Capabilities

The capabilities service provides operations to determine what an organization or an environment is capable of doing within PingOne with respect to:

The organization’s current PingOne license.
The current utilization of PingOne resources.
The current PingOne system limits.
The products and services included in the environment’s bill of materials.

The Capabilities service is closely associated with the Licenses and Bill of Materials (BOM) services. The PingOne license and BOM identify the Ping Identity products associated with your organization and environment, but these services do not enumerate the specific actions you can perform. You can use the capabilities service to check the capabilities provided by the current license and the environment’s BOM. For example, if the organization-level capability canCreateEnvironment is set to true, it shows that the license grants you the capability to create new environments. Likewise, there can be numerous capabilities at the environment level, depending on the products in the BOM. The following list shows some of the actions that you might be able to perform:

"canUseCredentials": false,
"canUseCredentialsPushNotifications": false,
"canUseCustomSchema": true,
"canUseDaVinciAdminPortal": true,

In this case, you can implement a custom user schema and you can access the DaVinci admin portal, but you cannot perform actions that use credentials or credential-based push notifications.

Capabilities events generated

Refer to Audit Reporting Events for the events generated.

Assigning admin roles and permissions to this service

Admin role assignments determine access to PingOne APIs. When assigning admin roles to this service, refer to PingOne Permissions by Service for the service-specific permissions.

You can also choose to assign admin roles based on particular service resources. Refer to PingOne Permissions by Resource when assigning admin roles per service resources.

Admin assignments to roles are set by:

Refer to Roles Management for more information.

Organization capabilities data model

Property Type Required Mutable Description

Property	Type	Required	Mutable	Description
`assignableLicenses.allowProduction`	Boolean	N/A	Read-only	Whether the license allows production environments.
`assignableLicenses.beginsAt`	Date	N/A	Read-only	When the license period starts.
`assignableLicenses.expiresAt`	Date	N/A	Read-only	When the license period ends.
`assignableLicenses.id`	String	N/A	Read-only	The license ID for a license that can be assigned to the organization.
`assignableLicenses.isTrial`	Boolean	N/A	Read-only	Whether the license is a trial license.
`assignableLicenses.name`	String	N/A	Read-only	The name of a license that can be assigned to the organization.
`assignableLicenses.package`	String	N/A	Read-only	The package type of a license that can be assigned to the organization.
`assignableLicenses.productTypes`	String[]	N/A	Read-only	The names of the PingOne product types for a license that can be assigned to the organization. Can be: `ADMIN`, `AGENT_IAM_CORE`, `AUTHORIZE`, `B2B_ESSENTIAL`, `B2B_PLUS`, `CIAM_ESSENTIAL`, `CIAM_PASSWORDLESS`, `CIAM_PLUS`, `CIAM_PREMIUM`, `CREDENTIALS`, `DAVINCI`, `DEVELOPER`, `ENHANCED_TRIAL`, `INTERNAL`, `JIT_TRIAL`, `LOADTEST`, `MFA`, `MFAWORKFORCE`, `P1_DIR`, `P1_SSO`, `PARTNERNFR`, `PINGID_WITH_P1`, `PRIVILEGE`, `PROTECT`, `SHADOW`, `SOLUTION`, `TRIAL`, `TRAINING`, `VERIFY`, `VERIFY_RECOGNIZE`, `WORKFORCE_ESSENTIAL`, `WORKFORCE_PLUS`, `WORKFORCE_PREMIUM`.
`assignableLicenses.supportedRegions`	String[]	N/A	Read-only	The names of the supported geographies for a license that can be assigned to the organization.
`canContactSupport`	Boolean	N/A	Read-only	Whether the organization can contact PingOne support.
`canCreateEnvironment`	Boolean	N/A	Read-only	Whether the organization can create an environment. A return value of `false` specifies that the organization’s maximum number of environments has been reached.
`canCreateEphemeralTrialLicenses`	Boolean	N/A	Read-only	Whether the organization can create short-term trial licenses.
`canUsePlatform`	Boolean	N/A	Read-only	The status of the associated license. Return values are `true` (ACTIVE) and `false` (TERMINATED).
`organizationId`	String	N/A	Read-only	The ID of the organization.

assignableLicenses.allowProduction

Boolean

N/A

Read-only

Whether the license allows production environments.

assignableLicenses.beginsAt

Date

N/A

Read-only

When the license period starts.

assignableLicenses.expiresAt

Date

N/A

Read-only

When the license period ends.

assignableLicenses.id

String

N/A

Read-only

The license ID for a license that can be assigned to the organization.

assignableLicenses.isTrial

Boolean

N/A

Read-only

Whether the license is a trial license.

assignableLicenses.name

String

N/A

Read-only

The name of a license that can be assigned to the organization.

assignableLicenses.package

String

N/A

Read-only

The package type of a license that can be assigned to the organization.

assignableLicenses.productTypes

String[]

N/A

Read-only

The names of the PingOne product types for a license that can be assigned to the organization. Can be: ADMIN, AGENT_IAM_CORE, AUTHORIZE, B2B_ESSENTIAL, B2B_PLUS, CIAM_ESSENTIAL, CIAM_PASSWORDLESS, CIAM_PLUS, CIAM_PREMIUM, CREDENTIALS, DAVINCI, DEVELOPER, ENHANCED_TRIAL, INTERNAL, JIT_TRIAL, LOADTEST, MFA, MFAWORKFORCE, P1_DIR, P1_SSO, PARTNERNFR, PINGID_WITH_P1, PRIVILEGE, PROTECT, SHADOW, SOLUTION, TRIAL, TRAINING, VERIFY, VERIFY_RECOGNIZE, WORKFORCE_ESSENTIAL, WORKFORCE_PLUS, WORKFORCE_PREMIUM.

assignableLicenses.supportedRegions

String[]

N/A

Read-only

The names of the supported geographies for a license that can be assigned to the organization.

canContactSupport

Boolean

N/A

Read-only

Whether the organization can contact PingOne support.

canCreateEnvironment

Boolean

N/A

Read-only

Whether the organization can create an environment. A return value of false specifies that the organization’s maximum number of environments has been reached.

canCreateEphemeralTrialLicenses

Boolean

N/A

Read-only

Whether the organization can create short-term trial licenses.

canUsePlatform

Boolean

N/A

Read-only

The status of the associated license. Return values are true (ACTIVE) and false (TERMINATED).

organizationId

String

N/A

Read-only

The ID of the organization.

Environment capabilities data model

Property Type Required Mutable Description

Property	Type	Required	Mutable	Description
`canAddResources`	Boolean	N/A	Read-only	Whether the license supports creation of resources in the specified environment.
`canAssignCustomRolesEverywhere`	Boolean	N/A	Read-only	Whether the license supports creation of custom roles in the specified environment.
`canAssignUsersRoles`	Boolean	N/A	Read-only	Whether the license supports role assignments in the specified environment.
`canContactSupport`	Boolean	N/A	Read-only	Whether the license allows contact of PingOne Support.
`canCreateConnections`	Boolean	N/A	Read-only	Whether the license supports creation of a application connections in the specified environment.
`canCreateCustomDomain`	Boolean	N/A	Read-only	Whether the license supports creation of a custom domain in the specified environment.
`canPromoteToProd`	Boolean	N/A	Read-only	Whether the environment’s `type` property can be promoted from `SANDBOX` to `PRODUCTION`.
`canSendMfaNotificationsOutsideWhitelist`	Boolean	N/A	Read-only	Whether the license supports sending notifications outside of the environment’s whitelist.
`canSendPasswordManagementNotifications`	Boolean	N/A	Read-only	Whether the license supports sending password management notifications.
`canSendVerificationFlowNotifications`	Boolean	N/A	Read-only	Whether the license supports sending verification flow notifications.
`canUseAadhaar`	Boolean	N/A	Read-only	Whether the license supports verification using unique identification number issued to residents of India by the Unique Identification Authority of India (UIDAI).
`canUseAamva`	Boolean	N/A	Read-only	Whether the license supports using additional verification support with American Association of Motor Vehicle Administrators (AAMVA).
`canUseAccountOwnership`	Boolean	N/A	Read-only	Not implemented.
`canUseAccountProtection`	Boolean	N/A	Read-only	Whether the license supports using account protection.
`canUseAccountTakeoverDetection`	Boolean	N/A	Read-only	Whether the license supports using account takeover detection.
`canUseAdvancedAuthn`	Boolean	N/A	Read-only	Whether the license supports SSO advanced features, such as accepting third-party tokens for Token Exchange and provisioning of applications or AI agents via Client ID Metadata Document.
`canUseAdvancedSts`	Boolean	N/A	Read-only	Whether a PingOne environment is licensed and enabled for advanced Security Token Service (STS) features, specifically including using PingOne as the federated STS to Entra ID for hybrid join and other WS-Trust 1.3 RST-based scenarios.
`canUseAgents`	Boolean	N/A	Read-only	Whether a given environment is actually licensed to create and run AI agents (“Agentic” features).
`canUseApiAccessManagement`	Boolean	N/A	Read-only	Whether the license supports using API Access Management services.
`canUseApplicationPermissions`	Boolean	N/A	Read-only	Whether the PingOne Authorize Application permissions feature is licensed and enabled for that environment
`canUseAuthorizeAgents`	Boolean	N/A	Read-only	Not implemented.
`canUseBotMaliciousDeviceDetection`	Boolean	N/A	Read-only	Whether the license supports using malicious BOT device detection capabilities.
`canUseConfigurationManagement`	Boolean	N/A	Read-only	Not implemented.
`canUseCredentials`	Boolean	N/A	Read-only	Whether the license supports using credentials services.
`canUseCredentialSharingDetection`	Boolean	N/A	Read-only	Whether the license supports using credential sharing detection capabilities.
`canUseCredentialsPushNotifications`	Boolean	N/A	Read-only	Whether the license supports using credentials push notifications services.
`canUseCustomSchema`	Boolean	N/A	Read-only	Whether the license supports using custom schema tributes in the specified environment.
`canUseDataAnalyticsSupport`	Boolean	N/A	Read-only	Whether the license supports using data analytics support services.
`canUseDataBasedVerifications`	Boolean	N/A	Read-only	Whether the license supports using data-based identity verification from TransUnion for the U.S.
`canUseDataVerificationGroup1`	Boolean	N/A	Read-only	Whether the license supports using data-based identity verification from DataZoo for countries in Group 1.
`canUseDataVerificationGroup2`	Boolean	N/A	Read-only	Whether the license supports using data-based identity verification from DataZoo for countries in Group 2.
`canUseDataVerificationGroup3`	Boolean	N/A	Read-only	Whether the license supports using data-based identity verification from DataZoo for countries in Group 3.
`canUseDataVerificationGroup4`	Boolean	N/A	Read-only	Whether the license supports using data-based identity verification from DataZoo for countries in Group 4.
`canUseDataVerificationGroup5`	Boolean	N/A	Read-only	Whether the license supports using data-based identity verification from DataZoo for countries in Group 5.
`canUseDaVinciAdminPortal`	Boolean	N/A	Read-only	Whether the license supports using the DaVinci admin portal.
`canUseDeviceReputationScoring`	Boolean	N/A	Read-only	Whether the license supports using verification through device ownership.
`canUseDigitalVerifications`	Boolean	N/A	Read-only	Whether the license supports using digital verifications services.
