provide direction — OUTBOUND requires targetStoreId, INBOUND requires sourceStoreId; use listProvisioningConnections to find IDs. The opposing store ID is resolved automatically.

updateProvisioningRule

Updates a provisioning rule. Only supplied fields are changed; omitted fields are left as-is. Enabling a rule (active: true) validates that both the source and target connections are ACTIVE and that the rule has a user filter configured. Use listProvisioningRules to find the rule ID.

deleteProvisioningRule

Permanently and irreversibly deletes a provisioning rule and all its attribute mappings. The rule does not need to be deactivated first. Fails if another rule references this one as a parent (Workday writeback rules must be deleted before their parent inbound rule). Use dryRun to verify the target before committing. Call listProvisioningRules to find the rule ID.

syncProvisioningRule

Triggers a sync on a provisioning rule. mode "full" replicates all users from source to target (interrupts any in-progress sync); mode "partial" applies only changes since the last poll (LdapGateway source connections only, environment-wide). The rule must be active. Use listProvisioningRules to find the rule ID.

Audit activity

Tool Description

Tool	Description
`searchAuditActivities`	Search audit events for a PingOne environment. Use to investigate activity history, trace actor actions, identify what changed on a resource, or review compliance events. MUST ask the user for (1) the environment and (2) the desired time range before calling — the default is only the last 24 hours and will silently miss older events. If results are empty, do NOT automatically search other environments — ask the user which environment to try next. When displaying results, always show a table with columns: Full Activity ID (complete UUID, never truncated), Timestamp (UTC), Event Type, Description, Client. To fetch full detail for a known activityId, use getAuditActivity instead.
`getAuditActivity`	Fetch the complete detail of a single audit event by ID. Use when you have an activityId from searchAuditActivities and need more than the summary view provides. To find events, use searchAuditActivities instead. IMPORTANT: always display the raw JSON response exactly as returned — do not summarise, reformat, or omit any fields.

searchAuditActivities

Search audit events for a PingOne environment. Use to investigate activity history, trace actor actions, identify what changed on a resource, or review compliance events. MUST ask the user for (1) the environment and (2) the desired time range before calling — the default is only the last 24 hours and will silently miss older events. If results are empty, do NOT automatically search other environments — ask the user which environment to try next. When displaying results, always show a table with columns: Full Activity ID (complete UUID, never truncated), Timestamp (UTC), Event Type, Description, Client. To fetch full detail for a known activityId, use getAuditActivity instead.

getAuditActivity

Fetch the complete detail of a single audit event by ID. Use when you have an activityId from searchAuditActivities and need more than the summary view provides. To find events, use searchAuditActivities instead. IMPORTANT: always display the raw JSON response exactly as returned — do not summarise, reformat, or omit any fields.

Roles

Tool Description

Tool	Description
`listRoles`	Lists the predefined (built-in) admin roles available for assignment. Use to choose a role to assign. Call getRole once you have a role and need what it grants. Custom roles are not returned.
`getRole`	Returns what a single predefined (built-in) admin role grants. Use to check its privileges before assigning it, or to explain an existing assignment. Use listRoles instead if you do not already have the role. Custom roles cannot be retrieved.

listRoles

Lists the predefined (built-in) admin roles available for assignment. Use to choose a role to assign. Call getRole once you have a role and need what it grants. Custom roles are not returned.

getRole

Returns what a single predefined (built-in) admin role grants. Use to check its privileges before assigning it, or to explain an existing assignment. Use listRoles instead if you do not already have the role. Custom roles cannot be retrieved.

