API overview for external developers

DotID exposes partner APIs for developers who build applications on the FlexGalaxy.AI APaaS. These APIs use common product names so integrators do not need to know internal service code names.

Where APIs Are Published

External developer APIs are exported through the public API edge.

Environment

Base URL

Local simulation

http://api.dev.fgai.test

Production

https://api.flexgalaxy.ai

Your integration contract is exactly two things: the base URL above and the capability path you call under it —

/developer/v1/…   /service-catalog/v1/…   /identity/v1/…   /accounts/v1/…
/organizations/v1/…   /passport/v1/…   /quota/v1/…   /audit/v1/…

Everything behind that edge — which gateway product terminates it, how it is deployed, and which internal service answers — is an implementation choice you cannot observe and must not depend on. It can change without notice; the base URL and the capability path cannot.

Local development may also use direct service ports while debugging, but examples and published API docs should use the edge-facing names.

API Families

API family

Purpose

identity

Identity-related APIs for users, groups, permission sets, and assignments that are safe to expose to registered applications.

passport

Application-scoped login, launch, session, and scope checks for PassPort-registered applications.

accounts

Account-level discovery and account-scoped application installation workflows.

organizations

Organization-level discovery and organization-scoped installation workflows.

service-catalog

Discover services, capabilities, application registrations, and installable integrations.

developer

Register developer-facing capabilities and application scopes.

quota

Read quota information and submit quota adjustment requests where the caller is allowed.

audit

Read audit events available to the caller’s account or organization context.

Internal service code names are not part of the external contract.

Authentication

Protected tenant APIs exported through the public API edge use AWS-shaped signed requests:

  • an Account service user uses a static AKIA access-key id and secret; or

  • a workforce user uses temporary DotID STS ASIA credentials, including the signed X-FGAI-Security-Token header.

Human OAuth/OIDC bearer tokens authenticate browser sessions, not CLI or direct public API-edge calls. Platform-admin operations are available only in the admin-console web app and are not partner APIs. A runtime workload may obtain a service-audience JWT through token exchange for a service-specific contract; that token is not a stored CLI command credential.

Do not call Keycloak Admin APIs from a partner application. Keycloak is the identity provider behind DotID, not the public management API.

Resource naming

Names of resources that double as stable identifiers — Identity Center groups and permission sets, IAM users (service users), groups, roles, managed and inline policies, SCPs, resource policies, and workload identities — must match the AWS IAM / Identity Center name charset ^[\w+=,.@-]+$: letters, digits, and + = , . @ _ - only (no spaces or other whitespace, and no other punctuation). These names are referenced by value (FRN segments, group↔permission-set pairing, customer-managed-policy name resolution), so anything outside the charset is rejected with a 400 at create/update time. Use - or _ for word breaks (e.g. store-manager, not Store Manager). Free-text description fields and human display names (organization and account names, user first/last names) are unaffected.

What Is Not Exported

The following surfaces are internal and are not partner APIs:

  • Platform admin-console APIs used by internal admin apps.

  • First-root plus standalone-Account bootstrap (POST /accounts/v1). Existing Organizations use the public member-account/provisioning capabilities instead.

  • Console-only APIs used by first-party web apps.

  • Internal service-to-service endpoints.

  • Raw Keycloak Admin REST endpoints.

  • Terraform, deployment, seed, or operator endpoints.

If your integration needs a capability that appears to live behind one of those surfaces, request a partner API instead of depending on the internal route.

Documentation Format

External API references are published as an aggregated, read-only Stoplight Elements page at https://docs.flexgalaxy.ai/api/dotid/. They are read-only by design so external developers can browse schemas, status codes, and examples without sending live requests from the documentation site.

See OpenAPI reference for the published specifications and External developer API example for a working integration walkthrough.