`canUseDocumentMatch`	Boolean	N/A	Read-only	Whether the license supports using document match services.
`canUseDynamicAuthorization`	Boolean	N/A	Read-only	Whether the license supports using dynamic authorization services.
`canUseEditNotificationTemplate`	Boolean	N/A	Read-only	Whether admins are allowed to edit email notification templates in that environment.
`canUseEmailOtp`	Boolean	N/A	Read-only	Whether the license supports using email OTP capabilities.
`canUseFaceMatch`	Boolean	N/A	Read-only	Whether the license supports using face match capabilities.
`canUseFraudDataEnrichment`	Boolean	N/A	Read-only	Whether the license supports using fraud data enrichment capabilities.
`canUseGlobalWatchlist`	Boolean	N/A	Read-only	Not implemented.
`canUseIdentities`	Boolean	N/A	Read-only	Whether the license supports using identities.
`canUseIdentityProviders`	Boolean	N/A	Read-only	Whether the license supports using external identity providers in the specified environment.
`canUseInboundProvisioning`	Boolean	N/A	Read-only	Whether the license supports using inbound provisioning services.
`canUseIntelligence`	Boolean	N/A	Read-only	Whether the license supports using PingIntellegence capabilities in the specified environment. This capability applies to the PingOne Platform and PingOne MFA products.
`canUseIntelligenceAdvancedPredictors`	Boolean	N/A	Read-only	Whether the license supports using PingIntellegence advanced predictors capabilities in the specified environment. This capability applies to the PingOne Platform and PingOne MFA products.
`canUseIntelligenceAnonymousNetworkDetection`	Boolean	N/A	Read-only	Whether the license supports using PingIntellegence anonymous network detection capabilities in the specified environment. This capability applies to the PingOne Platform and PingOne MFA products.
`canUseIntelligenceDataConsent`	Boolean	N/A	Mutable	Whether the customer consents to user and event behavior analytics (UEBA) collection capabilities in the specified environment. This capability applies to the PingOne Protect product.
`canUseIntelligenceEditPolicyScores`	Boolean	N/A	Mutable	Whether the license supports editing PingIntellegence policy scores in the specified environment.
`canUseIntelligenceGeoVelocity`	Boolean	N/A	Read-only	Whether the license supports using PingIntellegence geovelocity capabilities in the specified environment when a geovelocity anomaly is detected. This capability applies to the PingOne Protect and PingOne MFA products.
`canUseIntelligenceLastTransactionOlderThan`	Boolean	N/A	Read-only	Whether a PingOne environment is allowed to use the PingIntellegence “Last transaction older than …”, a time-since-last-transaction condition, in risk policy evaluation.
`canUseIntelligenceLimitedCompositePredictor`	Boolean	N/A	Read-only	Whether the license supports using a PingIntellegence composite risk predictor limited to combining IP and country as the additional risk factors.
`canUseIntelligenceNewDevicePredictor`	Boolean	N/A	Read-only	Whether the license supports using PingIntellegence New Device–type predictors in a Protect policy.
`canUseIntelligenceProtect`	Boolean	N/A	Read-only	Whether the license supports using protect capabilities in the specified environment. This capability applies to the PingOne Protect product.
`canUseIntelligenceReputation`	Boolean	N/A	Read-only	Whether the license supports using PingIntellegence reputation capabilities in the specified environment. This capability applies to the PingOne Platform and PingOne MFA products.
`canUseIntelligenceRisk`	Boolean	N/A	Read-only	Whether the license supports using Risk capabilities in the specified environment. This capability applies to the PingOne Protect product.
`canUseIntelligenceTrustDevicePredictor`	Boolean	N/A	Read-only	Whether the license supports using PingIntellegence Trusted Device predictors in a Protect policy.
`canUseKerberosGateway`	Boolean	N/A	Read-only	Whether the license supports using Kerberos gateway services.
`canUseLdapGateway`	Boolean	N/A	Read-only	Whether the license supports using LDAP gateway services.
`canUseLiveAgent`	Boolean	N/A	Read-only	Not implemented.
`canUseManualIdInspection`	Boolean	N/A	Read-only	Whether the license supports using manual document ID inspection services.
`canUseManualIDStepUpInspection`	Boolean	N/A	Read-only	Whether the license supports using manual document ID step-up inspection services.
`canUseMcpAccessManagement`	Boolean	N/A	Read-only	Not implemented.
`canUseMfa`	Boolean	N/A	Read-only	Whether the license supports using MFA in the specified environment.
`canUseMfaCiam`	Boolean	N/A	Read-only	Whether the environment is licensed to use PingOne MFA for consumer identity access management (CIAM).
`canUseMfaFido2Devices`	Boolean	N/A	Read-only	Whether the license supports MFA operations on FIDO2 devices.
`canUseMfaPushNotifications`	Boolean	N/A	Read-only	Whether the license supports MFA push authentication for native applications in the specified environment.
`canUseMfaSignOnPolicies`	Boolean	N/A	Read-only	Whether the environment is licensed to create and use MFA-specific sign-on policies.
`canUseMfaVoiceOtp`	Boolean	N/A	Read-only	Whether the license supports MFA voice OTP for native applications in the specified environment.
`canUseMfaWf`	Boolean	N/A	Read-only	Whether the environment is licensed to use PingOne MFA for workforce.
`canUseMyAccount`	Boolean	N/A	Read-only	Whether the license supports using the My Account capabilities in the specified environment.
`canUseNewAccountFraudDetection`	Boolean	N/A	Read-only	Whether the license supports using new account fraud detection capabilities in the specified environment.
`canUseOATHToken`	Boolean	N/A	Read-only	Whether a PingOne environment is licensed to use OATH-compliant tokens as MFA authenticators.
`canUseOrchestration`	Boolean	N/A	Read-only	Whether the license supports using orchestration capabilities in the specified environment.
