Forgerock PingOne Advanced Identity Cloud API

Name: PingOne Advanced Identity Cloud API
Brand: PingOne Advanced Identity Cloud API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthDirectory Servicesoauth2, apiKey, basic67 EndpointsREST

For Agents

Manage Advanced Identity Cloud tenant environments, certificates, custom domains, secrets, variables, and config promotions from agent code.

Use for: I need to upload a new TLS certificate to a PingOne Advanced Identity Cloud environment, I want to list all custom domains configured on this tenant, Find a specific environment secret by ID, Get the current state of a promotion lock

Not supported: Does not handle end-user authentication journeys, OAuth client management, or directory record CRUD - use for PingOne Advanced Identity Cloud tenant environment configuration, certificates, secrets, variables, and promotions only.

Jentic publishes the only available OpenAPI specification for PingOne Advanced Identity Cloud API, keeping it validated and agent-ready. PingOne Advanced Identity Cloud (formerly ForgeRock Identity Cloud) is an enterprise identity platform used to manage tenant configuration, certificates, custom domains, federation, environment promotions, secrets, and variables. The API exposes 67 endpoints across environment management with multiple authentication options including OAuth 2.0, API key plus secret, and basic auth.

Install Jentic One Beta

Connect the PingOne Advanced Identity Cloud API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the PingOne Advanced Identity Cloud API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fforgerock.io%2Fforgerock" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fforgerock.io%2Fforgerock" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with PingOne Advanced Identity Cloud API.

Manage TLS certificates and certificate signing requests for tenant environments

Configure cookie domains, custom domains, and content security policies

Issue and rotate environment secrets and variables

Promote configuration between environments using promotion locks and reports

GET STARTED

Start building with PingOne Advanced Identity Cloud API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use PingOne Advanced Identity Cloud API for, with concrete tasks.

★ Tenant Environment Configuration

Manage day-two configuration of an Advanced Identity Cloud tenant by automating certificate uploads, custom domains, cookie domains, and CSP rules. The API surfaces these as discrete endpoints under /environment so platform engineers can codify their identity environment alongside other infra-as-code. This eliminates manual portal work for repeatable changes.

Upload a new certificate to /environment/certificates and then add a custom domain via /environment/custom-domains for the supplied hostname.

Secrets and Variables Management

Manage environment secrets and variables through the corresponding endpoints to inject runtime configuration into Identity Cloud journeys and scripts. Useful for rotating secrets without redeploying configuration and for keeping environment-specific values out of journey JSON. Each secret and variable is referenced by ID in journey logic.

Rotate the secret named 'auth-signing-key' in /environment/secrets and update its value to the new key supplied by the user.

Config Promotion Workflows

Promote configuration changes from a development tenant to staging and production using the promotion endpoints under /environment/promotion. Lock the promotion to prevent concurrent changes, run the promotion, and inspect state via the promotion report. This formalises the move from manual exports to a controlled, auditable rollout pipeline.

Acquire a promotion lock via /environment/promotion/lock, trigger a promotion via /environment/promotion/promote, and return the new lock state.

Federation and SSO Management

Use /environment/federation/enforcement to enable or disable federation enforcement on a tenant, ensuring SSO requirements match policy. Useful for security teams running periodic compliance checks or enforcing a baseline across multiple tenants. The endpoint returns the current enforcement state and lets you toggle it.

Read /environment/federation/enforcement and switch enforcement to enabled if it is currently disabled.

AI Agent Identity Operations via Jentic

Agents use Jentic's intent search to find Identity Cloud operations, load the schema for the right environment endpoint, and execute calls under a scoped credential. This is the recommended pattern for platform copilots that automate routine identity admin tasks without exposing the underlying API key, secret, or access token to the model.

Use Jentic to search 'list Advanced Identity Cloud certificates', load the GET /environment/certificates schema, and return the IDs and expiry dates of all certificates on the tenant.

