Sign-On Policies Operations

When: A POST /signOnPolicies or PUT /signOnPolicies/{policyID} request omits the required name property, supplies a name containing spaces, supplies a name that is empty or longer than 256 characters, supplies a name containing characters other than Unicode letters, marks, numbers, forward slashes, dots, apostrophes, underscores, or hyphens and that does not contain a colon to form an absolute URI, or a POST request sets default to true

Details: Describes the failing property, such as must not be null for an omitted name (detail EMPTY_VALUE), cannot contain spaces for a name containing spaces (detail INVALID_VALUE), size must be between 1 and 256 (with rangeMinimumValue and rangeMaximumValue inner errors) for an empty or over-256-character name (detail OUT_OF_RANGE), must contain only Unicode letters, marks, numbers, forward slashes, dots, apostrophes, underscores, or hyphens or if name contains a colon, policy name URI must be absolute and must not contain a fragment component (detail INVALID_VALUE), or Cannot set a Sign-On Policy to default on create for a POST request setting default to true (detail INVALID_VALUE, target default), for example Validation Error : [name cannot contain spaces]

When: A POST /signOnPolicies request creates a sign-on policy with a name that duplicates another sign-on policy in the environment, or a PUT /signOnPolicies/{policyID} request renames the sign-on policy to one that does

Details: name already exists with target name and an existingId inner error carrying the duplicate policy’s ID

When: A POST /signOnPolicies request creates the hundred‑first sign-on policy in the environment (a maximum of 100 policies per environment is enforced, raised to 150 for environments with the increased-limit feature enabled), a PUT request sets the policy’s default property to true when the policy has no actions, a PUT request changes an environment’s default policy to a policy that requires MFA when the actor has MFA disabled or no valid registered devices, or a DELETE /signOnPolicies/{policyID} request deletes the environment’s default policy or would leave the actor locked out of a platform application

Details: Cannot create more than 100 policies per environment (or Cannot create more than 150 policies per environment for feature-enabled environments), An environment must have a default policy (a PUT request clearing the current default policy’s default flag), Cannot set a policy without actions as the default policy., Cannot set an MFA policy as the default policy when you have MFA disabled or no valid registered device., Cannot delete a default policy, or

When: A path identifier cannot be parsed as a UUID, or the request body cannot be deserialized

Details: For a JSON field conversion error, the detail is Invalid value for attribute. with target = the field path. Otherwise no detail is returned.

When: The actor lacks the authn:create:signOnPolicy permission (POST), the authn:read:signOnPolicy permission (GET operations), the authn:update:signOnPolicy permission (PUT), or the authn:delete:signOnPolicy permission (DELETE)

Details: None.

When: GET, PUT, or DELETE /signOnPolicies/{policyID} references a sign-on policy that does not exist in the environment

Details: None.