`canUsePasswordManagement`	Boolean	N/A	Read-only	Whether the license supports using password management capabilities in the specified environment.
`canUsePasswordOnlyAuthentication`	Boolean	N/A	Read-only	Whether the license supports using password only login capabilities in the specified environment.
`canUsePasswordPolicy`	Boolean	N/A	Read-only	Whether the license supports using password policies in the specified environment.
`canUsePingIDApp`	Boolean	N/A	Read-only	Whether the environment is licensed to use the PingID mobile app as a mobile MFA method.
`canUsePingIdDesktop`	Boolean	N/A	Read-only	Whether the environment is licensed to use the legacy PingID desktop app as an MFA method.
`canUsePingIdDesktopGen2`	Boolean	N/A	Read-only	Whether the environment is licensed to use the generation 2 PingID desktop app as an MFA method.
`canUsePingSmsAccount`	Boolean	N/A	Read-only	Whether a PingOne tenant is allowed to use the Ping-managed SMS/voice provider for notifications instead of a customer’s own telephony provider.
`canUsePlatform`	Boolean	N/A	Read-only	The status of the associated license. Return values are `true` (ACTIVE) and `false` (TERMINATED).
`canUsePrivilege`	Boolean	N/A	Read-only	Whether the environment’s license is licensed to use PingOne Privilege.
`canUsePrivilegeCloudResources`	Boolean	N/A	Read-only	Whether the environment’s license is licensed to use PingOne Privilege for cloud resources.
`canUsePrivilegeOnPremResources`	Boolean	N/A	Read-only	Whether the environment’s license is licensed to use PingOne Privilege for on-premise resources.
`canUseProtectTransactions`	Boolean	N/A	Read-only	Whether the license supports using protect transaction capabilities in the specified environment.
`canUseProvisioning`	Boolean	N/A	Read-only	Whether the license supports using provisioning capabilities in the specified environment.
`canUseRadiusGateway`	Boolean	N/A	Read-only	Whether the license supports using radius gateway services.
`canUseRecognize`	Boolean	N/A	Read-only	Whether the environment’s license is licensed to use PingOne Recognize.
`canUsersUpdateSelf`	Boolean	N/A	Read-only	Whether the license supports allowing users to update their own profile.
`canUseScheduledFlows`	Boolean	N/A	Read-only	Whether the license supports creating and running DaVinci scheduled flows and batch-processing subflows.
`canUseSesTenant`	Boolean	N/A	Read-only	Whether a PingOne environment is licensed to use its own dedicated Amazon Simple Email Service (SES) tenant for notifications, instead of only using the shared SES tenant.
`canUseSmsOtp`	Boolean	N/A	Read-only	Whether the license supports using SMS OTP capabilities.
`canUseTotp`	Boolean	N/A	Read-only	Whether the license supports using TOTP capabilities.
`canUseUniversalCapture`	Boolean	N/A	Read-only	Whether the license supports using universal capture capabilities in the specified environment.
`canUseUniversalDeviceId`	Boolean	N/A	Read-only	Whether the license supports using universal ID, a persistent device identifier for trusted devices.
`canUseVerificationFlow`	Boolean	N/A	Read-only	Whether the license supports using verification flows in the specified environment.
`canUseVerify`	Boolean	N/A	Read-only	Whether the license supports using Verify in the specified environment.
`canUseVerifyPushNotifications`	Boolean	N/A	Read-only	Whether the license supports using verify push notifictions capabilities in the specified environment.
`canUseVerifyVoice`	Boolean	N/A	Read-only	Whether the license supports using verify voice capabilities in the specified environment.
`canUseWhatsAppOtp`	Boolean	N/A	Read-only	Whether the license supports using WhatsApp as a one-time password (OTP) delivery channel.
`canUseWinLogin`	Boolean	N/A	Read-only	Whether a PingOne environment is licensed to use the PingID Windows Login (Windows desktop/server login) MFA method.
`canUseYubikey`	Boolean	N/A	Read-only	Whether a PingOne environment is licensed to use YubiKey as an MFA factor.
`environmentId`	String	N/A	Read-only	The ID of the environment.
`licenseQuantities.numberOfAadhaar`	Integer	N/A	Read-only	How many Aadhaar-based verification transactions are included in that license.
`licenseQuantities.numberOfAccountOwnership`	Integer	N/A	Read-only	Not implemented.
`licenseQuantities.numberOfAgents`	Integer	N/A	Read-only	How many AI agents are included in that license.
`licenseQuantities.numberOfDataVerificationGroup1`	Integer	N/A	Read-only	How many DataZoo data-based identity verification transactions from Group 1 are included in that license.
`licenseQuantities.numberOfDataVerificationGroup2`	Integer	N/A	Read-only	How many DataZoo data-based identity verification transactions from Group 2 are included in that license.
`licenseQuantities.numberOfDataVerificationGroup3`	Integer	N/A	Read-only	How many DataZoo data-based identity verification transactions from Group 3 are included in that license.
`licenseQuantities.numberOfDataVerificationGroup4`	Integer	N/A	Read-only	How many DataZoo data-based identity verification transactions from Group 4 are included in that license.
`licenseQuantities.numberOfDataVerificationGroup5`	Integer	N/A	Read-only	How many DataZoo data-based identity verification transactions from Group 5 are included in that license.
`licenseQuantities.numberOfDataVerifications`	Integer	N/A	Read-only	How many TransUnion data-based identity verification transactions are included in that license.
`licenseQuantities.numberOfDeviceReputationScoring`	Integer	N/A	Read-only	How many device ownership verification transactions.
`licenseQuantities.numberOfGlobalWatchlist`	Integer	N/A	Read-only	Not implemented.
`licenseQuantities.numberOfLiveAgent`	Integer	N/A	Read-only	How many Not implemented.
`licenseQuantities.numberOfPrivilegeCloudResources`	Integer	N/A	Read-only	How many PingOne Privilege cloud resources are included in that license.
`licenseQuantities.numberOfPrivilegeOnPremResources`	Integer	N/A	Read-only	How many PingOne Privilege on-premise resources are included in that license.

