Returns the authenticated user's F5 Insight role and the permissions granted to that role. Used by the frontend to enable or hide role-based UI actions. Requires authentication.

Returns all available system roles with user counts. Used to populate the role selector when creating or updating a group mapping. Requires authentication.

Returns a single role by its UUID, including its full permission list. Requires authentication.

Returns configured mappings grouped by identity provider and role. Requires authentication.

Returns all provider-scoped grouped mappings for the given role_id. Requires authentication.

Creates or fully replaces the grouped_resource_attribute list for the given provider_id and role_id. Sending an empty grouped_resource_attribute array clears mappings for that provider/role. Requires admin role.

Adds or moves the provided grouped_resource_attribute values to the given provider_id and role_id without removing other values already mapped to that role. Requires admin role.

Deletes the grouped mapping for the given provider_id and role_id. This removes all grouped_resource_attribute values currently mapped to that provider/role pair. Requires admin role.

Internal server-to-server endpoint called by the Zitadel action script during token enrichment. Receives the authenticating user's provider ID and group/resource attribute values, then returns the F5 Insight role names mapped to those values.

This endpoint is NOT protected by JWT bearer auth — it is called by Zitadel's action runtime (server-to-server). It is protected by the X-Webhook-Key header which must match the AUTHZ_WEBHOOK_SECRET environment variable configured on the backend.

Do not call this endpoint from browser clients.

Returns a paginated list of device templates.

Supports OData-style query parameters for filtering, sorting, pagination, field selection, and total count:

Creates a new device template.

The optional draft flag controls the initial state:

To deploy a template, use the separate POST /device-templates/{id}/deploy endpoint.

Returns a single device template identified by its ID.

Supports the OData $select parameter to return only specific fields:

GET /device-templates/{id}?$select=id,name,state
GET /device-templates/{id}?$select=id,name,locked,lockReason,definition

Replaces all fields of an existing device template.

Precondition: The device template must not be locked (locked=true → 409). Templates in DEPLOYING state are system-locked and cannot be modified.

The optional draft flag controls state transitions:

To deploy a template, use the separate POST /device-templates/{id}/deploy endpoint.

Partially updates an existing device template. Only the provided fields are modified; omitted fields retain their current values.

Precondition: The device template must not be locked. Templates in DEPLOYING state cannot be patched.

For the definition object, merge-patch semantics apply:

• Provided keys are updated.
• Omitted keys are left unchanged.
• Keys set to null are cleared.
• Array fields (e.g. vlanList, selfIpList) are replaced wholesale.

Deletes a device template by ID.

Precondition: The device template must not be locked. Templates in DEPLOYING state cannot be deleted.

Locks a device template to prevent modifications. Sets locked=true and lockReason=READ_ONLY.

Precondition: Template must not already be locked.

Unlocks a device template to allow modifications. Sets locked=false and lockReason=NONE.

Precondition: Template must be locked with lockReason=READ_ONLY. System locks (DEPLOYMENT) cannot be manually unlocked.

Runs multi-tier validation on a device template:

• Tier 1 — Data & Sanity: Required fields, value ranges, cross-field rules.
• Tier 2 — Template / Schema: Validates the definition against the default template schema.
• Tier 3 — Live VM (future): Validates against a live BIG-IP VM.

Always returns HTTP 200. Inspect valid and each tier's result for pass/fail.

Triggers deployment of a device template to target infrastructure.

Preconditions:

• Template must be in NEW or DEPLOYED state
• Template must not be locked
• Template must pass validation

Returns 202 Accepted with a task object for tracking deployment progress.

Creates a deep copy of an existing device template with a new name. The clone is always created in DRAFT state, unlocked.

Retrieves a specific task by its ID. For active tasks (PENDING, RUNNING), this endpoint polls the external service for the latest status before returning.

Fetches all available license pools in the system.

Creates a new license pool that can hold multiple license offerings

Get license pool by given ID in the path parameter

Deletes a license pool. If licenses are added and activated but not assigned to any device, deleting the pool will invalidate all associated registration keys. If any license from the pool is already assigned to a member, returns 400 error.

Automatically assigns an available license from the pool to the specified BIG-IP device.

This is a convenience endpoint that:

1. Finds all offerings in the pool that are READY and not already assigned to any member
2. Picks the first available offering
3. Assigns the license to the specified device

This is an asynchronous operation that returns a TaskReference for polling.

Revokes the license from a device that has a license assigned from this pool.

This is a convenience endpoint that:

1. Finds the member record by device address
2. Revokes the license from the device (unless force=true)
3. Removes the member record from the pool

If force=true, the license will be revoked from the pool without contacting the device. This is useful when the device is unreachable or destroyed.

Adds a license offering to an existing pool by activating a registration key. Steps - 1. Generate public/private keys and dossier. 2. Check the MODE of activation (AUTOMATIC, MANUAL, CCN) and trigger corresponding flow. 3. Contact F5 License Server at https://authem.f5net.com/license/services/. 4. F5 License server returns license_text if activation is successful.