Application Flow Policy Assignments

Flow policy assignment endpoints manage the flow policies associated with the specified application. An application can have zero or more flow policies assigned to it that determine how users are authenticated. The number of flow policies assigned to an application also controls how the authentication flow progresses.

No flow policy assignments

Applications that have no flow policy assignments use the environment resource’s default sign-on policy to authenticate users (or a designated sign-on policy assignment).

One flow policy assignment

Applications that have one flow policy assignment always use that flow policy to authenticate users.

Two or more flow policy assignments

If an application has two or more assigned flow policies, the authentication flow uses the flow policy with the highest priority (priority 1) first. If authentication is successful, the flow is complete. If authentication fails, the flow initiates the flow policy with the next highest priority. The flow continues until one of the assigned flow policies completes successfully or all policies have been tried and failed.

OIDC applications can request a lower-priority policy by using the acr_values OIDC parameter with the desired PingOne authentication name or DaVinci flow policy ID. Refer to OpenID Connect/OAuth2 data model.

SAML applications can request a lower-priority policy by sending a SAML 2.0 authentication request with the RequestedAuthnContext parameter, where the value indicates the desired PingOne authentication name or DaVinci flow policy ID. Note that the enableRequestAuthnContext must be set to true for the SAML application. Refer to SAML settings data model.

Flow policies and the PingOne application portal

If the PingOne application portal is not configured with any flow policies, it will use the default PingOne policy.

You can apply policies other than the default to the PingOne application portal by appending the policy query parameter to your Application Portal Home Page URL. For example, the Home Page URL https://apps.pingone.com/<envID>/myapps/ would become https://apps.pingone.com/<envID>/myapps/?policy=<value>, where <value> is the name of a configured PingOne policy, or the ID of a configured DaVinci flow policy. If the policy name or ID doesn’t match any configured policy, then PingOne returns an error.

Application flow policy assignments data model

Property Type Required Mutable Description

Property	Type	Required	Mutable	Description
`application.id`	String	Required	Read only	A string that specifies the application resource ID associated with the flow policy assignment.
`environment.id`	String	Required	Read only	A string that specifies the environment associated with the application.
`flowPolicy.id`	String	Required	Mutable	A string that specifies the flow policy resource ID associated with the flow policy assignment.
`id`	String	Required	Read only	A string that specifies the flow policy assignment resource’s unique identifier.
`priority`	Integer	Required	Mutable	The order in which the policy referenced by this assignment is evaluated during an authentication flow relative to other policies. An assignment with a lower priority will be evaluated first.

application.id

String

Required

Read only

A string that specifies the application resource ID associated with the flow policy assignment.

environment.id

String

Required

Read only

A string that specifies the environment associated with the application.

flowPolicy.id

String

Required

Mutable

A string that specifies the flow policy resource ID associated with the flow policy assignment.

id

String

Required

Read only

A string that specifies the flow policy assignment resource’s unique identifier.

priority

Integer

Required

Mutable

The order in which the policy referenced by this assignment is evaluated during an authentication flow relative to other policies. An assignment with a lower priority will be evaluated first.

Flow Policy events generated

Refer to Audit Reporting Events for the events generated.

Response codes

Code	Message
200	Successful operation.
201	Successfully created.
204	Successfully removed. No content.
400	The request could not be completed.
401	You do not have access to this resource.
403	You do not have permissions or are not licensed to make this request.
404	The requested resource was not found.
500	An unexpected error occurred.

Application flow policy assignment errors

In addition to the general error codes, application flow policy assignment operations can return the following errors:

HTTP status Top‑level code Detail code When it happens and what the response contains