canAddResources

Boolean

N/A

Read-only

Whether the license supports creation of resources in the specified environment.

canAssignCustomRolesEverywhere

Boolean

N/A

Read-only

Whether the license supports creation of custom roles in the specified environment.

canAssignUsersRoles

Boolean

N/A

Read-only

Whether the license supports role assignments in the specified environment.

canContactSupport

Boolean

N/A

Read-only

Whether the license allows contact of PingOne Support.

canCreateConnections

Boolean

N/A

Read-only

Whether the license supports creation of a application connections in the specified environment.

canCreateCustomDomain

Boolean

N/A

Read-only

Whether the license supports creation of a custom domain in the specified environment.

canPromoteToProd

Boolean

N/A

Read-only

Whether the environment’s type property can be promoted from SANDBOX to PRODUCTION.

canSendMfaNotificationsOutsideWhitelist

Boolean

N/A

Read-only

Whether the license supports sending notifications outside of the environment’s whitelist.

canSendPasswordManagementNotifications

Boolean

N/A

Read-only

Whether the license supports sending password management notifications.

canSendVerificationFlowNotifications

Boolean

N/A

Read-only

Whether the license supports sending verification flow notifications.

canUseAadhaar

Boolean

N/A

Read-only

Whether the license supports verification using unique identification number issued to residents of India by the Unique Identification Authority of India (UIDAI).

canUseAamva

Boolean

N/A

Read-only

Whether the license supports using additional verification support with American Association of Motor Vehicle Administrators (AAMVA).

canUseAccountOwnership

Boolean

N/A

Read-only

Not implemented.

canUseAccountProtection

Boolean

N/A

Read-only

Whether the license supports using account protection.

canUseAccountTakeoverDetection

Boolean

N/A

Read-only

Whether the license supports using account takeover detection.

canUseAdvancedAuthn

Boolean

N/A

Read-only

Whether the license supports SSO advanced features, such as accepting third-party tokens for Token Exchange and provisioning of applications or AI agents via Client ID Metadata Document.

canUseAdvancedSts

Boolean

N/A

Read-only

Whether a PingOne environment is licensed and enabled for advanced Security Token Service (STS) features, specifically including using PingOne as the federated STS to Entra ID for hybrid join and other WS-Trust 1.3 RST-based scenarios.

canUseAgents

Boolean

N/A

Read-only

Whether a given environment is actually licensed to create and run AI agents (“Agentic” features).

canUseApiAccessManagement

Boolean

N/A

Read-only

Whether the license supports using API Access Management services.

canUseApplicationPermissions

Boolean

N/A

Read-only

Whether the PingOne Authorize Application permissions feature is licensed and enabled for that environment

canUseAuthorizeAgents

Boolean

N/A

Read-only

Not implemented.

canUseBotMaliciousDeviceDetection

Boolean

N/A

Read-only

Whether the license supports using malicious BOT device detection capabilities.

canUseConfigurationManagement

Boolean

N/A

Read-only

Not implemented.

canUseCredentials

Boolean

N/A

Read-only

Whether the license supports using credentials services.

canUseCredentialSharingDetection

Boolean

N/A

Read-only

Whether the license supports using credential sharing detection capabilities.

canUseCredentialsPushNotifications

Boolean

N/A

Read-only

Whether the license supports using credentials push notifications services.

canUseCustomSchema

Boolean

N/A

Read-only

Whether the license supports using custom schema tributes in the specified environment.