Key Endpoints

67 endpoints — jentic publishes the only available openapi specification for pingone advanced identity cloud api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/environment/certificates

List installed TLS certificates

GET

/environment/certificates/{id}

Retrieve a certificate by ID

GET

/environment/csrs

List certificate signing requests

GET

/environment/custom-domains

List custom domains

GET

/environment/cookie-domains

List cookie domains

POST

/environment/promotion/lock

Acquire a promotion lock

POST

/environment/promotion/promote

Run a promotion

GET

/environment/federation/enforcement

Read federation enforcement state

GET

/environment/certificates

List installed TLS certificates

GET

/environment/certificates/{id}

Retrieve a certificate by ID

GET

/environment/csrs

List certificate signing requests

GET

/environment/custom-domains

List custom domains

GET

/environment/cookie-domains

List cookie domains

POST

/environment/promotion/lock

Acquire a promotion lock

POST

/environment/promotion/promote

Run a promotion

GET

/environment/federation/enforcement

Read federation enforcement state

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the PingOne Advanced Identity Cloud API by hand means picking among its OAuth 2.0 authorization-code flow, its paired x-api-key-id and x-api-key-secret headers, and HTTP Basic auth, then building your own retry and error handling around the environment endpoints. Through Jentic you install once, import it from the API Directory, store the chosen credential once, and your agent calls it.

Permission scoping

Advanced Identity Cloud puts the certificate id in the URL path (/environment/certificates/{id}), so a rule can pin your agent to reading certificates and related environment records. You choose the operations it may call, so the promotion lock and promote operations that change tenant configuration are not included unless you add them.

Credential isolation

Your chosen Advanced Identity Cloud credential, whether the API key pair, OAuth client credentials, or Basic auth pair, is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'list Advanced Identity Cloud certificates', and Jentic returns the GET /environment/certificates operation with its query schema so the agent runs the right call without browsing the Ping Identity docs.

FAQs

Specific to using PingOne Advanced Identity Cloud API through Jentic.

Why is there no official OpenAPI spec for PingOne Advanced Identity Cloud API?

Ping Identity publishes reference docs but the only consolidated OpenAPI 3.0 specification is generated and maintained by Jentic so AI agents and developers can call PingOne Advanced Identity Cloud API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the PingOne Advanced Identity Cloud API use?

The API supports three schemes: an API key id and secret pair (in headers x-api-key-id and x-api-key-secret) for read-only tenant operations, OAuth 2.0 access tokens for write and access management operations, and basic auth as a fallback. Jentic stores the chosen credential encrypted in your Jentic One instance.

Can I rotate environment secrets with the PingOne Advanced Identity Cloud API?

Yes, the /environment/secrets endpoints let you list, create, update, and delete tenant secrets. Rotating a secret in the API immediately makes the new value available to journeys and scripts that reference it by name.

What are the rate limits for the PingOne Advanced Identity Cloud API?

The OpenAPI spec does not declare explicit rate limits. Ping Identity applies tenant-level throughput controls in production - back off on 429 responses and avoid running large promotion or certificate operations in tight loops.

How do I run a config promotion through Jentic?

Search Jentic for 'promote Advanced Identity Cloud config', acquire a lock via /environment/promotion/lock, then load and execute /environment/promotion/promote. Read /environment/promotion/lock/state to confirm the lock has been released.

Does the PingOne Advanced Identity Cloud API support custom domains?

Yes, /environment/custom-domains and /environment/custom-domains/{realm} let you list and manage custom domains attached to specific realms. Pair this with /environment/certificates to upload the matching TLS certificate.

Can I limit what my agent is allowed to do with the PingOne Advanced Identity Cloud API?

Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials your agent may use, and you choose exactly which environment endpoints it can call. Since the certificate id sits in the URL path at /environment/certificates/{id}, you can pin the agent to read-only certificate and environment record lookups while excluding write operations. The promotion lock and /environment/promotion/promote calls that change tenant configuration stay off limits unless you explicitly add them.

Forgerock PingOne Advanced Identity Cloud API

Connect the PingOne Advanced Identity Cloud API to your agent

Capabilities

Start building with PingOne Advanced Identity Cloud API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs