Commit Graph

219 Commits

Author SHA1 Message Date
Livio Spring
35ad7fd9b8 feat(api): move instance service to v2 (#10919)
# Which Problems Are Solved

As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.

# How the Problems Are Solved

- This PR moves instance v2beta service and its endpoints to a
corresponding v2 version. The v2beta service and endpoints are
deprecated.
- The docs are moved to the new GA service and its endpoints. The v2beta
is not displayed anymore.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with (google.api.field_behavior)
= REQUIRED and validation rules have been added where missing
- `Domain` has been renamed to `CustomDomain` to align with naming
conventions
- `..Query` has been renamed to `..Filter` to align with other services
- The `instance_id` parameter can now passed on all endpoints and is
properly used, but requires `system` permissions. It can be omitted to
use the own instance (identified by context as any other service).
  - The following endpoints are affected:
    - GetInstance
    - UpdateInstance
    - ListCustomDomains
    - AddTrustedDomain
    - RemoveTrustedDomain
    - ListTrustedDomains
- InstanceService has been added the InstanceInterceptor's
`explicitInstanceIdServices` to allow passing the id
- If the instance is not found by id, the error is not directly returned
to prevent enumeration.
- Permissions are checked in the API instead of the interceptor for
these calls.
- Setting the same instance name in the update no longer returns an
error, but the previous change date.

# Additional Changes

none

# Additional Context

- part of https://github.com/zitadel/zitadel/issues/10772
- requires backport to v4.x

(cherry picked from commit c2a0b9d187)
2025-10-28 15:10:54 +01:00
Livio Spring
c3a3766445 feat(api): move project service v2beta to GA (and deprecate v2beta) (#10844)
# Which Problems Are Solved

As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.

# How the Problems Are Solved

- This PR moves project v2beta service and its endpoints to a
corresponding v2 version. The v2beta service and endpoints are
deprecated.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with `(google.api.field_behavior)
= REQUIRED` and validation rules have been added where missing.
- Name ID of the project always `project_id`
- `UpdateProjectRequest` has been updated to align with the creation and
retrieval of a project:
  - `project_role_check` has been renamed to `authorization_required`
  - `has_project_check` has been renamed to `project_access_required`
- `ListProjectRequest` has been changed:
- `project_grant_resource_owner_filter`,
`project_grant_resource_owner_filter` and
`project_organization_id_filter` have been removed and merged into a
single `organization_id_filter` where a `type` can optionally be
specified to select `owned`, `granted` or both project types within a
specified organization.
- `ListProjectGrantReques` has been changed:
- `project_resource_owner_filter` has been renamed to
`project_organization_id_filter`
- `grant_resource_owner_filter` has been renamed to
`granted_organization_id_filter`

# Additional Changes

Replaced deprecated `intergration.WithAuthorization` with
`integration.WithAuthorizationToken` in integration tests.

# Additional Context

- part of #10772
- requires backport to v4.x

(cherry picked from commit 32500e3b0c)
2025-10-28 15:10:03 +01:00
Livio Spring
999e81b74b feat(api): move authorization service to v2 (#10914)
# Which Problems Are Solved

As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.

# How the Problems Are Solved

- This PR moves the authorization v2beta service and its endpoints to a
corresponding v2 version. The v2beta service and endpoints are
deprecated.
- The docs are moved to the new GA service and its endpoints. The v2beta
is not displayed anymore.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with (google.api.field_behavior)
= REQUIRED and validation rules have been added where missing.
- The `organization_id` to create an authorization is now required to be
always passed. There's no implicit fallback to the project's
organization anymore.
- The `user_id` filter has been removed in favor of the recently added
`in_user_ids` filter.
- The returned `Authorization` object has been reworked to return
`project`, `organization` and `roles` as objects like the granted `user`
already was.
- Additionally the `roles` now not only contain the granted `role_keys`,
but also the `display_name` and `group`. To implement this the query has
been updated internally. Existing APIs are unchanged and still return
just the keys.

# Additional Changes

None

# Additional Context

- part of https://github.com/zitadel/zitadel/issues/10772
- closes #10746
- requires backport to v4.x

(cherry picked from commit c9ac1ce344)
2025-10-28 15:09:54 +01:00
Livio Spring
bd995b0b48 feat(api): move application service v2beta to GA (and deprecate v2beta) (#10846)
# Which Problems Are Solved

As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.

# How the Problems Are Solved

- This PR moves app v2beta service and its endpoints to a corresponding
to application v2 version. The v2beta service and endpoints are
deprecated.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with (google.api.field_behavior)
= REQUIRED and validation rules have been added where missing.
- Name ID of the application always `application_id`, previously was
also `id` and `app_id`.
- Get rid of all `app` abbreviations and name it `application` including
the service name, `AppState` -> `ApplicationState` and `AppSorting` ->
`ApplicationSorting`
- Updated `CreateApplicationRequest`:
- renamed `creation_request_type` to `application_type` and all its
options to `XY_configuration` instead of `XY_request`
- `RegenerateClientSecret`
  - renamed method to `GenerateClientSecret`
  - removed `app_type` from request
- `ListApplicationRequest`:
  - removed required `project_id` and provided it as a filter
- Type `ApplicationNameQuery` has been renamed to
`ApplicationNameFilter` as its usage in the request
- Renamed all fields and types from `config` to `configuration`
- Updated `DeleteApplicationKeyRequest`
  - removed `organization_id`
- Updated `GetApplicationKeyRequest`:
  - removed `project_id`, `application_id` and `organization_id``
- Updated `ListApplicationKeysRequest`:
  - removed oneOf `resource_id` and moved the options into filters
- Name ID of the application key always `key_id`.
- removed unnecessary package prefixed (`zitadel.application.v2`)
- formatted using `buf`

# Additional Changes

None

# Additional Context

- part of https://github.com/zitadel/zitadel/issues/10772
- requires backport to v4.x

(cherry picked from commit 0281670030)
2025-10-27 08:56:27 +01:00
Livio Spring
366fe3fd5b feat(api): move internal permission service to GA (and deprecate v2beta) (#10898)
# Which Problems Are Solved

As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.

# How the Problems Are Solved

- This PR moves the internal permission v2beta service and its endpoints
to a corresponding v2 version. The v2beta service and endpoints are
deprecated.
- The docs are moved to the new GA service and its endpoints. The v2beta
is not displayed anymore.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with (google.api.field_behavior)
= REQUIRED and validation rules have been added where missing.
- Listing administrators of a project grant can now be done with the
`ProjectGrant` (`project_id` and `organization_id`) instead of a
`project_id`, which corresponds to creation of the administrator ship of
such grant.
- formatted using `buf`

# Additional Changes

None

# Additional Context

- part of https://github.com/zitadel/zitadel/issues/10772
- requires backport to v4.x

---------

Co-authored-by: Gayathri Vijayan <66356931+grvijayan@users.noreply.github.com>
(cherry picked from commit 0f2a349ec1)
2025-10-27 08:55:55 +01:00
Matías Racedo
40d8f1fe00 docs: SCIM provisioning from Okta to ZITADEL (#10437)
Adds a step-by-step guide for configuring SCIM provisioning from Okta
into ZITADEL using a service user with the Org User Manager role,
including authentication options and SCIM endpoint details.

---------

Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
(cherry picked from commit 2abcec00e8)
2025-08-25 15:18:07 +02:00
Rajat Singh
2a0441b9b9 docs: remove old keycloak guide (#10483)
̶r̶e̶m̶o̶v̶e̶ ̶o̶l̶d̶ ̶k̶e̶y̶c̶l̶o̶a̶k̶ ̶g̶u̶i̶d̶e̶
̶h̶t̶t̶p̶s̶:̶/̶/̶z̶i̶t̶a̶d̶e̶l̶.̶c̶o̶m̶/̶d̶o̶c̶s̶/̶g̶u̶i̶d̶e̶s̶/̶m̶i̶g̶r̶a̶t̶e̶/̶s̶o̶u̶r̶c̶e̶s̶/̶k̶e̶y̶c̶l̶o̶a̶k̶
̶n̶e̶w̶ ̶o̶n̶e̶ ̶e̶x̶i̶s̶t̶s̶
̶h̶t̶t̶p̶s̶:̶/̶/̶z̶i̶t̶a̶d̶e̶l̶.̶c̶o̶m̶/̶d̶o̶c̶s̶/̶g̶u̶i̶d̶e̶s̶/̶m̶i̶g̶r̶a̶t̶e̶/̶s̶o̶u̶r̶c̶e̶s̶/̶k̶e̶y̶c̶l̶o̶a̶k̶-̶g̶u̶i̶d̶e̶

---------

Signed-off-by: Rajat Singh <rajat@zitadel.com>
Co-authored-by: Rajat Singh <rajat@zitadel.com>
(cherry picked from commit 5e1f0d7e3e)
2025-08-25 15:18:03 +02:00
Silvan
539a9661c5 docs: benchmarks for v4 (#10360)
Introduce benchmark documentation and results for various endpoints in
the Zitadel v4 release, including performance metrics and test
configurations.

(cherry picked from commit 9a799a7c7b)
2025-08-25 15:17:59 +02:00
Federico Coppede
b601075dbc docs(legal): remove billing page to redirect to the HubSpot KBA URL (#10488)
Removed the billing md document and updated the links to the HubSpot KBA
-> https://help.zitadel.com/pricing-and-billing-of-zitadel-services

Co-authored-by: Maximilian <mpa@zitadel.com>
(cherry picked from commit c83a85dee9)
2025-08-25 15:17:56 +02:00
Elio Bischof
8f73fdb3cf docs(login v2): update proxy examples (#10358)
# Which Problems Are Solved

- The proxy examples are updated so a self-hosted login container is
deployed.
- The proxies are configured to direct traffic at /ui/v2/login to it.

# How the Problems Are Solved

The base compose file is extended by correctly configured login
containers for all three scenarios
- TLS disabled
- External TLS
- TLS Enabled

The proxy always connects to the login via HTTP.

# Additional Changes

- All proxies have the TLS disabled mode outcommented, because the login
container has state problems, maybe because it needs secure cookies. The
need for this is unclear, so we avoid creating a follow-up issue.
- The httpd external mode is incommented, as gRPC connections work with
this configuration.
- *ZITADEL* is replaced by *Zitadel*

# Additional Context

- Partially Closes #10016

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
(cherry picked from commit 4930870504)
2025-08-25 15:17:40 +02:00
Elio Bischof
a9e6845626 docs(self-hosting): remove Knative example (#10342)
# Which Problems Are Solved

The Knative docs are removed, as they are not relevant enough.