canUseDataAnalyticsSupport

Boolean

N/A

Read-only

Whether the license supports using data analytics support services.

canUseDataBasedVerifications

Boolean

N/A

Read-only

Whether the license supports using data-based identity verification from TransUnion for the U.S.

canUseDataVerificationGroup1

Boolean

N/A

Read-only

Whether the license supports using data-based identity verification from DataZoo for countries in Group 1.

canUseDataVerificationGroup2

Boolean

N/A

Read-only

Whether the license supports using data-based identity verification from DataZoo for countries in Group 2.

canUseDataVerificationGroup3

Boolean

N/A

Read-only

Whether the license supports using data-based identity verification from DataZoo for countries in Group 3.

canUseDataVerificationGroup4

Boolean

N/A

Read-only

Whether the license supports using data-based identity verification from DataZoo for countries in Group 4.

canUseDataVerificationGroup5

Boolean

N/A

Read-only

Whether the license supports using data-based identity verification from DataZoo for countries in Group 5.

canUseDaVinciAdminPortal

Boolean

N/A

Read-only

Whether the license supports using the DaVinci admin portal.

canUseDeviceReputationScoring

Boolean

N/A

Read-only

Whether the license supports using verification through device ownership.

canUseDigitalVerifications

Boolean

N/A

Read-only

Whether the license supports using digital verifications services.

canUseDocumentMatch

Boolean

N/A

Read-only

Whether the license supports using document match services.

canUseDynamicAuthorization

Boolean

N/A

Read-only

Whether the license supports using dynamic authorization services.

canUseEditNotificationTemplate

Boolean

N/A

Read-only

Whether admins are allowed to edit email notification templates in that environment.

canUseEmailOtp

Boolean

N/A

Read-only

Whether the license supports using email OTP capabilities.

canUseFaceMatch

Boolean

N/A

Read-only

Whether the license supports using face match capabilities.

canUseFraudDataEnrichment

Boolean

N/A

Read-only

Whether the license supports using fraud data enrichment capabilities.

canUseGlobalWatchlist

Boolean

N/A

Read-only

Not implemented.

canUseIdentities

Boolean

N/A

Read-only

Whether the license supports using identities.

canUseIdentityProviders

Boolean

N/A

Read-only

Whether the license supports using external identity providers in the specified environment.

canUseInboundProvisioning

Boolean

N/A

Read-only

Whether the license supports using inbound provisioning services.

canUseIntelligence

Boolean

N/A

Read-only

Whether the license supports using PingIntellegence capabilities in the specified environment. This capability applies to the PingOne Platform and PingOne MFA products.

canUseIntelligenceAdvancedPredictors

Boolean

N/A

Read-only

Whether the license supports using PingIntellegence advanced predictors capabilities in the specified environment. This capability applies to the PingOne Platform and PingOne MFA products.

canUseIntelligenceAnonymousNetworkDetection

Boolean

N/A

Read-only

Whether the license supports using PingIntellegence anonymous network detection capabilities in the specified environment. This capability applies to the PingOne Platform and PingOne MFA products.

canUseIntelligenceDataConsent

Boolean

N/A

Mutable

Whether the customer consents to user and event behavior analytics (UEBA) collection capabilities in the specified environment. This capability applies to the PingOne Protect product.

canUseIntelligenceEditPolicyScores

Boolean

N/A

Mutable

Whether the license supports editing PingIntellegence policy scores in the specified environment.

canUseIntelligenceGeoVelocity

Boolean

N/A

Read-only

Whether the license supports using PingIntellegence geovelocity capabilities in the specified environment when a geovelocity anomaly is detected. This capability applies to the PingOne Protect and PingOne MFA products.

canUseIntelligenceLastTransactionOlderThan

Boolean

N/A

Read-only

Whether a PingOne environment is allowed to use the PingIntellegence “Last transaction older than …”, a time-since-last-transaction condition, in risk policy evaluation.

canUseIntelligenceLimitedCompositePredictor

Boolean

N/A

Read-only

Whether the license supports using a PingIntellegence composite risk predictor limited to combining IP and country as the additional risk factors.

canUseIntelligenceNewDevicePredictor

Boolean

N/A

Read-only

Whether the license supports using PingIntellegence New Device–type predictors in a Protect policy.

canUseIntelligenceProtect

Boolean

N/A

Read-only

Whether the license supports using protect capabilities in the specified environment. This capability applies to the PingOne Protect product.

canUseIntelligenceReputation

Boolean

N/A

Read-only

Whether the license supports using PingIntellegence reputation capabilities in the specified environment. This capability applies to the PingOne Platform and PingOne MFA products.

canUseIntelligenceRisk

Boolean

N/A

Read-only

Whether the license supports using Risk capabilities in the specified environment. This capability applies to the PingOne Protect product.

canUseIntelligenceTrustDevicePredictor

Boolean

N/A

Read-only

Whether the license supports using PingIntellegence Trusted Device predictors in a Protect policy.

canUseKerberosGateway

Boolean

N/A

Read-only

Whether the license supports using Kerberos gateway services.

canUseLdapGateway

Boolean

N/A

Read-only

Whether the license supports using LDAP gateway services.

canUseLiveAgent

Boolean

N/A

Read-only

Not implemented.

canUseManualIdInspection

Boolean

N/A

Read-only

Whether the license supports using manual document ID inspection services.

