Forgerock PingOne Advanced Identity Cloud API
Agent-ready OpenAPI document · curated by JenticIdentity AuthDirectory Servicesoauth2, apiKey, basic67 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Manage Advanced Identity Cloud tenant environments, certificates, custom domains, secrets, variables, and config promotions from agent code.
Use for: I need to upload a new TLS certificate to a PingOne Advanced Identity Cloud environment, I want to list all custom domains configured on this tenant, Find a specific environment secret by ID, Get the current state of a promotion lock
Not supported: Does not handle end-user authentication journeys, OAuth client management, or directory record CRUD - use for PingOne Advanced Identity Cloud tenant environment configuration, certificates, secrets, variables, and promotions only.
Jentic publishes the only available OpenAPI specification for PingOne Advanced Identity Cloud API, keeping it validated and agent-ready. PingOne Advanced Identity Cloud (formerly ForgeRock Identity Cloud) is an enterprise identity platform used to manage tenant configuration, certificates, custom domains, federation, environment promotions, secrets, and variables. The API exposes 67 endpoints across environment management with multiple authentication options including OAuth 2.0, API key plus secret, and basic auth.
Install Jentic One Beta
Connect the PingOne Advanced Identity Cloud API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the PingOne Advanced Identity Cloud API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fforgerock.io%2Fforgerock" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fforgerock.io%2Fforgerock" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with PingOne Advanced Identity Cloud API.
Manage TLS certificates and certificate signing requests for tenant environments
Configure cookie domains, custom domains, and content security policies
Issue and rotate environment secrets and variables
Promote configuration between environments using promotion locks and reports
Configure federation enforcement and SSO settings on a tenant
Read environment counts and inspect promotion state
Authenticate with API key and secret for read-only operations or access tokens for writes
Use Cases
Patterns agents use PingOne Advanced Identity Cloud API for, with concrete tasks.
★ Tenant Environment Configuration
Manage day-two configuration of an Advanced Identity Cloud tenant by automating certificate uploads, custom domains, cookie domains, and CSP rules. The API surfaces these as discrete endpoints under /environment so platform engineers can codify their identity environment alongside other infra-as-code. This eliminates manual portal work for repeatable changes.
Upload a new certificate to /environment/certificates and then add a custom domain via /environment/custom-domains for the supplied hostname.
Secrets and Variables Management
Manage environment secrets and variables through the corresponding endpoints to inject runtime configuration into Identity Cloud journeys and scripts. Useful for rotating secrets without redeploying configuration and for keeping environment-specific values out of journey JSON. Each secret and variable is referenced by ID in journey logic.
Rotate the secret named 'auth-signing-key' in /environment/secrets and update its value to the new key supplied by the user.
Config Promotion Workflows
Promote configuration changes from a development tenant to staging and production using the promotion endpoints under /environment/promotion. Lock the promotion to prevent concurrent changes, run the promotion, and inspect state via the promotion report. This formalises the move from manual exports to a controlled, auditable rollout pipeline.
Acquire a promotion lock via /environment/promotion/lock, trigger a promotion via /environment/promotion/promote, and return the new lock state.
Federation and SSO Management
Use /environment/federation/enforcement to enable or disable federation enforcement on a tenant, ensuring SSO requirements match policy. Useful for security teams running periodic compliance checks or enforcing a baseline across multiple tenants. The endpoint returns the current enforcement state and lets you toggle it.
Read /environment/federation/enforcement and switch enforcement to enabled if it is currently disabled.
AI Agent Identity Operations via Jentic
Agents use Jentic's intent search to find Identity Cloud operations, load the schema for the right environment endpoint, and execute calls under a scoped credential. This is the recommended pattern for platform copilots that automate routine identity admin tasks without exposing the underlying API key, secret, or access token to the model.
Use Jentic to search 'list Advanced Identity Cloud certificates', load the GET /environment/certificates schema, and return the IDs and expiry dates of all certificates on the tenant.