Groups

Tool Description

Tool	Description
`listGroups`	Lists groups in an environment. Use to discover groups by name, population, or external ID when you do not have a groupId. Call getGroup when you already have the ID and need the full configuration. Returns 1 - 200 results per page (default 100).
`getGroup`	Returns a group’s full configuration, optionally with its members, total member count, and role assignments (all of them, or one by roleAssignmentId). Use when you already have the groupId. Call listGroups first to find it by name.
`createGroup`	Creates a new group in an environment, optionally scoped to a population. Use when provisioning a group to organize users or grant application access. Member and nested-group operations require a known groupId — use updateGroup for those. Do not use to modify an existing group — use updateGroup instead.
`updateGroup`	Changes a group, its direct memberships, nested-group relationships, and role assignments in one call. Handles read-merge-write internally for the group settings; pass only the fields that change. population.id cannot be changed after creation, and isAdmin cannot be set directly. Operations are not atomic: on a partial failure, retry only the items that failed.
`deleteGroup`	Permanently deletes a group. If the group has admin role assignments, those roles are removed from its members. Use dryRun to verify the target before committing.

listGroups

Lists groups in an environment. Use to discover groups by name, population, or external ID when you do not have a groupId. Call getGroup when you already have the ID and need the full configuration. Returns 1 - 200 results per page (default 100).

getGroup

Returns a group’s full configuration, optionally with its members, total member count, and role assignments (all of them, or one by roleAssignmentId). Use when you already have the groupId. Call listGroups first to find it by name.

createGroup

Creates a new group in an environment, optionally scoped to a population. Use when provisioning a group to organize users or grant application access. Member and nested-group operations require a known groupId — use updateGroup for those. Do not use to modify an existing group — use updateGroup instead.

updateGroup

Changes a group, its direct memberships, nested-group relationships, and role assignments in one call. Handles read-merge-write internally for the group settings; pass only the fields that change. population.id cannot be changed after creation, and isAdmin cannot be set directly. Operations are not atomic: on a partial failure, retry only the items that failed.

deleteGroup

Permanently deletes a group. If the group has admin role assignments, those roles are removed from its members. Use dryRun to verify the target before committing.

DaVinci

Manage DaVinci flows, applications, connectors, variables, forms, and execution history.

DaVinci tools are only available when your environment has the DaVinci capability enabled.

Flows

Tool Description

Tool	Description
`createDavinciFlow`	Creates, clones, or imports a DaVinci flow. Pass flowId to clone an existing flow (all other fields are ignored). Pass importFilePath (local server only) or importJson (works everywhere, including remote deployments) to import a DaVinci export — modern exports (flow.id present) accept field overrides; legacy exports (flowId at root) do not. Both parameters also accept a bare flow JSON payload (no export wrapper), treated as a plain create body with inline overrides merged on top. Omit all three to create from scratch — name is then required. IMPORTANT: When importing via importJson or importFilePath, pass the JSON exactly as provided by the user — never modify, summarise, or reconstruct the flow content.
`listDavinciFlows`	Lists DaVinci flows. Use to discover a flow before calling getDavinciFlow or the flow execution tools. Flow type is derived from the `trigger` field: no trigger = standard, AUTHENTICATION = PingOne, AUTHENTICATION+CIBA = CIBA, SCHEDULE = scheduled, BATCH_PROCESSING_SUBFLOW = batch subflow.
`getDavinciFlow`	Returns the complete definition of a DaVinci flow, including its full node graph and settings. Use when you already have the flowId; call listDavinciFlows first to find it. Also dispatches flow sub-operations via operationParams (4 operations, all require flowId): "validateFlow" — runs the DVLinter engine and returns errors and warnings; zero errors means deployment-ready; errors appear in `linterError` on each node (`graphData.elements.nodes`) and in `allLinterErrors` on `graphData`; "listFlowVersions" — lists all saved versions of the flow; "getFlowVersion" — returns the complete definition of a specific historical flow version including its node graph and settings, requires versionId; "exportFlowVersion" — exports a specific flow version as a portable JSON payload, requires versionId; IMPORTANT: before using exportFlowVersion, ask the user: (1) Should sub-flows referenced by this version be included in the export? (2) Should variable values be included? (3) Should form definitions be included? Set includeSubFlows, includeVariableValues, and includeForms based on answers; after receiving the response write the exact file to the user’s machine without any modifications as <flowName>_Export_<timestamp>.json where timestamp is the current UTC time in ISO 8601 format with colons replaced by underscores (e.g. 2026-08-05T10_40_57.944Z). operationParams may be sent together with base GET fields (attributes, expand) in the same call to retrieve both in one round trip.
`listDavinciFlowExecutions`	Lists past executions of a DaVinci flow. Use to find a specific run before calling getDavinciFlowExecution for its event log. Call listDavinciFlows first to find the flow. Returns 1 - 500 results per page (default 500).
`getDavinciFlowExecution`	Returns the event log of a single flow execution. Use to debug failures, verify data transformations, or investigate user-specific issues. Use when you already have the flowId and interactionId; call listDavinciFlowExecutions first to find the execution.
`updateDavinciFlow`	Performs write operations on a DaVinci flow. Specify `operation`: "updateFlow" — replaces the flow definition, requires `body` with the full flow object; "enableFlow" — enables or disables the flow, requires `enabled` boolean; "deployFlow" — deploys the flow to production; "setVersionAlias" — assigns an alias to a flow version, requires `versionId` and `alias`; "revertFlow" — reverts the flow to a specific saved version, requires `versionId`. Call listDavinciFlows first to find the flowId; call getDavinciFlow with operationParams.operation="listFlowVersions" to find the versionId for setVersionAlias and revertFlow.
`deleteDavinciFlow`	Permanently deletes a DaVinci flow or a specific flow version. Call listDavinciFlows first to find the flowId; call getDavinciFlow with operationParams.operation="listFlowVersions" to find the versionId. This action is irreversible. Use dryRun to verify the target before committing.