# How the Problems Are Solved

- The docs page is removed
- The sidebar item is removed

# Additional Context

- Partially Closes #10016

(cherry picked from commit 5f7851768b)
2025-08-25 15:17:39 +02:00
Elio Bischof
31342f2528 docs: simplify compose example (#10407)
# Which Problems Are Solved

Using the compose configuration with for existing installation doesn't
work.
It is not appreciated in the whole community, that we use Traefik for
the deployment example.

# How the Problems Are Solved

- The config we used before v4 is reused and extended in a compatible
way.
- Traefik is removed, Zitadel is accessible again at localhost:8080 and
the login at localhost:3000. Deploying with Traefik is described already
here http://localhost:3000/docs/self-hosting/manage/reverseproxy/traefik
- A page is added that describes how to create a login client and switch
from login v1 to v2. The page is linked in a hint in the compose
example.

# Additional Changes

- The config also sets up a machine user and documents it inline. This
allows us to avoid using the cumbersome separate docker-compose-sa.yaml

# Additional Context

- Closes #10379
- Internal discussion
https://zitadel.slack.com/archives/C08TL9AURL7/p1754471184222879
- Discord about upgrading to v2 login:
-
https://discord.com/channels/927474939156643850/927866013545025566/threads/1401950163940933804
-
https://discord.com/channels/927474939156643850/927866013545025566/1401312126030708756
- Discord about not found errors:
-
https://discord.com/channels/927474939156643850/927866013545025566/threads/1401173877941473291
-
https://discord.com/channels/927474939156643850/927866013545025566/1401045717849604227
-
https://discord.com/channels/927474939156643850/927866013545025566/1401173877941473291
-
https://discord.com/channels/927474939156643850/927866013545025566/1401301168998584361

(cherry picked from commit 7e184727b0)
2025-08-25 15:17:37 +02:00
Stefan Benz
4b58c787cd docs: correct api v2 docs for zitadel v4 (#10249)
# Which Problems Are Solved

As documentation is published from the main branch and the releases get
created from another branch, they are not always correctly equal.

# How the Problems Are Solved

Add previously removed docs again to the documentation.
Add deprecation notes on all replaced endpoints related to
administrators, authentications and projects.

## Deprecated endpoints

- Management service
  - to Organization service v2
    - GetOrgByDomainGlobal
  - to User service v2
    - AddMachineUser
    - UpdateMachine
    - GenerateMachineSecret
    - RemoveMachineSecret
    - GetMachineKeyByIDs
    - ListMachineKeys
    - AddMachineKey
    - RemoveMachineKey
    - UpdateUserName
    - SetUserMetadata
    - BulkSetUserMetadata
    - ListUserMetadata
    - GetUserMetadata
    - RemoveUserMetadata
    - BulkRemoveUserMetadata
    - UpdateHumanPhone
    - GetPersonalAccessTokenByIDs
    - ListPersonalAccessTokens
    - AddPersonalAccessToken
    - RemovePersonalAccessToken
  - to Application service v2beta
    - ListAppKeys
  - to Project service v2beta
    - GetProjectByID
    - GetGrantedProjectByID
    - ListProjects
    - ListGrantedProjects
    - ListGrantedProjectRoles
    - AddProject
    - UpdateProject
    - DeactivateProject
    - ReactivateProject
    - RemoveProject
    - ListProjectRoles
    - AddProjectRole
    - BulkAddProjectRoles
    - UpdateProjectRole
    - RemoveProjectRole
    - GetProjectGrantByID
    - ListProjectGrants
    - ListAllProjectGrants
    - AddProjectGrant
    - UpdateProjectGrant
    - DeactivateProjectGrant
    - ReactivateProjectGrant
    - RemoveProjectGrant
  - to Internal Permission service v2beta
    - ListUserMemberships
    - ListOrgMembers
    - AddOrgMember
    - UpdateOrgMember
    - RemoveOrgMember
    - ListProjectMembers
    - AddProjectMember
    - UpdateProjectMember
    - RemoveProjectMember
    - ListProjectGrantMembers
    - AddProjectGrantMember
    - UpdateProjectGrantMember
    - RemoveProjectGrantMember
- Admin service
  - to Instance service v2
    - GetMyInstance
    - ListInstanceDomains
    - ListInstanceTrustedDomains
    - AddInstanceTrustedDomain
    - RemoveInstanceTrustedDomain
  - to Organization service v2
    - GetOrgByID
    - IsOrgUnique
    - GetDefaultOrg
  - to Internal Permission service v2beta
    - ListIAMMembers
    - AddIAMMember
    - UpdateIAMMember
    - RemoveIAMMember

# Additional Changes

None

# Additional Context

Related to #10112

---------

Co-authored-by: Gayathri Vijayan <66356931+grvijayan@users.noreply.github.com>
Co-authored-by: Gayathri Vijayan <gayathri+github@zitadel.com>
Co-authored-by: Marco A. <marco@zitadel.com>
(cherry picked from commit 57a0abdcc7)
2025-08-25 15:14:01 +02:00
Livio Spring
615972aa2b docs: document service ping configuration and data sent (#10167)
# Which Problems Are Solved

With the introduction of the service ping, we'll send data from all
systems back to a central endpoint for analytics and getting insights
about usage. To make it visible what data is sent and provide the users
an easy way to opt-out, we need a small documentation to tell them what
and how.

# How the Problems Are Solved

Document the service ping including what data is sent and how to opt-out
or configure most important settings.