Key Endpoints
67 endpoints — jentic publishes the only available openapi specification for pingone advanced identity cloud api, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/environment/certificates
List installed TLS certificates
GET
/environment/certificates/{id}
Retrieve a certificate by ID
GET
/environment/csrs
List certificate signing requests
GET
/environment/custom-domains
List custom domains
GET
/environment/cookie-domains
List cookie domains
POST
/environment/promotion/lock
Acquire a promotion lock
POST
/environment/promotion/promote
Run a promotion
GET
/environment/federation/enforcement
Read federation enforcement state
GET
/environment/certificates
List installed TLS certificates
GET
/environment/certificates/{id}
Retrieve a certificate by ID
GET
/environment/csrs
List certificate signing requests
GET
/environment/custom-domains
List custom domains
GET
/environment/cookie-domains
List cookie domains
POST
/environment/promotion/lock
Acquire a promotion lock
POST
/environment/promotion/promote
Run a promotion
GET
/environment/federation/enforcement
Read federation enforcement state
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the PingOne Advanced Identity Cloud API by hand means picking among its OAuth 2.0 authorization-code flow, its paired x-api-key-id and x-api-key-secret headers, and HTTP Basic auth, then building your own retry and error handling around the environment endpoints. Through Jentic you install once, import it from the API Directory, store the chosen credential once, and your agent calls it.
Permission scoping
Advanced Identity Cloud puts the certificate id in the URL path (/environment/certificates/{id}), so a rule can pin your agent to reading certificates and related environment records. You choose the operations it may call, so the promotion lock and promote operations that change tenant configuration are not included unless you add them.
Credential isolation
Your chosen Advanced Identity Cloud credential, whether the API key pair, OAuth client credentials, or Basic auth pair, is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'list Advanced Identity Cloud certificates', and Jentic returns the GET /environment/certificates operation with its query schema so the agent runs the right call without browsing the Ping Identity docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using PingOne Advanced Identity Cloud API through Jentic.
Why is there no official OpenAPI spec for PingOne Advanced Identity Cloud API?
Ping Identity publishes reference docs but the only consolidated OpenAPI 3.0 specification is generated and maintained by Jentic so AI agents and developers can call PingOne Advanced Identity Cloud API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.
What authentication does the PingOne Advanced Identity Cloud API use?
The API supports three schemes: an API key id and secret pair (in headers x-api-key-id and x-api-key-secret) for read-only tenant operations, OAuth 2.0 access tokens for write and access management operations, and basic auth as a fallback. Jentic stores the chosen credential encrypted in your Jentic One instance.
Can I rotate environment secrets with the PingOne Advanced Identity Cloud API?
Yes, the /environment/secrets endpoints let you list, create, update, and delete tenant secrets. Rotating a secret in the API immediately makes the new value available to journeys and scripts that reference it by name.
What are the rate limits for the PingOne Advanced Identity Cloud API?
The OpenAPI spec does not declare explicit rate limits. Ping Identity applies tenant-level throughput controls in production - back off on 429 responses and avoid running large promotion or certificate operations in tight loops.
How do I run a config promotion through Jentic?
Search Jentic for 'promote Advanced Identity Cloud config', acquire a lock via /environment/promotion/lock, then load and execute /environment/promotion/promote. Read /environment/promotion/lock/state to confirm the lock has been released.
Does the PingOne Advanced Identity Cloud API support custom domains?
Yes, /environment/custom-domains and /environment/custom-domains/{realm} let you list and manage custom domains attached to specific realms. Pair this with /environment/certificates to upload the matching TLS certificate.
Can I limit what my agent is allowed to do with the PingOne Advanced Identity Cloud API?
Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials your agent may use, and you choose exactly which environment endpoints it can call. Since the certificate id sits in the URL path at /environment/certificates/{id}, you can pin the agent to read-only certificate and environment record lookups while excluding write operations. The promotion lock and /environment/promotion/promote calls that change tenant configuration stay off limits unless you explicitly add them.
GET STARTED