Replace one space's reader sign-in override
https://forumulate.com/api /orgs/{orgId}/spaces/{spaceId}/reader-auth The response carries inherits, so a save that does not actually govern readers says so at the moment you make it rather than on a later read. Secrets are never lost by omission: a secret key (clientSecret, secret, sharedSecret, secretKey, bindPassword, outboundSync.scimBearerToken) that is absent, empty, or a redaction mask (********) keeps the stored value, and the <key>Set / secretSet markers a read returns are ignored — so a GET can be sent back verbatim. Providers are matched to stored ones by method + order, then by method alone. To change part of the registry without resending anything, use PATCH. A stored override with an empty providers array does NOT disable sign-in: it inherits the org defaults, exactly as having no override does — so a space cannot currently override the org with NO sign-in methods. To remove an override, use DELETE /orgs/{orgId}/spaces/{spaceId}/reader-auth.
Requires token scope: admin (the coarse method gate) for Atlas key (ak_), Personal Access Token (cft_) or OAuth (cfo_) auth — in addition to any catalog scope (GET /pats/scopes) the route’s capability needs. Session/cookie auth is governed by RBAC capabilities instead.
Parameters
orgIdstringpathrequiredspaceIdstringpathrequiredforumulate-versionstringheaderforumulate-version: 2026-12-01 on every request from a new integration; it is optional only so that integrations written before versioning keep working. Each version includes everything before it:Idempotency-Keystringheader409. The key is scoped to the method and path, so the same key on a different endpoint is a different request. Error responses of 5xx are never cached — those retries re-run. A key is bound to the BODY it was first used with: reusing it with a different body is a 409 idempotency.key_reused, not a replay, because replaying would tell you a write landed that never ran. Generate one key per request, never per process or per session.Request body application/json
sourceOfTruthstringprovidersobject[]Show child parameters
methodstringrequiredlabelstringorderintegerrequiredconfigobjectprovisionIdentitybooleansecretSetbooleanapproveNewMembersbooleanhostedSignupbooleansignInUrlstringreturnTo — the absolute URL of the page the reader was on (always set, replacing any returnTo already in the URL); space — the space slug; spaceId — the space id. space/spaceId are only added when the URL does not already carry them. Configured once for the org, one page serves every space: send the reader on to /api/public/orgs/{orgId}/spaces/{spaceId}/visitor-oidc/start (or your own flow) using spaceId, then back to returnTo. returnTo is URL-encoded as one query value and is at most 2048 characters: a longer page address is sent without its query string and fragment, and failing that as the space root.signOutUrlstringreturnTo — the absolute URL of the page they signed out from (URL-encoded, at most 2048 characters) — replacing any returnTo already in the URL. End your own session, then send them on.outboundSyncobjectShow child parameters
scimBaseUrlstringrequiredscimBearerTokenstringdeprovisionActionstringtargetIdstringstatusstringlastErrorstring{
"sourceOfTruth": "customer",
"providers": [],
"approveNewMembers": true,
"hostedSignup": true,
"signInUrl": "string",
"signOutUrl": "string",
"outboundSync": {
"scimBaseUrl": "string",
"scimBearerToken": "string",
"deprovisionAction": "deactivate",
"targetId": "string",
"status": "active",
"lastError": "string"
}
}cURL
curl -X PUT "https://forumulate.com/api/orgs/{orgId}/spaces/{spaceId}/reader-auth" \
-H "forumulate-version: <value>" \
-H "Idempotency-Key: <value>" \
-H "Content-Type: application/json" \
-d '{"sourceOfTruth":"customer","providers":[],"approveNewMembers":true,"hostedSignup":true,"signInUrl":"string","signOutUrl":"string","outboundSync":{"scimBaseUrl":"string","scimBearerToken":"string","deprovisionAction":"deactivate","targetId":"string","status":"active","lastError":"string"}}'TypeScript
const res = await fetch('https://forumulate.com/api/orgs/{orgId}/spaces/{spaceId}/reader-auth', {
method: 'PUT',
headers: {
'forumulate-version': '<value>',
'Idempotency-Key': '<value>',
'Content-Type': 'application/json',
},
body: JSON.stringify({"sourceOfTruth":"customer","providers":[],"approveNewMembers":true,"hostedSignup":true,"signInUrl":"string","signOutUrl":"string","outboundSync":{"scimBaseUrl":"string","scimBearerToken":"string","deprovisionAction":"deactivate","targetId":"string","status":"active","lastError":"string"}}),
});
const data = await res.json();Python
import requests
res = requests.request(
"PUT",
"https://forumulate.com/api/orgs/{orgId}/spaces/{spaceId}/reader-auth",
headers={
"forumulate-version": "<value>",
"Idempotency-Key": "<value>",
"Content-Type": "application/json",
},
json={"sourceOfTruth": "customer", "providers": [], "approveNewMembers": True, "hostedSignup": True, "signInUrl": "string", "signOutUrl": "string", "outboundSync": {"scimBaseUrl": "string", "scimBearerToken": "string", "deprovisionAction": "deactivate", "targetId": "string", "status": "active", "lastError": "string"}},
)
data = res.json()Go
package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
req, _ := http.NewRequest("PUT", "https://forumulate.com/api/orgs/{orgId}/spaces/{spaceId}/reader-auth", strings.NewReader(`{"sourceOfTruth":"customer","providers":[],"approveNewMembers":true,"hostedSignup":true,"signInUrl":"string","signOutUrl":"string","outboundSync":{"scimBaseUrl":"string","scimBearerToken":"string","deprovisionAction":"deactivate","targetId":"string","status":"active","lastError":"string"}}`))
req.Header.Set("forumulate-version", "<value>")
req.Header.Set("Idempotency-Key", "<value>")
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}PHP
<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://forumulate.com/api/orgs/{orgId}/spaces/{spaceId}/reader-auth');
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PUT');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['forumulate-version: <value>', 'Idempotency-Key: <value>', 'Content-Type: application/json']);
curl_setopt($ch, CURLOPT_POSTFIELDS, '{"sourceOfTruth":"customer","providers":[],"approveNewMembers":true,"hostedSignup":true,"signInUrl":"string","signOutUrl":"string","outboundSync":{"scimBaseUrl":"string","scimBearerToken":"string","deprovisionAction":"deactivate","targetId":"string","status":"active","lastError":"string"}}');
$response = curl_exec($ch);
curl_close($ch);
echo $response;Ruby
require 'net/http'
require 'uri'
uri = URI('https://forumulate.com/api/orgs/{orgId}/spaces/{spaceId}/reader-auth')
req = Net::HTTP::Put.new(uri)
req['forumulate-version'] = '<value>'
req['Idempotency-Key'] = '<value>'
req['Content-Type'] = 'application/json'
req.body = '{"sourceOfTruth":"customer","providers":[],"approveNewMembers":true,"hostedSignup":true,"signInUrl":"string","signOutUrl":"string","outboundSync":{"scimBaseUrl":"string","scimBearerToken":"string","deprovisionAction":"deactivate","targetId":"string","status":"active","lastError":"string"}}'
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
http.request(req)
end
puts res.bodyJava
import java.net.URI;
import java.net.http.*;
import java.net.http.HttpRequest.BodyPublishers;
HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://forumulate.com/api/orgs/{orgId}/spaces/{spaceId}/reader-auth"))
.header("forumulate-version", "<value>")
.header("Idempotency-Key", "<value>")
.header("Content-Type", "application/json")
.method("PUT", BodyPublishers.ofString("{\"sourceOfTruth\":\"customer\",\"providers\":[],\"approveNewMembers\":true,\"hostedSignup\":true,\"signInUrl\":\"string\",\"signOutUrl\":\"string\",\"outboundSync\":{\"scimBaseUrl\":\"string\",\"scimBearerToken\":\"string\",\"deprovisionAction\":\"deactivate\",\"targetId\":\"string\",\"status\":\"active\",\"lastError\":\"string\"}}"))
.build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());Responses
inherits stating whether it actually governs this space's readers.Example
{
"approveNewMembers": true,
"hasOverride": true,
"hostedSignup": true,
"inherits": true,
"outboundSync": {
"deprovisionAction": "deactivate",
"lastError": "string",
"scimBaseUrl": "string",
"scimBearerToken": "string",
"status": "active",
"targetId": "string"
},
"providers": [
{
"config": {},
"label": "string",
"method": "apple",
"order": 0,
"provisionIdentity": true,
"secretSet": true
}
],
"signInUrl": "string",
"signOutUrl": "string",
"sourceOfTruth": "customer",
"warnings": [
"tags: \"Launch Day\" is stored as \"launch-day\""
]
}Schema
approveNewMembersbooleanhasOverridebooleanrequiredhostedSignupbooleaninheritsbooleanrequiredoutboundSyncobjectShow child parameters
deprovisionActionstringlastErrorstringscimBaseUrlstringrequiredscimBearerTokenstringstatusstringtargetIdstringprovidersobject[]requiredShow child parameters
configobjectrequiredlabelstringmethodstringrequiredordernumberrequiredprovisionIdentitybooleansecretSetbooleansignInUrlstringsignOutUrlstringsourceOfTruthstringrequiredwarningsstring[][]. The same sentences are on the X-Field-Warnings response header. If this is present, something you sent is not what is stored; read the resource back rather than assuming your own value.request.malformed). A value that was understood but is not acceptable is a 422 validation.failed.Example
{
"error": {
"code": "string",
"message": "string",
"details": {},
"docs": "string",
"reason": "string",
"slugs": [
"string"
],
"conflict": {
"etag": "string",
"ops": [
null
]
}
},
"requestId": "string"
}Schema
errorobjectrequiredShow child parameters