canUseManualIDStepUpInspection

Boolean

N/A

Read-only

Whether the license supports using manual document ID step-up inspection services.

canUseMcpAccessManagement

Boolean

N/A

Read-only

Not implemented.

canUseMfa

Boolean

N/A

Read-only

Whether the license supports using MFA in the specified environment.

canUseMfaCiam

Boolean

N/A

Read-only

Whether the environment is licensed to use PingOne MFA for consumer identity access management (CIAM).

canUseMfaFido2Devices

Boolean

N/A

Read-only

Whether the license supports MFA operations on FIDO2 devices.

canUseMfaPushNotifications

Boolean

N/A

Read-only

Whether the license supports MFA push authentication for native applications in the specified environment.

canUseMfaSignOnPolicies

Boolean

N/A

Read-only

Whether the environment is licensed to create and use MFA-specific sign-on policies.

canUseMfaVoiceOtp

Boolean

N/A

Read-only

Whether the license supports MFA voice OTP for native applications in the specified environment.

canUseMfaWf

Boolean

N/A

Read-only

Whether the environment is licensed to use PingOne MFA for workforce.

canUseMyAccount

Boolean

N/A

Read-only

Whether the license supports using the My Account capabilities in the specified environment.

canUseNewAccountFraudDetection

Boolean

N/A

Read-only

Whether the license supports using new account fraud detection capabilities in the specified environment.

canUseOATHToken

Boolean

N/A

Read-only

Whether a PingOne environment is licensed to use OATH-compliant tokens as MFA authenticators.

canUseOrchestration

Boolean

N/A

Read-only

Whether the license supports using orchestration capabilities in the specified environment.

canUsePasswordManagement

Boolean

N/A

Read-only

Whether the license supports using password management capabilities in the specified environment.

canUsePasswordOnlyAuthentication

Boolean

N/A

Read-only

Whether the license supports using password only login capabilities in the specified environment.

canUsePasswordPolicy

Boolean

N/A

Read-only

Whether the license supports using password policies in the specified environment.

canUsePingIDApp

Boolean

N/A

Read-only

Whether the environment is licensed to use the PingID mobile app as a mobile MFA method.

canUsePingIdDesktop

Boolean

N/A

Read-only

Whether the environment is licensed to use the legacy PingID desktop app as an MFA method.

canUsePingIdDesktopGen2

Boolean

N/A

Read-only

Whether the environment is licensed to use the generation 2 PingID desktop app as an MFA method.

canUsePingSmsAccount

Boolean

N/A

Read-only

Whether a PingOne tenant is allowed to use the Ping-managed SMS/voice provider for notifications instead of a customer’s own telephony provider.

canUsePlatform

Boolean

N/A

Read-only

The status of the associated license. Return values are true (ACTIVE) and false (TERMINATED).

canUsePrivilege

Boolean

N/A

Read-only

Whether the environment’s license is licensed to use PingOne Privilege.

canUsePrivilegeCloudResources

Boolean

N/A

Read-only

Whether the environment’s license is licensed to use PingOne Privilege for cloud resources.

canUsePrivilegeOnPremResources

Boolean

N/A

Read-only

Whether the environment’s license is licensed to use PingOne Privilege for on-premise resources.

canUseProtectTransactions

Boolean

N/A

Read-only

Whether the license supports using protect transaction capabilities in the specified environment.

canUseProvisioning

Boolean

N/A

Read-only

Whether the license supports using provisioning capabilities in the specified environment.

canUseRadiusGateway

Boolean

N/A

Read-only

Whether the license supports using radius gateway services.

canUseRecognize

Boolean

N/A

Read-only

Whether the environment’s license is licensed to use PingOne Recognize.

canUsersUpdateSelf

Boolean

N/A

Read-only

Whether the license supports allowing users to update their own profile.

canUseScheduledFlows

Boolean

N/A

Read-only

Whether the license supports creating and running DaVinci scheduled flows and batch-processing subflows.

canUseSesTenant

Boolean

N/A

Read-only

Whether a PingOne environment is licensed to use its own dedicated Amazon Simple Email Service (SES) tenant for notifications, instead of only using the shared SES tenant.

canUseSmsOtp

Boolean

N/A

Read-only

Whether the license supports using SMS OTP capabilities.

canUseTotp

Boolean

N/A

Read-only

Whether the license supports using TOTP capabilities.

canUseUniversalCapture

Boolean

N/A

Read-only

Whether the license supports using universal capture capabilities in the specified environment.

canUseUniversalDeviceId

Boolean

N/A

Read-only

Whether the license supports using universal ID, a persistent device identifier for trusted devices.

canUseVerificationFlow

Boolean

N/A

Read-only

Whether the license supports using verification flows in the specified environment.

canUseVerify

Boolean

N/A

Read-only

Whether the license supports using Verify in the specified environment.

canUseVerifyPushNotifications

Boolean

N/A

Read-only

Whether the license supports using verify push notifictions capabilities in the specified environment.

canUseVerifyVoice

Boolean

N/A

Read-only

Whether the license supports using verify voice capabilities in the specified environment.

canUseWhatsAppOtp

Boolean

N/A

Read-only

Whether the license supports using WhatsApp as a one-time password (OTP) delivery channel.

canUseWinLogin

Boolean

N/A

Read-only

Whether a PingOne environment is licensed to use the PingID Windows Login (Windows desktop/server login) MFA method.