createDavinciFlow

Creates, clones, or imports a DaVinci flow. Pass flowId to clone an existing flow (all other fields are ignored). Pass importFilePath (local server only) or importJson (works everywhere, including remote deployments) to import a DaVinci export — modern exports (flow.id present) accept field overrides; legacy exports (flowId at root) do not. Both parameters also accept a bare flow JSON payload (no export wrapper), treated as a plain create body with inline overrides merged on top. Omit all three to create from scratch — name is then required. IMPORTANT: When importing via importJson or importFilePath, pass the JSON exactly as provided by the user — never modify, summarise, or reconstruct the flow content.

listDavinciFlows

Lists DaVinci flows. Use to discover a flow before calling getDavinciFlow or the flow execution tools. Flow type is derived from the trigger field: no trigger = standard, AUTHENTICATION = PingOne, AUTHENTICATION+CIBA = CIBA, SCHEDULE = scheduled, BATCH_PROCESSING_SUBFLOW = batch subflow.

getDavinciFlow

Returns the complete definition of a DaVinci flow, including its full node graph and settings. Use when you already have the flowId; call listDavinciFlows first to find it. Also dispatches flow sub-operations via operationParams (4 operations, all require flowId): "validateFlow" — runs the DVLinter engine and returns errors and warnings; zero errors means deployment-ready; errors appear in linterError on each node (graphData.elements.nodes) and in allLinterErrors on graphData; "listFlowVersions" — lists all saved versions of the flow; "getFlowVersion" — returns the complete definition of a specific historical flow version including its node graph and settings, requires versionId; "exportFlowVersion" — exports a specific flow version as a portable JSON payload, requires versionId; IMPORTANT: before using exportFlowVersion, ask the user: (1) Should sub-flows referenced by this version be included in the export? (2) Should variable values be included? (3) Should form definitions be included? Set includeSubFlows, includeVariableValues, and includeForms based on answers; after receiving the response write the exact file to the user’s machine without any modifications as <flowName>_Export_<timestamp>.json where timestamp is the current UTC time in ISO 8601 format with colons replaced by underscores (e.g. 2026-08-05T10_40_57.944Z). operationParams may be sent together with base GET fields (attributes, expand) in the same call to retrieve both in one round trip.

listDavinciFlowExecutions

Lists past executions of a DaVinci flow. Use to find a specific run before calling getDavinciFlowExecution for its event log. Call listDavinciFlows first to find the flow. Returns 1 - 500 results per page (default 500).

getDavinciFlowExecution

Returns the event log of a single flow execution. Use to debug failures, verify data transformations, or investigate user-specific issues. Use when you already have the flowId and interactionId; call listDavinciFlowExecutions first to find the execution.

