Auth0 Management API

Alert history

• Additive

  Add ThirdPartyClientAccessConfig to organization settings

  Jul 17, 2026, 8:00 PM

  The Auth0 Management API now supports a new optional third_party_client_access_config field in organization settings, along with the new ThirdPartyClientAccessConfig schema. This field controls whether third-party applications can configure connections during the Self-Service Enterprise Configuration flow. The addition is purely additive with no breaking changes to existing endpoints or response shapes.

• Additive

  Add B2B integration and Cross App Access fields to client and connection schemas

  Jul 16, 2026, 6:00 PM

  Multiple new optional fields and schema definitions were added to support B2B Integration clients and Cross App Access functionality. New fields include b2b_integration_configuration on client schemas, identity_assertion_authorization_grant configuration for ID-JAG token exchange, and cross_app_access_resource_app settings for connections. All additions are marked as beta or EA lifecycle stage and are optional, so existing integrations remain fully compatible.

• Additive

  Add EA identifiers and actor fields to branding and session APIs

  Jul 15, 2026, 6:00 PM

  Auth0 Management API adds several new optional, early-access (EA) fields: identifiers to multiple branding theme endpoints, actor to session-related endpoints, and a new pre-custom-token-exchange throttling configuration. New schema types BrandingThemeIdentifiers, SessionActorMetadata, and SuspiciousIPThrottlingPreCustomTokenExchangeStage are introduced. All changes are backwards-compatible additions that don't modify existing field requirements or remove functionality.

• Breaking

  Removed federated connections tokens feature and ASN device binding option

  Jul 14, 2026, 6:01 PM

  Several previously documented features have been removed from the Auth0 Management API spec:

  • The ConnectionFederatedConnectionsAccessTokens schema and all federated_connections_access_tokens fields have been removed from Azure AD (v1/v2), Google Apps, and generic OAuth2/SAML connection options — clients writing this field will no longer have it accepted.
  • The FederatedConnectionTokenSet schema has been removed entirely.
  • The scopes read:federated_connections_tokens and delete:federated_connections_tokens have been removed from the API's scope list.
  • The asn enum value has been removed from ClientSessionTransferDelegationDeviceBindingEnum, making ip the only valid value; any client passing "asn" will now be sending an unsupported value.
  • All SDK code samples have been updated to require a domain/base_url parameter alongside token, which is an informational change to examples only.
• Additive

  Add auth0_managed field to rule conditions

  Jul 10, 2026, 7:00 PM

  A new optional auth0_managed field has been added to rule condition schemas, allowing an array of Auth0-managed provider identifiers matching the pattern auth0.*. This is a purely additive change that extends rule configuration capabilities without breaking existing integrations.

• Informational

  Added documentation for 403 scope upgrade requirement

  Jul 9, 2026, 7:00 PM

  The 403 error response for the SSO access tickets endpoint now includes an x-description-1 field clarifying that a subscription upgrade is required to use cross_app_access_resource_app_config. This is a documentation enhancement that does not affect API behaviour.

• Additive

  Add "confirmation" prompt type to Auth0 Management API

  Jul 8, 2026, 10:01 PM

  A new enum value "confirmation" has been added to the prompt type list in the Auth0 Management API. This is an additive change that allows clients to use the new "confirmation" prompt type; existing code is unaffected.

• Informational

  Added error code descriptions for subscription/scoping limitations

  Jul 7, 2026, 6:00 PM

  The Auth0 Management API OpenAPI spec now includes additional x-description-* fields in 403 error responses, documenting new error conditions related to subscription upgrades (identity_assertion_authorization_grant and cross_app_access_resource_app) and entity limits. These are documentation-only changes to the error response metadata that do not alter actual API behaviour, response structure, or client integration logic.

• Additive

  Add grants field and third_party_client_access support to org APIs

  Jul 3, 2026, 8:00 PM

  The Auth0 Management API adds three new optional response fields: grants array to token vault privileged access schemas, third_party_client_access enum to organization schemas, and organization_id to the user grants response. All fields are additive and marked with lifecycle status, enabling new capabilities around grant management and third-party client access control without breaking existing integrations.

• Breaking

  weight type narrowed number→integer; backoff enum "none" renamed "default"

  Jul 2, 2026, 6:00 PM

  Three distinct breaking changes in one diff:

  • The weight field in two allocation-related schemas is narrowed from type: number to type: integer — clients sending decimal weights will now fail validation.
  • The backoff_type enum loses the value "none" and gains "default" — any client sending or matching "none" will break.
  • The phone-provider-protection endpoints (GET/PATCH) are promoted from Early Access (EA) to General Availability (GA) — informational, but the x-release-lifecycle change signals a stability commitment.
• Additive

  Auth0 Management API additions: code samples, new schemas, new scopes

  Jul 2, 2026, 12:15 AM

  The Auth0 Management API spec adds comprehensive code samples in multiple languages (x-codeSamples), introduces new schemas for experimentation features (ExperimentValidationResult, Variation-related schemas, XssProtectionConfig), and adds new OAuth2 scopes for experimentation, group roles, organization features, rate limit policies, and user permissions. These are all purely additive changes that do not break existing integrations.