codestringrequiredrbac.forbidden.messagestringrequireddetailsobjectdocsstringGET /space-types/{type}/presets. Present on errors over a controlled list, so the answer to "what am I allowed to send?" is in the error itself.reasonstringiat_too_old, iat_in_future, bad_signature, bad_issuer, bad_audience, expired and more. Branch on this, not on message.slugsstring[]space.slug_taken, page.slug_taken, collection.slug_taken, site.slug_taken or badge.slug_taken.conflictobjectPATCH …/entries/{entryId}/fields) whose If-Match was stale.Show child parameters
etagstringrequiredopsarrayrequiredIf-Match that touch a path your own operations touch. Empty: none did — retry the batch unchanged under etag. null: the history no longer reaches your tag — re-read the entry first.requestIdstringx-request-id and x-forumulate-request-id response headers. Quote it in a bug report: it is the only thing that finds your exact request in our logs. It is in the body because that is the part that survives — an SDK that throws the parsed body, a serverless log that keeps the body and drops the headers, a ticket with the JSON pasted in.auth.required). Send a Bearer token or the session cookie.Example
{
"error": {
"code": "string",
"message": "string",
"details": {},
"docs": "string",
"reason": "string",
"slugs": [
"string"
],
"conflict": {
"etag": "string",
"ops": [
null
]
}
},
"requestId": "string"
}Schema
errorobjectrequiredShow child parameters
codestringrequiredrbac.forbidden.messagestringrequireddetailsobjectdocsstringGET /space-types/{type}/presets. Present on errors over a controlled list, so the answer to "what am I allowed to send?" is in the error itself.reasonstringiat_too_old, iat_in_future, bad_signature, bad_issuer, bad_audience, expired and more. Branch on this, not on message.slugsstring[]space.slug_taken, page.slug_taken, collection.slug_taken, site.slug_taken or badge.slug_taken.conflictobjectPATCH …/entries/{entryId}/fields) whose If-Match was stale.Show child parameters
etagstringrequiredopsarrayrequiredIf-Match that touch a path your own operations touch. Empty: none did — retry the batch unchanged under etag. null: the history no longer reaches your tag — re-read the entry first.requestIdstringx-request-id and x-forumulate-request-id response headers. Quote it in a bug report: it is the only thing that finds your exact request in our logs. It is in the body because that is the part that survives — an SDK that throws the parsed body, a serverless log that keeps the body and drops the headers, a ticket with the JSON pasted in.rbac.forbidden, whether what is missing is the capability, the token scope, or a resource the token is pinned away from. The message names the capability and, for a scope refusal, the scopes that would grant it. A refusal because of the PLAN is a 402 with quota.exceeded, not this.Example
{
"error": {
"code": "string",
"message": "string",
"details": {},
"docs": "string",
"reason": "string",
"slugs": [
"string"
],
"conflict": {
"etag": "string",
"ops": [
null
]
}
},
"requestId": "string"
}Schema
errorobjectrequiredShow child parameters
codestringrequiredrbac.forbidden.messagestringrequireddetailsobjectdocsstringGET /space-types/{type}/presets. Present on errors over a controlled list, so the answer to "what am I allowed to send?" is in the error itself.reasonstringiat_too_old, iat_in_future, bad_signature, bad_issuer, bad_audience, expired and more. Branch on this, not on message.slugsstring[]space.slug_taken, page.slug_taken, collection.slug_taken, site.slug_taken or badge.slug_taken.conflictobjectPATCH …/entries/{entryId}/fields) whose If-Match was stale.Show child parameters
etagstringrequiredopsarrayrequiredIf-Match that touch a path your own operations touch. Empty: none did — retry the batch unchanged under etag. null: the history no longer reaches your tag — re-read the entry first.requestIdstringx-request-id and x-forumulate-request-id response headers. Quote it in a bug report: it is the only thing that finds your exact request in our logs. It is in the body because that is the part that survives — an SDK that throws the parsed body, a serverless log that keeps the body and drops the headers, a ticket with the JSON pasted in.*.not_found).Example
{
"error": {
"code": "string",
"message": "string",
"details": {},
"docs": "string",
"reason": "string",
"slugs": [
"string"
],
"conflict": {
"etag": "string",
"ops": [
null
]
}
},
"requestId": "string"
}Schema
errorobjectrequiredShow child parameters
codestringrequiredrbac.forbidden.messagestringrequireddetailsobjectdocsstringGET /space-types/{type}/presets. Present on errors over a controlled list, so the answer to "what am I allowed to send?" is in the error itself.reasonstringiat_too_old, iat_in_future, bad_signature, bad_issuer, bad_audience, expired and more. Branch on this, not on message.slugsstring[]space.slug_taken, page.slug_taken, collection.slug_taken, site.slug_taken or badge.slug_taken.conflictobjectPATCH …/entries/{entryId}/fields) whose If-Match was stale.Show child parameters