HTTP status	Top‑level code	Detail code	When it happens and what the response contains
400	`INVALID_DATA`	`UNIQUENESS_VIOLATION`	Message: Flow policy '<flowPolicyId>' cannot be assigned to the application '<applicationId>' in environment '<environmentId>' multiple times. Existing flow policy assignment id is '<existingAssignmentId>' When and details When: Creating or updating an assignment would assign the same flow policy to the application more than once Details: `flow policy already assigned to the application`, with target `flowPolicy.id` and `innerError.existingId` identifying the existing assignment
400	`INVALID_DATA`	`EMPTY_VALUE` or `INVALID_VALUE`	Message: `Validation Error : <field errors>` When and details When: The request body omits `flowPolicy`, `flowPolicy.id`, or `priority`, or sets `priority` to less than `1` Details: Describes the failing property. A missing `priority` value returns `EMPTY_VALUE`, while a `priority` below `1` returns `INVALID_VALUE`.
400	`INVALID_REQUEST`	None	Message: `The request could not be completed. One or more validation errors were in the request.` When and details When: A path identifier cannot be parsed as a UUID Details: None.
400	`INVALID_REQUEST`	None	Message: `The request could not be completed. The request was malformed or invalid.` When and details When: The request body is missing or is not valid JSON syntax Details: None.
400	`INVALID_DATA`	`INVALID_VALUE`	Message: `The request could not be completed. One or more validation errors were in the request.` When and details When: A request body field cannot be converted to the expected type (for example, a non-UUID value where a UUID is expected) Details: `Invalid value for attribute.`, with target = the field path.
400	`REQUEST_FAILED`	None	Message: Describes the downstream error. When and details When: DaVinci returns an HTTP error status other than 404 while resolving the flow policy during assignment create or update Details: None.
404	`NOT_FOUND`	None	Message: `Unable to find an active Flow Policy with ID: '<flowPolicyId>' in Environment '<environmentId>'` When and details When: Creating or updating an assignment references a flow policy that does not exist or is disabled Details: None.
404	`NOT_FOUND`	None	Message: Unable to find Flow Policy Assignment with ID: '<assignmentId>' in Environment '<environmentId>' for Application '<applicationId>' When and details When: `GET`, `PUT`, or `DELETE /flowPolicyAssignments/{ID}` references an assignment that does not exist for the application Details: None.
500	`UNEXPECTED_ERROR`	None	Message: Describes the underlying failure. When and details When: Assignment mapping or storage processing fails after a request is accepted, or the DaVinci access token response is empty before resolving the flow policy Details: None.

400

INVALID_DATA

UNIQUENESS_VIOLATION

Message:

Flow policy '<flowPolicyId>' cannot be assigned to the application '<applicationId>' in environment '<environmentId>' multiple times. Existing flow policy assignment id is '<existingAssignmentId>'

When and details

When: Creating or updating an assignment would assign the same flow policy to the application more than once

Details: flow policy already assigned to the application, with target flowPolicy.id and innerError.existingId identifying the existing assignment

400

INVALID_DATA

EMPTY_VALUE or INVALID_VALUE

Message: Validation Error : <field errors>

When and details

When: The request body omits flowPolicy, flowPolicy.id, or priority, or sets priority to less than 1

Details: Describes the failing property. A missing priority value returns EMPTY_VALUE, while a priority below 1 returns INVALID_VALUE.

400

INVALID_REQUEST

None

Message: The request could not be completed. One or more validation errors were in the request.

When and details

When: A path identifier cannot be parsed as a UUID

Details: None.

400

INVALID_REQUEST

None

Message: The request could not be completed. The request was malformed or invalid.

When and details

When: The request body is missing or is not valid JSON syntax

Details: None.

400

INVALID_DATA

INVALID_VALUE

Message: The request could not be completed. One or more validation errors were in the request.

When and details

When: A request body field cannot be converted to the expected type (for example, a non-UUID value where a UUID is expected)

Details: Invalid value for attribute., with target = the field path.

400

REQUEST_FAILED

None

Message: Describes the downstream error.

When and details

When: DaVinci returns an HTTP error status other than 404 while resolving the flow policy during assignment create or update

Details: None.

404

NOT_FOUND

None

Message: Unable to find an active Flow Policy with ID: '<flowPolicyId>' in Environment '<environmentId>'

When and details

When: Creating or updating an assignment references a flow policy that does not exist or is disabled

Details: None.

404

NOT_FOUND

None

Message:

Unable to find Flow Policy Assignment with ID: '<assignmentId>' in Environment '<environmentId>' for Application '<applicationId>'

When and details

When: GET, PUT, or DELETE /flowPolicyAssignments/{ID} references an assignment that does not exist for the application

Details: None.

500

UNEXPECTED_ERROR

None

Message: Describes the underlying failure.

When and details

When: Assignment mapping or storage processing fails after a request is accepted, or the DaVinci access token response is empty before resolving the flow policy

Details: None.

PingOne Platform APIs

Application Flow Policy Assignments

No flow policy assignments

One flow policy assignment

Two or more flow policy assignments

Flow policies and the PingOne application portal

Application flow policy assignments data model

Flow Policy events generated

Response codes

Application flow policy assignment errors