# Additional Changes

None

# Additional Context

relates to #9869
2025-07-31 15:18:42 +02:00
Elio Bischof
6562c0aec8 docs(self-hosting): simplify lb example and replace compose example (#9844)
# Which Problems Are Solved

The load balancing compose example uses a dedicated service
`use-new-login` that gives the set up machine user the login role and
requires the v2 login using an instance feature. This is cumbersome and
unnecessary.

# How the Problems Are Solved

- A login client machine user is set up and the token is passed to the
login by using the environment variable ZITADEL_SERVICE_USER_TOKEN_FILE.
- The unnecessary service is removed

# Additional Changes

- Uses the static `MasterkeyNeedsToHave32Characters` master key.
- The load balancing example replaces the previous Docker Compose
example.
- The login uses `network_mode: service:zitadel` so it can access the
zitadel service in the docker network via localhost.
- Uses the docker provider for Traefik.

# Additional Context

- Complements https://github.com/zitadel/zitadel/pull/9496
- Partially closes https://github.com/zitadel/zitadel/issues/10016
- When we release, we should update the image tags to latest, for
example with [this PR](https://github.com/zitadel/zitadel/pull/10249).

---------

Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
2025-07-31 15:18:33 +02:00
elinashoko
0cd3b47b16 docs: deprecate organization v2beta endpoints + remove scim preview notice (#10350)
# Which Problems Are Solved

The documentation API regarding organization v2 beta is not up to date.

The documentation regarding SCIM v2 is not up to date.

# How the Problems Are Solved

- Deprecate the existing v2beta endpoints `CreateOrganization` and
`ListOrganizations` in favour of the v2 counterparst
  - Remove the preview warning from SCIM v2 pages

# Additional Context

- Closes #10311 and #10310

---------

Co-authored-by: Marco Ardizzone <marco@zitadel.com>
2025-07-31 10:51:41 +02:00
Rajat Singh
af66c9844a docs(migration): Added step-by-step guide for the Keycloak to Zitadel migration (#10304)
Added a step-by-step guide for Keycloak to Zitadel migration for the
workshop tomorrow

---------

Signed-off-by: RAJAT SINGH <rajatsingh@RAJATs-MacBook-Pro.local>
Signed-off-by: Rajat Singh <rajat@zitadel.com>
Co-authored-by: RAJAT SINGH <rajatsingh@RAJATs-MacBook-Pro.local>
Co-authored-by: Rajat Singh <rajat@zitadel.com>
2025-07-23 14:18:41 -03:00
Mridang Agarwalla
63b894908c docs: add initial docs for the new client-libraries (#10230)
# Which Problems Are Solved

The recently released client libraries were missing documentation, which
made it difficult for developers to understand and use the new features.

# How the Problems Are Solved

This pull request introduces the necessary documentation for the new
client libraries, covering their installation and basic usage.

# Additional Changes

None.

# Additional Context

This documentation supports the recent client library release.
2025-07-21 12:32:00 +05:30
Livio Spring
27cd1d8518 docs(api): add new beta services to api reference (#10018)
# Which Problems Are Solved

The unreleased new resource apis have been removed from the docs:
https://github.com/zitadel/zitadel/pull/10015

# How the Problems Are Solved

Add them to the docs sidenav again, since they're now released.

# Additional Changes

none

# Additional Context

none

---------

Co-authored-by: Fabienne <fabienne.gerschwiler@gmail.com>
Co-authored-by: Marco Ardizzone <marco@zitadel.com>
2025-07-04 19:00:24 +02:00
Stefan Benz
5403be7c4b feat: user profile requests in resource APIs (#10151)
# Which Problems Are Solved

The commands for the resource based v2beta AuthorizationService API are
added.
Authorizations, previously knows as user grants, give a user in a
specific organization and project context roles.
The project can be owned or granted.
The given roles can be used to restrict access within the projects
applications.

The commands for the resource based v2beta InteralPermissionService API
are added.
Administrators, previously knows as memberships, give a user in a
specific organization and project context roles.
The project can be owned or granted.
The give roles give the user permissions to manage different resources
in Zitadel.

API definitions from https://github.com/zitadel/zitadel/issues/9165 are
implemented.

Contains endpoints for user metadata.

# How the Problems Are Solved

### New Methods

- CreateAuthorization
- UpdateAuthorization
- DeleteAuthorization
- ActivateAuthorization
- DeactivateAuthorization
- ListAuthorizations
- CreateAdministrator
- UpdateAdministrator
- DeleteAdministrator
- ListAdministrators
- SetUserMetadata to set metadata on a user
- DeleteUserMetadata to delete metadata on a user
- ListUserMetadata to query for metadata of a user

## Deprecated Methods

### v1.ManagementService
- GetUserGrantByID
- ListUserGrants
- AddUserGrant
- UpdateUserGrant
- DeactivateUserGrant
- ReactivateUserGrant
- RemoveUserGrant
- BulkRemoveUserGrant

### v1.AuthService
- ListMyUserGrants
- ListMyProjectPermissions

# Additional Changes

- Permission checks for metadata functionality on query and command side
- correct existence checks for resources, for example you can only be an
administrator on an existing project
- combined all member tables to singular query for the administrators
- add permission checks for command an query side functionality
- combined functions on command side where necessary for easier
maintainability

# Additional Context

Closes #9165

---------

Co-authored-by: Elio Bischof <elio@zitadel.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-07-04 18:12:59 +02:00
Livio Spring
9ebf2316c6 feat: exchange gRPC server implementation to connectRPC (#10145)
# Which Problems Are Solved

The current maintained gRPC server in combination with a REST (grpc)
gateway is getting harder and harder to maintain. Additionally, there
have been and still are issues with supporting / displaying `oneOf`s
correctly.
We therefore decided to exchange the server implementation to
connectRPC, which apart from supporting connect as protocol, also also
"standard" gRCP clients as well as HTTP/1.1 / rest like clients, e.g.
curl directly call the server without any additional gateway.