canUseYubikey

Boolean

N/A

Read-only

Whether a PingOne environment is licensed to use YubiKey as an MFA factor.

environmentId

String

N/A

Read-only

The ID of the environment.

licenseQuantities.numberOfAadhaar

Integer

N/A

Read-only

How many Aadhaar-based verification transactions are included in that license.

licenseQuantities.numberOfAccountOwnership

Integer

N/A

Read-only

Not implemented.

licenseQuantities.numberOfAgents

Integer

N/A

Read-only

How many AI agents are included in that license.

licenseQuantities.numberOfDataVerificationGroup1

Integer

N/A

Read-only

How many DataZoo data-based identity verification transactions from Group 1 are included in that license.

licenseQuantities.numberOfDataVerificationGroup2

Integer

N/A

Read-only

How many DataZoo data-based identity verification transactions from Group 2 are included in that license.

licenseQuantities.numberOfDataVerificationGroup3

Integer

N/A

Read-only

How many DataZoo data-based identity verification transactions from Group 3 are included in that license.

licenseQuantities.numberOfDataVerificationGroup4

Integer

N/A

Read-only

How many DataZoo data-based identity verification transactions from Group 4 are included in that license.

licenseQuantities.numberOfDataVerificationGroup5

Integer

N/A

Read-only

How many DataZoo data-based identity verification transactions from Group 5 are included in that license.

licenseQuantities.numberOfDataVerifications

Integer

N/A

Read-only

How many TransUnion data-based identity verification transactions are included in that license.

licenseQuantities.numberOfDeviceReputationScoring

Integer

N/A

Read-only

How many device ownership verification transactions.

licenseQuantities.numberOfGlobalWatchlist

Integer

N/A

Read-only

Not implemented.

licenseQuantities.numberOfLiveAgent

Integer

N/A

Read-only

How many Not implemented.

licenseQuantities.numberOfPrivilegeCloudResources

Integer

N/A

Read-only

How many PingOne Privilege cloud resources are included in that license.

licenseQuantities.numberOfPrivilegeOnPremResources

Integer

N/A

Read-only

How many PingOne Privilege on-premise resources are included in that license.

Response codes

Code	Message
200	Successful operation.
400	The request could not be completed.
401	You do not have access to this resource.
403	You do not have permissions or are not licensed to make this request.
404	The requested resource was not found.

Capabilities errors

In addition to the general error codes, capabilities operations can return the following errors:

HTTP status Top‑level code Detail code When it happens and what the response contains

HTTP status	Top‑level code	Detail code	When it happens and what the response contains
400	`INVALID_DATA`	`INVALID_VALUE`	Message: `The request could not be completed. One or more validation errors were in the request.` When and details When: A `GET /environments/{environmentID}/capabilities` request supplies a `licenseId` query parameter that does not identify an existing license Details: `License specified to project environment capabilities does not exist.`
403	`ACCESS_FAILED`	`INSUFFICIENT_PERMISSIONS`	Message: `The request could not be completed. You do not have access to this resource.` When and details When: The actor is not entitled to the requested environment or organization, for example when the environment does not belong to the actor’s organization Details: `The actor attempting to perform the request is not authorized.`
403	`ACCESS_FAILED`	None	Message: `The actor attempting to perform the request is not authorized.` When and details When: The actor lacks the `orgmgt:read:environment` permission (`GET /environments/{environmentID}/capabilities`), or the `orgmgt:read:organization` permission (`GET /organizations/{organizationId}/capabilities`) Details: None.
404	`NOT_FOUND`	None	Message: `Unable to find environment with ID: '<environmentId>'` for environments, or `Unable to find organization: '<organizationId>'` for organizations. Non-UUID path identifiers and a null capabilities response return the generic not found message, `The request could not be completed. The requested resource was not found.` When and details When: The environment or organization in the request path does not exist Details: None.

400

INVALID_DATA

INVALID_VALUE

Message: The request could not be completed. One or more validation errors were in the request.

When and details

When: A GET /environments/{environmentID}/capabilities request supplies a licenseId query parameter that does not identify an existing license

Details: License specified to project environment capabilities does not exist.

403

ACCESS_FAILED

INSUFFICIENT_PERMISSIONS

Message: The request could not be completed. You do not have access to this resource.

When and details

When: The actor is not entitled to the requested environment or organization, for example when the environment does not belong to the actor’s organization

Details: The actor attempting to perform the request is not authorized.

403

ACCESS_FAILED

None

Message: The actor attempting to perform the request is not authorized.

When and details

When: The actor lacks the orgmgt:read:environment permission (GET /environments/{environmentID}/capabilities), or the orgmgt:read:organization permission (GET /organizations/{organizationId}/capabilities)

Details: None.

404

NOT_FOUND

None

Message: Unable to find environment with ID: '<environmentId>' for environments, or Unable to find organization: '<organizationId>' for organizations. Non-UUID path identifiers and a null capabilities response return the generic not found message, The request could not be completed. The requested resource was not found.

When and details

When: The environment or organization in the request path does not exist

Details: None.

You need Organization Admin role or the Environment Admin role to get the capabilities for an organization or an environment, respectively. For more information about roles, refer to Roles.

PingOne Platform APIs

Capabilities

Capabilities events generated

Assigning admin roles and permissions to this service

Organization capabilities data model

Environment capabilities data model

Response codes

Capabilities errors