updateDavinciFlow

Performs write operations on a DaVinci flow. Specify operation: "updateFlow" — replaces the flow definition, requires body with the full flow object; "enableFlow" — enables or disables the flow, requires enabled boolean; "deployFlow" — deploys the flow to production; "setVersionAlias" — assigns an alias to a flow version, requires versionId and alias; "revertFlow" — reverts the flow to a specific saved version, requires versionId. Call listDavinciFlows first to find the flowId; call getDavinciFlow with operationParams.operation="listFlowVersions" to find the versionId for setVersionAlias and revertFlow.

deleteDavinciFlow

Permanently deletes a DaVinci flow or a specific flow version. Call listDavinciFlows first to find the flowId; call getDavinciFlow with operationParams.operation="listFlowVersions" to find the versionId. This action is irreversible. Use dryRun to verify the target before committing.

Applications

Tool Description

Tool	Description
`listDavinciApplications`	Lists DaVinci applications. Use to discover an application before calling getDavinciApplication for its full details.
`getDavinciApplication`	Returns the full configuration of a single DaVinci application or flow policy. Use when you already have the applicationId, or the applicationId and policyId for a specific flow policy; call listDavinciApplications first to find it.
`createDavinciApplication`	Creates a new DaVinci application. Use when an application does not exist; use updateDavinciApplication to modify an existing one.
`updateDavinciApplication`	Updates an existing DaVinci application’s OAuth/API-key configuration, rotates its API key or secret, or adds/updates one of its flow policies. Use createDavinciApplication instead for a brand-new application, and deleteDavinciApplication to remove an application or a flow policy.
`deleteDavinciApplication`	Permanently deletes a DaVinci application, or detaches a single flow policy from it. Use to remove an application, or to remove a flow policy from an application; use updateDavinciApplication instead if you just want to change a flow policy rather than remove it. Call getDavinciApplication first to find the current applicationId/policyId.

listDavinciApplications

Lists DaVinci applications. Use to discover an application before calling getDavinciApplication for its full details.

getDavinciApplication

Returns the full configuration of a single DaVinci application or flow policy. Use when you already have the applicationId, or the applicationId and policyId for a specific flow policy; call listDavinciApplications first to find it.

createDavinciApplication

Creates a new DaVinci application. Use when an application does not exist; use updateDavinciApplication to modify an existing one.

updateDavinciApplication

Updates an existing DaVinci application’s OAuth/API-key configuration, rotates its API key or secret, or adds/updates one of its flow policies. Use createDavinciApplication instead for a brand-new application, and deleteDavinciApplication to remove an application or a flow policy.

deleteDavinciApplication

Permanently deletes a DaVinci application, or detaches a single flow policy from it. Use to remove an application, or to remove a flow policy from an application; use updateDavinciApplication instead if you just want to change a flow policy rather than remove it. Call getDavinciApplication first to find the current applicationId/policyId.

Connectors

Tool Description

Tool	Description
`listDavinciConnectors`	Discovers connector types and deployed instances. Use to browse or search. Use getDavinciConnector instead once you have identified a specific one.
`getDavinciConnector`	Returns full details for a specific, known connector type or instance. Use listDavinciConnectors instead to discover what exists.
`createDavinciConnector`	Creates a new DaVinci connector instance, either fresh or as a clone of an existing instance. Call listDavinciConnectors first to find the connectorId or connectorInstanceId — do not call getDavinciConnector as a prerequisite step. Do NOT use to modify an existing instance, use updateDavinciConnector instead.
`updateDavinciConnector`	Updates mutable fields of an existing DaVinci connector instance; omitted fields retain their current values. Use when the connector instance already exists; use createDavinciConnector to create a new one. Call listDavinciConnectors first to find the connectorInstanceId.
`deleteDavinciConnector`	Permanently deletes a DaVinci connector instance. Blocks deletion if any flow references the connector instance. Use dryRun to verify the target before committing. Call listDavinciConnectors first to find the connectorInstanceId. Do NOT use to update, use updateDavinciConnector instead.
`getDavinciConnectorCapabilityOptions`	Returns the available option values for a connector instance’s capability fields. Use when configuring a capability in a flow. Call listDavinciConnectors first to find the connectorId and connectorInstanceId. Do NOT use for connector update, use updateDavinciConnector instead.

