The stored directory configuration — never the bind password.

GET

/api/v1/settings/ldap

curl --request GET \
  --url https://example.com/api/v1/settings/ldap \
  --header 'Authorization: Bearer <token>'

Authorizations

• bearer

Responses

200

The directory configuration, or null when none is saved

Media typeapplication/json

The directory configuration, or null when none has been saved.

object

config

One of:

null

null

object

null rather than a 404: “not configured” is the normal state of a fresh installation, and the settings form wants to render its empty self rather than an error.

object

bind_dn

required

string

ca_cert

The operator-supplied CA certificate, in PEM. A certificate is public, so unlike the bind password it round-trips through the form rather than being write-only.

string | null

default_role

string | null

enabled

required

boolean

group_base_dn

string | null

group_filter

string | null

group_name_attribute

required

string

has_bind_password

required

True once a bind password has been stored, so the form can say “set” without revealing it.

boolean

host

required

string

member_of_attribute

required

string

port

required

integer format: int32

role_map

required

object

key

additional properties

string

security

required

How the connection is protected. Two variants, both TLS — there is deliberately no plaintext option, so ldap:// cannot be configured into existence and the bind password cannot cross the wire in the clear. Adding one later would be a certificate-verification-disable flag by another name and needs the same argument (ADR-041 decision 2).

string

Allowed values: ldaps starttls

uid_attribute

required

string

updated_at

required

string

user_base_dn

required

string

user_filter

required

string

username_attribute

required

string

Example

{
  "config": {
    "security": "ldaps"
  }
}

401

No valid bearer token

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Role lacks the user-administration permission

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

503

This deployment has no directory store

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}