# How the Problems Are Solved

- All v2 services are moved to connectRPC implementation. (v1 services
are still served as pure grpc servers)
- All gRPC server interceptors were migrated / copied to a corresponding
connectRPC interceptor.
- API.ListGrpcServices and API. ListGrpcMethods were changed to include
the connect services and endpoints.
- gRPC server reflection was changed to a `StaticReflector` using the
`ListGrpcServices` list.
- The `grpc.Server` interfaces was split into different combinations to
be able to handle the different cases (grpc server and prefixed gateway,
connect server with grpc gateway, connect server only, ...)
- Docs of services serving connectRPC only with no additional gateway
(instance, webkey, project, app, org v2 beta) are changed to expose that
- since the plugin is not yet available on buf, we download it using
`postinstall` hook of the docs

# Additional Changes

- WebKey service is added as v2 service (in addition to the current
v2beta)

# Additional Context

closes #9483

---------

Co-authored-by: Elio Bischof <elio@zitadel.com>
2025-07-04 14:06:20 +00:00
Matías Racedo
27f88a6390 docs(migration): Added step-by-step guide for the Auth0 to Zitadel migration (#10118)
Added a step-by-step guide for the Auth0 to Zitadel migration in
preparation for the upcoming workshop.
2025-06-25 12:44:11 -03:00
Livio Spring
e2a61a6002 docs(api): remove unreleased services from api reference (#10015)
# Which Problems Are Solved

As we migrate resources to the new API, whenever a an implementation got
merged, the API reference was added to the docs sidenav. As these new
services and their implementation are not yet released, it can be
confusing for developers as the corresponding endpoints return 404 or
unimplemented errors.

# How the Problems Are Solved

Currently we just remove it from the sidenav and will add it once
they're released. We're looking into a proper solution for the API
references.

# Additional Changes

None

# Additional Context

None
2025-06-04 08:41:10 +02:00
Fabienne Bühler
b8ff83454e docs: product roadmap and zitadel versions (#9838)
# Which Problems Are Solved

The current public roadmap can be hard to understand for customers and
it doesn't show the timelines for the different versions. which results
in a lot of requests.
It only outlines what is already fixed on the timeline, but doesn't give
any possibilities to outline future topics / features, which not yet
have a timeline

# How the Problems Are Solved

A new roadmap page is added
- Outline for each version when it will have which state
- Outline different zitadel versions with its features, deprecations,
breaking changes, etc.
- Show future topics, which are not yet on the roadmap
2025-06-03 13:44:04 +00:00
Iraq
ae1a2e93c1 feat(api): moving organization API resourced based (#9943) 2025-06-02 16:27:53 +00:00
Stefan Benz
7eb45c6cfd feat: project v2beta resource API (#9742)
# Which Problems Are Solved

Resource management of projects and sub-resources was before limited by
the context provided by the management API, which would mean you could
only manage resources belonging to a specific organization.

# How the Problems Are Solved

With the addition of a resource-based API, it is now possible to manage
projects and sub-resources on the basis of the resources themselves,
which means that as long as you have the permission for the resource,
you can create, read, update and delete it.

- CreateProject to create a project under an organization
- UpdateProject to update an existing project
- DeleteProject to delete an existing project
- DeactivateProject and ActivateProject to change the status of a
project
- GetProject to query for a specific project with an identifier
- ListProject to query for projects and granted projects
- CreateProjectGrant to create a project grant with project and granted
organization
- UpdateProjectGrant to update the roles of a project grant
- DeactivateProjectGrant and ActivateProjectGrant to change the status
of a project grant
- DeleteProjectGrant to delete an existing project grant
- ListProjectGrants to query for project grants
- AddProjectRole to add a role to an existing project
- UpdateProjectRole to change texts of an existing role
- RemoveProjectRole to remove an existing role
- ListProjectRoles to query for project roles

# Additional Changes

- Changes to ListProjects, which now contains granted projects as well
- Changes to messages as defined in the
[API_DESIGN](https://github.com/zitadel/zitadel/blob/main/API_DESIGN.md)
- Permission checks for project functionality on query and command side
- Added testing to unit tests on command side
- Change update endpoints to no error returns if nothing changes in the
resource
- Changed all integration test utility to the new service
- ListProjects now also correctly lists `granted projects`
- Permission checks for project grant and project role functionality on
query and command side
- Change existing pre checks so that they also work resource specific
without resourceowner
- Added the resourceowner to the grant and role if no resourceowner is
provided
- Corrected import tests with project grants and roles
- Added testing to unit tests on command side
- Change update endpoints to no error returns if nothing changes in the
resource
- Changed all integration test utility to the new service
- Corrected some naming in the proto files to adhere to the API_DESIGN

# Additional Context

Closes #9177

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-05-21 14:40:47 +02:00
Marco A.
490e4bd623 feat: instance requests implementation for resource API (#9830)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

These changes introduce resource-based API endpoints for managing
instances and custom domains.

There are 4 types of changes:

- Endpoint implementation: consisting of the protobuf interface and the
implementation of the endpoint. E.g:
606439a172
- (Integration) Tests: testing the implemented endpoint. E.g:
cdfe1f0372
- Fixes: Bugs found during development that are being fixed. E.g:
acbbeedd32
- Miscellaneous: code needed to put everything together or that doesn't
fit any of the above categories. E.g:
529df92abc or
6802cb5468

# How the Problems Are Solved

_Ticked checkboxes indicate that the functionality is complete_

- [x] Instance
  - [x] Create endpoint
  - [x] Create endpoint tests
  - [x] Update endpoint
  - [x] Update endpoint tests
  - [x] Get endpoint
  - [x] Get endpoint tests
  - [x] Delete endpoint
  - [x] Delete endpoint tests
- [x] Custom Domains
  - [x] Add custom domain
  - [x] Add custom domain tests
  - [x] Remove custom domain
  - [x] Remove custom domain tests
  - [x] List custom domains
  - [x] List custom domains tests
- [x] Trusted Domains
  - [x] Add trusted domain
  - [x] Add trusted domain tests
  - [x] Remove trusted domain
  - [x] Remove trusted domain tests
  - [x] List trusted domains
  - [x] List trusted domains tests

# Additional Changes

When looking for instances (through the `ListInstances` endpoint)
matching a given query, if you ask for the results to be order by a
specific column, the query will fail due to a syntax error. This is
fixed in acbbeedd32 . Further explanation
can be found in the commit message

# Additional Context

- Relates to #9452 
- CreateInstance has been excluded:
https://github.com/zitadel/zitadel/issues/9930
- Permission checks / instance retrieval (middleware) needs to be
changed to allow context based permission checks
(https://github.com/zitadel/zitadel/issues/9929), required for
ListInstances

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-05-21 10:50:44 +02:00
Stefan Benz
8fdd58f506 docs: add actions v2 docs (#9652)
# Which Problems Are Solved

There is no documentation yet for Actions v2 regarding the different
usable types and for migrating from Actions v1 to v2.

# How the Problems Are Solved

Add documentation for all use-cases.

# Additional Changes

None

# Additional Context

Closes #9456

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
Co-authored-by: Silvan <27845747+adlerhurst@users.noreply.github.com>
Co-authored-by: Ramon <mail@conblem.me>
Co-authored-by: Elio Bischof <elio@zitadel.com>
Co-authored-by: Kenta Yamaguchi <56732734+KEY60228@users.noreply.github.com>
Co-authored-by: Harsha Reddy <harsha.reddy@klaviyo.com>
Co-authored-by: Livio Spring <livio@zitadel.com>
Co-authored-by: Max Peintner <max@caos.ch>
Co-authored-by: Iraq <66622793+kkrime@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-04-09 13:29:58 +02:00
Fabienne Bühler
07ce3b6905 chore!: Introduce ZITADEL v3 (#9645)
This PR summarizes multiple changes specifically only available with
ZITADEL v3:

- feat: Web Keys management
(https://github.com/zitadel/zitadel/pull/9526)
- fix(cmd): ensure proper working of mirror
(https://github.com/zitadel/zitadel/pull/9509)
- feat(Authz): system user support for permission check v2
(https://github.com/zitadel/zitadel/pull/9640)
- chore(license): change from Apache to AGPL
(https://github.com/zitadel/zitadel/pull/9597)
- feat(console): list v2 sessions
(https://github.com/zitadel/zitadel/pull/9539)
- fix(console): add loginV2 feature flag
(https://github.com/zitadel/zitadel/pull/9682)
- fix(feature flags): allow reading "own" flags
(https://github.com/zitadel/zitadel/pull/9649)
- feat(console): add Actions V2 UI
(https://github.com/zitadel/zitadel/pull/9591)

BREAKING CHANGE
- feat(webkey): migrate to v2beta API
(https://github.com/zitadel/zitadel/pull/9445)
- chore!: remove CockroachDB Support
(https://github.com/zitadel/zitadel/pull/9444)
- feat(actions): migrate to v2beta API
(https://github.com/zitadel/zitadel/pull/9489)

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
Co-authored-by: Silvan <27845747+adlerhurst@users.noreply.github.com>
Co-authored-by: Ramon <mail@conblem.me>
Co-authored-by: Elio Bischof <elio@zitadel.com>
Co-authored-by: Kenta Yamaguchi <56732734+KEY60228@users.noreply.github.com>
Co-authored-by: Harsha Reddy <harsha.reddy@klaviyo.com>
Co-authored-by: Livio Spring <livio@zitadel.com>
Co-authored-by: Max Peintner <max@caos.ch>
Co-authored-by: Iraq <66622793+kkrime@users.noreply.github.com>
Co-authored-by: Florian Forster <florian@zitadel.com>
Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Max Peintner <peintnerm@gmail.com>
2025-04-02 16:53:06 +02:00
Fabienne Bühler
febf410d80 docs: Update customer portal docs/screenshots (#9604)
# Which Problems Are Solved

With the recent updates of our customer portal design, our onboarding
guide and customer portal docs were outdated.

# How the Problems Are Solved

- Updated screenshots of customer portal
- Updated screenshots of onboarding in management console
- Updated quickstarts with changes that have been made in the onbaording

---------

Co-authored-by: Maximilian <mpa@zitadel.com>
2025-03-25 18:20:49 +01:00
Maximilian
988146b2ad fix: sidebar imports (#9589)
# Which Problems Are Solved

Running local development of the docs didn't work due to errors with
sidebar imports.