listDavinciConnectors

Discovers connector types and deployed instances. Use to browse or search. Use getDavinciConnector instead once you have identified a specific one.

getDavinciConnector

Returns full details for a specific, known connector type or instance. Use listDavinciConnectors instead to discover what exists.

createDavinciConnector

Creates a new DaVinci connector instance, either fresh or as a clone of an existing instance. Call listDavinciConnectors first to find the connectorId or connectorInstanceId — do not call getDavinciConnector as a prerequisite step. Do NOT use to modify an existing instance, use updateDavinciConnector instead.

updateDavinciConnector

Updates mutable fields of an existing DaVinci connector instance; omitted fields retain their current values. Use when the connector instance already exists; use createDavinciConnector to create a new one. Call listDavinciConnectors first to find the connectorInstanceId.

deleteDavinciConnector

Permanently deletes a DaVinci connector instance. Blocks deletion if any flow references the connector instance. Use dryRun to verify the target before committing. Call listDavinciConnectors first to find the connectorInstanceId. Do NOT use to update, use updateDavinciConnector instead.

getDavinciConnectorCapabilityOptions

Returns the available option values for a connector instance’s capability fields. Use when configuring a capability in a flow. Call listDavinciConnectors first to find the connectorId and connectorInstanceId. Do NOT use for connector update, use updateDavinciConnector instead.

Variables

Tool Description

Tool	Description
`listDavinciVariables`	Lists DaVinci variables with their data types and context. Use to discover a variable before calling getDavinciVariable for its full configuration. Returns 1 - 50 results per page (default 10).
`getDavinciVariable`	Returns the full configuration of a single DaVinci variable, including its context, type, and default value. Use when you already have the variableId; call listDavinciVariables first to find it.
`createDavinciVariable`	Creates a new DaVinci variable. Use when a variable does not exist; use updateDavinciVariable to modify an existing one.
`updateDavinciVariable`	Updates mutable fields of an existing DaVinci variable; omitted fields retain their current values. Use when the variable already exists; use createDavinciVariable to create a new one. Call listDavinciVariables first to find the variableId.
`deleteDavinciVariable`	Permanently deletes a DaVinci variable. Blocks deletion if any flow references the variable. Use dryRun to verify the target before committing. Call listDavinciVariables first to find the variableId. Do NOT use to update, use updateDavinciVariable instead.

listDavinciVariables

Lists DaVinci variables with their data types and context. Use to discover a variable before calling getDavinciVariable for its full configuration. Returns 1 - 50 results per page (default 10).

getDavinciVariable

Returns the full configuration of a single DaVinci variable, including its context, type, and default value. Use when you already have the variableId; call listDavinciVariables first to find it.

createDavinciVariable

Creates a new DaVinci variable. Use when a variable does not exist; use updateDavinciVariable to modify an existing one.

updateDavinciVariable

Updates mutable fields of an existing DaVinci variable; omitted fields retain their current values. Use when the variable already exists; use createDavinciVariable to create a new one. Call listDavinciVariables first to find the variableId.

deleteDavinciVariable

Permanently deletes a DaVinci variable. Blocks deletion if any flow references the variable. Use dryRun to verify the target before committing. Call listDavinciVariables first to find the variableId. Do NOT use to update, use updateDavinciVariable instead.

