/third-party-applications/reconcile-access - Align Logto access rules with the portal lists

Add MCP server to your AI tool

Allow AI tools and LLMs to interact with the API documentation portal through MCP.

MCP server URL

https://api.my.nethesis.it/mcp

Standard setup for AI tools providing an mcp.json file

mcp.json 
{
  "my.nethesis.it MCP server": {
    "url": "https://api.my.nethesis.it/mcp"
  }
}
Close
POST /third-party-applications/reconcile-access
Bearer auth

For every third-party application whose sync config sets access_control.idp_enforced, aligns Logto app-level access control with the organizations the portal admits: the Owner organization, every distributor when the distributor role is admitted, and the resellers and customers whose distributor grants the portal. An application pinned to organization_ids gets exactly those. idp_enforced: false makes sure Logto enforces nothing for the application. The same reconcile runs on its own after organization changes and periodically; call this for the rollout or to check the state. Never enables enforcement over an empty organization list. Owner organization only.

Query parameters

  • dry_run boolean

    When true nothing is written to Logto; the report says what would change.

    Default value is false.

Responses

  • 200 application/json

    Reconcile report

    Hide response attributes Show response attributes object
    • code integer
    • message string
    • data object
      Hide data attributes Show data attributes object
      • dry_run boolean
      • applications array[object]

        Outcome of the Logto access-rule reconcile for one idp_enforced application

        Hide applications attributes Show applications attributes object

        Outcome of the Logto access-rule reconcile for one idp_enforced application

        • application string Required
        • application_id string Required

          Logto application id

        • enforced boolean Required

          The idp_enforced flag of the application in the sync config

        • organization_ids array[string] Required

          The organizations the rule admits (empty when enforced is false)

        • enabled boolean Required

          Whether Logto evaluates the rule after the reconcile (or would, in a dry run)

        • rules_changed boolean Required

          Whether the organization list was (or would be) rewritten

        • enabled_changed boolean Required

          Whether the enabled flag was (or would be) flipped

        • error string

          Why the application was left untouched, when it was
  • 401 application/json

    Unauthorized - invalid or missing token

    Hide response attributes Show response attributes object
    • code integer
    • message string
    • data object | null
  • 403 application/json

    Forbidden - insufficient permissions

    Hide response attributes Show response attributes object
    • code integer
    • message string
    • data object | null
  • 500 application/json

    Internal server error

    Hide response attributes Show response attributes object
    • code integer
    • message string
    • data object | null
POST /third-party-applications/reconcile-access 
curl \
 --request POST 'https://my.nethesis.it/backend/api/third-party-applications/reconcile-access' \
 --header "Authorization: Bearer $ACCESS_TOKEN"
Response examples (200) 
{
  "code": 200,
  "message": "portal access rules reconciled",
  "data": {
    "dry_run": true,
    "applications": [
      {
        "application": "helpdesk.nethesis.it",
        "application_id": "6mcxf9pv2yjv4hiw7xjri",
        "enforced": true,
        "organization_ids": [
          "string"
        ],
        "enabled": true,
        "rules_changed": true,
        "enabled_changed": true,
        "error": "string"
      }
    ]
  }
}
Response examples (401) 
{
  "code": 401,
  "message": "invalid token",
  "data": {}
}
Response examples (403) 
{
  "code": 403,
  "message": "insufficient permissions",
  "data": {}
}
Response examples (500) 
{
  "code": 500,
  "message": "internal server error",
  "data": {}
}