DaVinci Admin Application Flow Policies

When: A POST /environments/{envID}/davinciApplications/{davinciApplicationID}/flowPolicies or a PUT /environments/{envID}/davinciApplications/{davinciApplicationID}/flowPolicies/{davinciAppFlowPolicyID} request supplies a body that violates the data model: an omitted flowDistributions array, an omitted name on update, a flow distribution entry without an id or version, an empty flowDistributions array on create, an empty successNodes array, a blank name, a blank trigger.subtype, a blank success node ID, a name longer than 256 characters, a trigger.type longer than 50 characters, more than 100 flowDistributions entries, an unknown status value, a name, status, or trigger.type value that is not a string, a name that starts with an unsupported character or contains a < or a ${ sequence, a property inside a flow distribution entry that the entry schema does not allow, or a flow distribution or success node ID that contains characters outside its allowed set

Details: One detail per validation error, each with the failing property path as the target. must have required property 'flowDistributions' with target flowDistributions when the create request omits flowDistributions. must have required property 'name' with target name when an update request omits name. must have required property 'id' or must have required property 'version' with the flow distribution entry path as the target, for example flowDistributions.0, when an entry omits either property. must NOT have fewer than 1 items with target flowDistributions when the create request supplies an empty flowDistributions array, and with the successNodes path as the target, for example flowDistributions.0.successNodes, for an empty successNodes array. must not be empty or blank for a blank name, a blank trigger.subtype, or a blank success node ID, for example with target flowDistributions.0.successNodes.0.id. must NOT have more than 256 characters for a name longer than 256 characters and must NOT have more than 50 characters for a trigger.type longer than 50 characters. must NOT have more than 100 items for more than 100 flowDistributions entries. must be one of the values: enabled or disabled for an unknown status value. must NOT have additional properties for a property inside a flow distribution entry that the entry schema does not allow. must match pattern "<pattern>", where the pattern is the JSON schema pattern for the property, for a name that starts with an unsupported character or contains a < or a ${ sequence, or for a flow distribution or success node ID that contains characters outside its allowed set. must be string for a property of the wrong JSON type, for example with target name.

When: A GET all flow policies request supplies a page, limit, filter, or expand query parameter longer than 256 characters, a GET flow policy events request includes any query parameter, or a DELETE flow policy request includes any query parameter

Details: For an overlong query parameter on a GET all flow policies request, detail code INVALID_PARAMETER with message must NOT have more than 256 characters and the overlong query parameter as the target. For a GET flow policy events request or a DELETE flow policy request that includes a query parameter, detail code INVALID_VALUE with message must NOT have additional properties and the rejected query parameter as the target.

When: A POST, PUT, or DELETE request targets an application that is read-only, or a POST or PUT request includes a read-only flow in flowDistributions

Details: Detail code CONSTRAINT_VIOLATION with message The request violates a constraint imposed by the service. No target is returned.

When: A POST or PUT request references flows that fail flow policy validation, for example a flow ID or flow version that does not exist, or a schedule-triggered policy that references more than one flow or a flow version that is not deployed

Details: Detail code CONSTRAINT_VIOLATION with message Flow validation failed. Please add valid flows. No target is returned.

When: A POST or PUT request includes flows whose trigger types do not resolve to a single trigger type, for example a PingOne authentication flow combined with a non-PingOne flow, or a flow reference that does not exist

Details: Detail code CONSTRAINT_VIOLATION with message This policy does not allow flows created with Ping and non-Ping triggers to be part of the same policy. No target is returned.

When: A POST or PUT request includes a trigger.configuration object for a policy whose flows do not resolve to the AUTHENTICATION trigger type

Details: Detail code CONSTRAINT_VIOLATION with message Non-PingOne Flow Policies do not support the configuration property. No target is returned.

When: A POST or PUT request includes flows that share a trigger type but resolve to different trigger subtypes

Details: Detail code CONSTRAINT_VIOLATION with message This policy does not allow flows with different trigger subtypes. No target is returned.

When: A GET all flow policies request supplies a filter query parameter that references an attribute other than createdBy.user.id, createdBy.client.id, updatedBy.user.id, or updatedBy.client.id, or an operator other than eq, and, or or, when actor metadata is enabled for the environment. When actor metadata is disabled, the filter parameter is ignored

Details: Detail code INVALID_PARAMETER with message The filter attribute was invalid or does not support filtering. and the invalid attribute as the target, or message The filter operator was invalid or not supported. and the invalid operator as the target. A filter that is not a well-formed SCIM expression returns detail code INVALID_FILTER with message The specified filter was invalid. and no target.

When: The actor lacks the davinci:create:flowPolicies permission (POST operations), the davinci:read:flowPolicies permission (GET operations, including the events endpoint), the davinci:update:flowPolicies permission (PUT operations), or the davinci:delete:flowPolicies permission (DELETE operations)

Details: None

When: Any operation references a DaVinci application ID that does not exist in the environment, or a GET one, PUT, or DELETE flow policy request or a GET flow policy events request references a flow policy ID that does not exist in the application

Details: None

When: A DELETE request targets an existing flow policy but the service cannot remove the policy from the application’s stored policy list, or the service encounters an unexpected internal failure while processing any flow policy operation

Details: None