etagstringrequiredopsarrayrequiredIf-Match that touch a path your own operations touch. Empty: none did — retry the batch unchanged under etag. null: the history no longer reaches your tag — re-read the entry first.requestIdstringx-request-id and x-forumulate-request-id response headers. Quote it in a bug report: it is the only thing that finds your exact request in our logs. It is in the body because that is the part that survives — an SDK that throws the parsed body, a serverless log that keeps the body and drops the headers, a ticket with the JSON pasted in.validation.failed). error.details names the field paths.Example
{
"error": {
"code": "string",
"message": "string",
"details": {},
"docs": "string",
"reason": "string",
"slugs": [
"string"
],
"conflict": {
"etag": "string",
"ops": [
null
]
}
},
"requestId": "string"
}Schema
errorobjectrequiredShow child parameters
codestringrequiredrbac.forbidden.messagestringrequireddetailsobjectdocsstringGET /space-types/{type}/presets. Present on errors over a controlled list, so the answer to "what am I allowed to send?" is in the error itself.reasonstringiat_too_old, iat_in_future, bad_signature, bad_issuer, bad_audience, expired and more. Branch on this, not on message.slugsstring[]space.slug_taken, page.slug_taken, collection.slug_taken, site.slug_taken or badge.slug_taken.conflictobjectPATCH …/entries/{entryId}/fields) whose If-Match was stale.Show child parameters
etagstringrequiredopsarrayrequiredIf-Match that touch a path your own operations touch. Empty: none did — retry the batch unchanged under etag. null: the history no longer reaches your tag — re-read the entry first.requestIdstringx-request-id and x-forumulate-request-id response headers. Quote it in a bug report: it is the only thing that finds your exact request in our logs. It is in the body because that is the part that survives — an SDK that throws the parsed body, a serverless log that keeps the body and drops the headers, a ticket with the JSON pasted in.Example
{
"error": {
"code": "string",
"message": "string",
"details": {},
"docs": "string",
"reason": "string",
"slugs": [
"string"
],
"conflict": {
"etag": "string",
"ops": [
null
]
}
},
"requestId": "string"
}Schema
errorobjectrequiredShow child parameters
codestringrequiredrbac.forbidden.messagestringrequireddetailsobjectdocsstringGET /space-types/{type}/presets. Present on errors over a controlled list, so the answer to "what am I allowed to send?" is in the error itself.reasonstringiat_too_old, iat_in_future, bad_signature, bad_issuer, bad_audience, expired and more. Branch on this, not on message.slugsstring[]space.slug_taken, page.slug_taken, collection.slug_taken, site.slug_taken or badge.slug_taken.conflictobjectPATCH …/entries/{entryId}/fields) whose If-Match was stale.Show child parameters
etagstringrequiredopsarrayrequiredIf-Match that touch a path your own operations touch. Empty: none did — retry the batch unchanged under etag. null: the history no longer reaches your tag — re-read the entry first.requestIdstringx-request-id and x-forumulate-request-id response headers. Quote it in a bug report: it is the only thing that finds your exact request in our logs. It is in the body because that is the part that survives — an SDK that throws the parsed body, a serverless log that keeps the body and drops the headers, a ticket with the JSON pasted in.Example
{
"error": {
"code": "string",
"message": "string",
"details": {},
"docs": "string",
"reason": "string",
"slugs": [
"string"
],
"conflict": {
"etag": "string",
"ops": [
null
]
}
},
"requestId": "string"
}Schema
errorobjectrequiredShow child parameters
codestringrequiredrbac.forbidden.messagestringrequireddetailsobjectdocsstringGET /space-types/{type}/presets. Present on errors over a controlled list, so the answer to "what am I allowed to send?" is in the error itself.reasonstringiat_too_old, iat_in_future, bad_signature, bad_issuer, bad_audience, expired and more. Branch on this, not on message.slugsstring[]space.slug_taken, page.slug_taken, collection.slug_taken, site.slug_taken or badge.slug_taken.conflictobjectPATCH …/entries/{entryId}/fields) whose If-Match was stale.Show child parameters
etagstringrequiredopsarrayrequiredIf-Match that touch a path your own operations touch. Empty: none did — retry the batch unchanged under etag. null: the history no longer reaches your tag — re-read the entry first.requestIdstringx-request-id and x-forumulate-request-id response headers. Quote it in a bug report: it is the only thing that finds your exact request in our logs. It is in the body because that is the part that survives — an SDK that throws the parsed body, a serverless log that keeps the body and drops the headers, a ticket with the JSON pasted in.