# How the Problems Are Solved

The imports held the sidebar items in a "default" object. Changed the
imports

# Additional Changes

removed some comments
2025-03-19 18:21:41 +02:00
Max Peintner
9f0d933bf6 docs: update oidc-playground link (#8529)
The new OIDC playground is deployed on
https://zitadel.com/oidc-playground.
This PR updates the relative links in the docs

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-03-03 13:54:00 +00:00
Livio Spring
4df3b6492c chore: API guidelines (#9340)
# Which Problems Are Solved

There were no guideline to how design future APIs and their endpoints.
The V3 documentation was to specific and targeted towards internal
stakeholders.
This PR is intended as base and kept to the minimum. If more details or
additional guideline or rules are needed, they will be added in the
future.

# How the Problems Are Solved

- Removed the V3 description and corresponding examples.
- Provided general guideline for the design of APIs, which includes the
structure, naming, versioning, error handling and more.

# Additional Changes

None

# Additional Context

closes #9184

---------

Co-authored-by: Maximilian <mpa@zitadel.com>
Co-authored-by: Silvan <27845747+adlerhurst@users.noreply.github.com>
2025-02-27 11:30:39 +00:00
Fabienne Bühler
4375c065b2 docs: add fast api example (#9418)
# Which Problems Are Solved

The community implemented an example for integrating fastAPI with
Zitadel.
So far this example has not been listed.

# How the Problems Are Solved

The example is now listed
Disclaimer is added, that some of the examples are not maintained by us
2025-02-26 14:54:52 +00:00
Silvan
1ce68a562b docs(benchmarks): v2.70.0 (#9416)
# Which Problems Are Solved

No benchmarks for v2.70.0 were provided so far.

# How the Problems Are Solved

Benchmarks added

# Additional changes

- it's now possible to plot multiple charts, one chart per `metric_name`
2025-02-26 14:03:20 +00:00
Livio Spring
911200aa9b feat(api): allow Device Authorization Grant using custom login UI (#9387)
# Which Problems Are Solved

The OAuth2 Device Authorization Grant could not yet been handled through
the new login UI, resp. using the session API.
This PR adds the ability for the login UI to get the required
information to display the user and handle their decision (approve with
authorization or deny) using the OIDC Service API.

# How the Problems Are Solved

- Added a `GetDeviceAuthorizationRequest` endpoint, which allows getting
the `id`, `client_id`, `scope`, `app_name` and `project_name` of the
device authorization request
- Added a `AuthorizeOrDenyDeviceAuthorization` endpoint, which allows to
approve/authorize with the session information or deny the request. The
identification of the request is done by the `device_authorization_id` /
`id` returned in the previous request.
- To prevent leaking the `device_code` to the UI, but still having an
easy reference, it's encrypted and returned as `id`, resp. decrypted
when used.
- Fixed returned error types for device token responses on token
endpoint:
- Explicitly return `access_denied` (without internal error) when user
denied the request
  - Default to `invalid_grant` instead of `access_denied`
- Explicitly check on initial state when approving the reqeust
- Properly handle done case (also relates to initial check) 
- Documented the flow and handling in custom UIs (according to OIDC /
SAML)

# Additional Changes

- fixed some typos and punctuation in the corresponding OIDC / SAML
guides.
- added some missing translations for auth and saml request

# Additional Context

- closes #6239

---------

Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
2025-02-25 07:33:13 +01:00
Fabienne Bühler
d7332d1ac4 docs: remove user schema and user api documentation from v3 api version (#9358)
# Which Problems Are Solved

Due to other priorities we decided to push the implementation of user
schema back in the roadmap.
As the feature is not yet complete and can't be tested/used, the API
Docs V3 for user schema and user lead to confusion.

# How the Problems Are Solved

I removed the api docs for user schema and user v3 from the sidenav for
the moment

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-02-18 07:11:52 +00:00
Lars
60cfa6cb76 docs: scim v2 interface (#9246)
# Which Problems Are Solved
- Lack of documentation for the SCIM v2 interface

# How the Problems Are Solved
- Introduced a new documentation page detailing the SCIM v2 interface

# Additional Context
Part of #8140

---------

Co-authored-by: Fabienne Bühler <fabienne@zitadel.com>
2025-01-30 08:07:28 +00:00
Stefan Benz
679ab58fa1 docs: support docs for SAML session in Custom Login UI (#9144)
# Which Problems Are Solved

SAML session implemented, but no how-to comparable to the OIDC sessions
for custom login available.

# How the Problems Are Solved

Added documentation, which should be also comparable with the OIDC
session for ease-of-use.

# Additional Changes

Added generated SAML API docs.

# Additional Context

Closes #9088 
Follow-up issue #9267

---------

Co-authored-by: Fabienne Bühler <fabienne@zitadel.com>
Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-01-29 11:29:48 +00:00
Fabienne Bühler
75f0ad42e6 docs: Login v2 docs (#9159)
# Which Problems Are Solved

As we are going into the Beta testing phase of our new typescript login
(login V2), we need to have a documentation about the capabilities, how
to test, and what the current limitations are.