Forms

Tool Description

Tool	Description
`listDavinciForms`	Lists DaVinci forms. Use to discover a form before calling getDavinciForm for its full configuration.
`getDavinciForm`	Returns the full configuration of a single DaVinci form, including all fields and layout. Use when you already have the formId; call listDavinciForms first to find it.
`createDavinciForm`	Creates a new DaVinci form from scratch. Use when building a sign-on, registration, password reset, or other identity form that does not yet exist. To modify a form that already exists, use updateDavinciForm instead.
`updateDavinciForm`	Updates an existing DaVinci form by ID using a read-merge-write strategy: reads the current form, deep-merges the supplied delta, strips server-managed fields, and sends a full-replacement PUT. Use when you already have the formId; call listDavinciForms first to find it. Always show the user the proposed changes and ask for explicit confirmation before proceeding.
`deleteDavinciForm`	Permanently deletes a DaVinci form by ID. Use when you already have the formId; call listDavinciForms first to find it. This action is irreversible. Use dryRun to verify the target before committing.

listDavinciForms

Lists DaVinci forms. Use to discover a form before calling getDavinciForm for its full configuration.

getDavinciForm

Returns the full configuration of a single DaVinci form, including all fields and layout. Use when you already have the formId; call listDavinciForms first to find it.

createDavinciForm

Creates a new DaVinci form from scratch. Use when building a sign-on, registration, password reset, or other identity form that does not yet exist. To modify a form that already exists, use updateDavinciForm instead.

updateDavinciForm

Updates an existing DaVinci form by ID using a read-merge-write strategy: reads the current form, deep-merges the supplied delta, strips server-managed fields, and sends a full-replacement PUT. Use when you already have the formId; call listDavinciForms first to find it. Always show the user the proposed changes and ask for explicit confirmation before proceeding.

deleteDavinciForm

Permanently deletes a DaVinci form by ID. Use when you already have the formId; call listDavinciForms first to find it. This action is irreversible. Use dryRun to verify the target before committing.

UI templates

Tool Description

Tool	Description
`listDavinciUiTemplates`	Lists DaVinci UI templates for the environment. Use to discover a UI template before calling getDavinciUiTemplate for its full configuration.
`getDavinciUiTemplate`	Returns the full configuration of a DaVinci UI template; Use when you already have the uiTemplateId; call listDavinciUiTemplates first to find it.
`createDavinciUiTemplate`	Creates a new DaVinci UI template. Use when building a login, registration, or other identity UI template that does not yet exist. To modify a template that already exists, use updateDavinciUiTemplate instead.
`updateDavinciUiTemplate`	Updates an existing DaVinci UI template. Use when you already have the uiTemplateId; call listDavinciUiTemplates first to find it.
`deleteDavinciUiTemplate`	Permanently deletes a DaVinci UI template. Use when you already have the uiTemplateId; call listDavinciUiTemplates first to find it. This action is irreversible. Use dryRun to verify the target before committing. Pass force: true to bypass the guard that blocks deletion when the template is still referenced by flows.

listDavinciUiTemplates

Lists DaVinci UI templates for the environment. Use to discover a UI template before calling getDavinciUiTemplate for its full configuration.

getDavinciUiTemplate

Returns the full configuration of a DaVinci UI template; Use when you already have the uiTemplateId; call listDavinciUiTemplates first to find it.

createDavinciUiTemplate

Creates a new DaVinci UI template. Use when building a login, registration, or other identity UI template that does not yet exist. To modify a template that already exists, use updateDavinciUiTemplate instead.

updateDavinciUiTemplate

Updates an existing DaVinci UI template. Use when you already have the uiTemplateId; call listDavinciUiTemplates first to find it.

deleteDavinciUiTemplate

Permanently deletes a DaVinci UI template. Use when you already have the uiTemplateId; call listDavinciUiTemplates first to find it. This action is irreversible. Use dryRun to verify the target before committing. Pass force: true to bypass the guard that blocks deletion when the template is still referenced by flows.

Example prompts

"List all DaVinci flows"
"Show me the last 10 executions of the Registration flow"
"What happened during execution xyz-456?"
"List all DaVinci connector instances in my environment"
"Create a new DaVinci variable called sessionTimeout with value 3600"
"Show me all DaVinci forms"

Build with AI

Available tools (early access)

Environments

Example prompts

Populations

Example prompts

Applications

Core application management

Example prompts

Resources

Example prompts

Users

Example prompts

Provisioning

Audit activity

Roles

Groups

DaVinci

Flows

Applications

Connectors

Variables

Forms

UI templates

Example prompts