> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # List > Returns a page of authenticator enrollments. Pass `pageToken` from the previous response's `nextPageToken` to fetch the next page. A page can be empty while the results are still being prepared. Keep requesting pages until the response has no `nextPageToken`. Requires the `https://devx.{environment}.oleria.io/read` scope. ## OpenAPI ````yaml /developer-docs/api-reference/oleria-public-api-1.0.0.yaml get /v1/authenticator-enrollments openapi: 3.0.3 info: title: Oleria Public API version: 1.0.0 description: >- REST API for Oleria's identity and access data. Each resource is a collection exposing list and get operations; responses return the complete object. Where Oleria can change what it reports, the change is a method on the same resource: disabling an account is `POST /v1/accounts/{id}/disable`, and membership is a sub-resource asserted with `PUT` and removed with `DELETE`. Those changes are applied in the source application asynchronously: each returns a job under `/v1/action-jobs` that reports the outcome for every target it affected, and whether Oleria's own data reflects it yet. Authenticate with OAuth 2.0 client credentials and send the access token as `Authorization: Bearer `. servers: - url: https://devx.{environment}.oleria.io description: Oleria API server. variables: environment: default: prod description: >- Your Oleria deployment, for example `acme` for `https://devx.acme.oleria.io`. Substitute it in the OAuth scope names as well, since OpenAPI applies a server variable to the URL only and the scopes are published with the placeholder still in them. security: [] paths: /v1/authenticator-enrollments: get: tags: - Authenticator enrollments summary: List description: >- Returns a page of authenticator enrollments. Pass `pageToken` from the previous response's `nextPageToken` to fetch the next page. A page can be empty while the results are still being prepared. Keep requesting pages until the response has no `nextPageToken`. Requires the `https://devx.{environment}.oleria.io/read` scope. operationId: ListAuthenticatorEnrollments parameters: - $ref: '#/components/parameters/pageSize' - $ref: '#/components/parameters/pageToken' - $ref: '#/components/parameters/applicationInstanceId' responses: '200': description: A page of authenticator enrollments. content: application/json: schema: $ref: '#/components/schemas/AuthenticatorEnrollmentList' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalError' security: - oauth2: - https://devx.{environment}.oleria.io/read components: parameters: pageSize: name: pageSize in: query description: Maximum items per page. schema: type: integer format: int32 default: 50 minimum: 1 maximum: 200 pageToken: name: pageToken in: query description: >- Opaque page token from the previous response's `nextPageToken`. Omit it for the first page; pass it back exactly as received. Do not parse or construct it. schema: type: string applicationInstanceId: name: applicationInstanceId in: query description: >- Scope the list to a single application instance, identified by its id (UUID). An application instance is one connected integration in your tenant: a specific Okta, Workday, and so on. Omit it to list across all of your instances. schema: type: string format: uuid schemas: AuthenticatorEnrollmentList: type: object required: - items properties: items: type: array items: $ref: '#/components/schemas/Oleria_AuthenticatorEnrollment' nextPageToken: type: string description: >- Opaque token for the next page; pass it back as `pageToken`. Present whenever more pages remain, including when this page is empty because the results are still being prepared, and absent only once the collection is fully returned. Do not parse or construct it. Oleria_AuthenticatorEnrollment: type: object description: > An Oleria AuthenticatorEnrollment object represents a specific account's enrollment in an Oleria Authenticator, recording enrolled authentication methods, enrollment lifecycle, and optional device binding allOf: - $ref: '#/components/schemas/AuthenticatorEnrollment' - $ref: '#/components/schemas/Oleria_AuthenticatorEnrollmentGlobalIdentifiers' - $ref: >- #/components/schemas/Oleria_AuthenticatorEnrollmentEnrichedInformation - $ref: >- #/components/schemas/Oleria_AuthenticatorEnrollmentAnalyticsInformation - $ref: >- #/components/schemas/Oleria_AuthenticatorEnrollmentSystemOfRecordInformation - required: - oleriaObjectMetadata type: object properties: oleriaObjectMetadata: $ref: '#/components/schemas/Oleria_ObjectMetadata' ErrorResponse: type: object description: >- Error envelope. `code` is a stable machine-readable identifier; `message` is human-readable. required: - code - message properties: code: type: string description: Stable, machine-readable error code (SCREAMING_SNAKE_CASE). example: NOT_FOUND details: type: object description: Optional free-form context for debugging. additionalProperties: true message: type: string description: Human-readable description of the error. example: No resource with the given id. AuthenticatorEnrollment: required: - accountKey - authenticationMethods - enrolledAt - enrollmentStatus - id - objectMetadata type: object properties: id: $ref: '#/components/schemas/LocallyUniqueId' accountKey: type: string description: > The freeform string used by the authenticator provider to identify the enrolled account. Used by the platform to correlate this enrollment to an Account by matching against Account.alias, Account.email, or Account.alternateEmails via the authenticationKeys linkage. authenticationMethods: type: array items: $ref: '#/components/schemas/AuthenticationMethod' description: >- The authentication methods enrolled for this enrollment. Narrows the methods available on the parent Authenticator to those specifically active for this account enrollment. enrollmentStatus: $ref: '#/components/schemas/AuthenticatorEnrollmentStatus' enrolledAt: type: string format: date-time description: Timestamp when the enrollment was created revokedAt: type: string format: date-time description: Timestamp when the enrollment was revoked (if applicable) deviceInfo: $ref: '#/components/schemas/AuthenticatorEnrollmentDeviceInfo' objectMetadata: $ref: '#/components/schemas/ObjectMetadata' description: > An AuthenticatorEnrollment represents a specific account's enrollment in an Authenticator. It records the enrolled authentication methods, the account key used to correlate to an Account, the enrollment lifecycle (status, timestamps), and optional device binding (e.g., a biometric device registered for a HYPR authenticator enrollment). Oleria_AuthenticatorEnrollmentGlobalIdentifiers: required: - globalId type: object properties: globalId: type: string description: > Global identifiers translated from AuthenticatorEnrollment local identifiers to be composed on Oleria AuthenticatorEnrollment Oleria_AuthenticatorEnrollmentEnrichedInformation: type: object description: > Enriched information derived from a combination of AuthenticatorEnrollment data, additional identity signals Oleria_AuthenticatorEnrollmentAnalyticsInformation: type: object description: > Analytics information calculated from identity security graph and added to the authenticator enrollment Oleria_AuthenticatorEnrollmentSystemOfRecordInformation: type: object properties: sorPrimaryStewardEmail: type: string description: > System of Record information associated with an authenticator enrollment and managed in Oleria Oleria_ObjectMetadata: type: object properties: enrichmentVersion: type: string generatedTime: type: string format: date-time description: > object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated LocallyUniqueId: minLength: 1 type: string description: > An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration AuthenticationMethod: type: object properties: type: type: string description: type: string description: > Authentication methods describe how an [Account](#/components/schemas/Account) is required to authenticate to an enterprise application or identity provider. [Account](#/components/schemas/Account) include a list of enrolled authentication methods for the account, and [Activity](#/components/schemas/Activity) will include the authentication method used for login and other events. The type [AuthenticationMethodType](#/components/schemas/AuthenticationMethodType) is a string that can be one of many different authentication methods recognized by Oleria AuthenticatorEnrollmentStatus: type: string enum: - Active - Pending - Revoked - Suspended description: > The lifecycle status of an AuthenticatorEnrollment. Active indicates a fully enrolled and usable enrollment. Pending indicates enrollment initiated but not yet completed (e.g., device registration required). Revoked indicates the enrollment has been explicitly revoked. Suspended indicates the enrollment is temporarily inactive. AuthenticatorEnrollmentDeviceInfo: required: - deviceId - deviceType - registeredAt type: object properties: deviceId: type: string description: >- Unique identifier for the device as assigned by the authenticator provider deviceType: type: string description: >- Type of device bound to this enrollment (e.g., TouchID, WindowsHello, YubiKey). Free-form string to accommodate provider-specific device taxonomies. deviceName: type: string description: >- Human-readable display name for the device, if provided by the authenticator provider registeredAt: type: string format: date-time description: Timestamp when the device was registered to this enrollment description: > Device binding information for an AuthenticatorEnrollment. Present when the authenticator requires a specific physical device (e.g., device-bound biometric or hardware security key). ObjectMetadata: required: - ApplicationInstanceId - GeneratedTime type: object properties: ApplicationInstanceId: type: string GeneratedTime: type: string format: date-time Profile: $ref: '#/components/schemas/SchemaProfile' ObjectOrRelationshipType: type: string description: > The _ObjectMetadata_ structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data SchemaProfile: type: string enum: - Account - Membership - Governance - Risk - Access - Detection responses: BadRequest: description: The request was malformed, for example an invalid cursor or page size. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: BAD_REQUEST message: The request was malformed. Unauthorized: description: Missing or invalid authentication token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: UNAUTHORIZED message: Missing or invalid authentication token. Forbidden: description: The token lacks the scope required for this resource. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: FORBIDDEN message: The token lacks the required scope. TooManyRequests: description: Rate limit exceeded. Retry after the interval in the Retry-After header. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 0 content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: TOO_MANY_REQUESTS message: Rate limit exceeded. Retry after the specified interval. InternalError: description: An unexpected error occurred. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: INTERNAL_ERROR message: An unexpected error occurred. securitySchemes: oauth2: type: oauth2 description: >- OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as `Authorization: Bearer `. flows: clientCredentials: tokenUrl: https://auth.prod.oleria.io/oauth/token scopes: https://devx.{environment}.oleria.io/delete: Irreversibly destroy an object in the source system. https://devx.{environment}.oleria.io/read: Read identity and access data, and the jobs that change it. https://devx.{environment}.oleria.io/write: >- Make reversible changes: grant, enable, assign, revoke and remove access. ````