# How the Problems Are Solved

Added new section for the Login V2

---------

Co-authored-by: Max Peintner <max@caos.ch>
Co-authored-by: Max Peintner <peintnerm@gmail.com>
2025-01-15 13:29:13 +00:00
Livio Spring
40fedace3c docs(oidc): add back-channel logout (#9034)
# Which Problems Are Solved

OIDC Back-Channel Logout released with
[V2.65.0](https://github.com/zitadel/zitadel/releases/tag/v2.65.0) were
not yet documented

# How the Problems Are Solved

- Added small guide and description
- Updated claims (added `sid` and `events`)

# Additional Changes

None

# Additional Context

relates to https://github.com/zitadel/zitadel/issues/8467
2024-12-13 09:47:04 +00:00
Silvan
e130467b7a docs(benchmarks): add v2.66.0 (#9038)
# Which Problems Are Solved

Add benchmarks for v2.66.0
2024-12-11 12:14:33 +02:00
Tim Möhlmann
c31b5df73b docs: add caches documentation (#8902)
# Which Problems Are Solved

Explain the usage of the new cache mechanisms.

# How the Problems Are Solved

Provide a dedicated page on caches with reference to `defaults.yaml`.

# Additional Changes

- Fix a broken link tag in token exchange docs.

# Additional Context

- Closes #8855
2024-11-19 10:56:10 +01:00
Silvan
fbebe0f183 docs: init benchmarks (#8894)
# Which Problems Are Solved

Adds initial benchmarks.

# How the Problems Are Solved

Added section `apis/benchmarks`

# Additional Changes

Update Makefile dependencies

# Additional Context

- Part of https://github.com/zitadel/zitadel/issues/8023
- Part of https://github.com/zitadel/zitadel/issues/8352
2024-11-15 23:44:22 +02:00
Elio Bischof
fb481256ec docs: reorganize actions v3 docs (#8712)
# Which Problems Are Solved

The actions v2 docs have broken links. Also, actions docs are
distributed and the navigation feels messy.

# How the Problems Are Solved

- The two actions v2 docs pages are integrated into the more accurate
actions v3 API section. Redirects are added to the Vercel config.


![image](https://github.com/user-attachments/assets/0b3b2255-4b90-45b3-be1d-ee875dd86f03)

![image](https://github.com/user-attachments/assets/a35314d7-11fb-446e-ae47-9d3e65adeccd)

- The broken links are fixed.

# Additional Changes

A text is added to the actions v3 section describing the changes coming
with v3.


![image](https://github.com/user-attachments/assets/bba0c9a2-36af-4820-aa84-a823b8801d79)

# Additional Context

- Replaces #8688
- Broken links reported in
https://discord.com/channels/927474939156643850/1275551972283646055
- Broken links reported in
https://discord.com/channels/927474939156643850/1168451861515354133/1280394234679136267

---------

Co-authored-by: Fabi <fabienne@zitadel.com>
2024-10-03 16:26:05 +00:00
mffap
624fee97c0 docs: optimized examples and sdk for search (#8657)
# Which Problems Are Solved

Page title was "introduction" and the headings were missing a h2 level.
This makes it difficult to index for search, both internal and external.

# How the Problems Are Solved

* Change the page title
* Pulled all headings one level up

# Additional Changes

- Show all elements in sdk-example folder automaticalls
2024-09-25 08:14:58 +00:00
mffap
87ac5ed254 docs: Improve http notification doc (#8642)
# Which Problems Are Solved

The docs contained typos and links that led to 404.
More subejectively the docs did not provide enough guidance for new
users what providers are and how to configure an HTTP provider and then
activate them. Only basic links to the API docs were given without
examples on how to achieve a basic configuration.

# How the Problems Are Solved

References and typos fixed and reworked the guide.

# Additional Changes

Added code highlighting for json and bash.

# Additional Context

We could further improve by adding more help on this page on how to
configure SMS and SMTP providers.
2024-09-18 15:38:55 +02:00
Stefan Benz
c297a62c4f docs: notification provider docs (#8626)
# Which Problems Are Solved

There is no documentation on how to use the HTTP providers for SMS and
Email.

# How the Problems Are Solved

Add documentation and correct the tags in the proto files to correctly
group the calls for the API docs.

# Additional Changes

None

# Additional Context

None

---------

Co-authored-by: Fabi <fabienne@zitadel.com>
2024-09-16 13:28:29 +02:00
Tim Möhlmann
2981ff04da docs(oidc): web keys (#8508)
# Which Problems Are Solved

Explain the web key implementation and usage in zitadel.

# How the Problems Are Solved

Add documentation

# Additional Changes

- none

# Additional Context

- Related to https://github.com/zitadel/zitadel/issues/7809
- Example cURL commands are broken:
https://github.com/zitadel/zitadel/issues/8507

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2024-09-06 08:58:06 +02:00
Tim Möhlmann
ab4daa0ebb fix(webkeys): remove include private key from projection index (#8436)
# Which Problems Are Solved

When Web keys with a large RSA Bitsize were generated, the new web key
did not get projected.
Zitadel logs printed the following errors:

```
time="2024-08-15T09:18:47Z" level=debug msg="execution of statements failed" caller="/home/tim/Repositories/zitadel/zitadel/internal/eventstore/handler/v2/handler.go:518" error="statement failed: ID=CRDB-pKtsr Message=exec failed Parent=(ERROR: index row size 3400 exceeds btree version 4 maximum 2704 for index \"web_keys_web_key_state_idx\" (SQLSTATE 54000))" lastProcessedIndex=-1 projection=projections.web_keys
```


# How the Problems Are Solved

Remove the the `WithInclude` option with the Private key from the
`web_keys` projection index and bump the projection version.

# Additional Changes

- Correct RPC summaries for documentation
- Fix docs slug in sidebar.js

# Additional Context

- Found during release review.
2024-08-16 11:41:09 +00:00