@smartytalent/mcp-tools 0.6.0 → 0.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/tools.json +285 -0
- package/package.json +1 -1
package/dist/tools.json
CHANGED
|
@@ -181,6 +181,66 @@
|
|
|
181
181
|
"type": "object",
|
|
182
182
|
"description": "Tenant-level outbound-sync defaults (ATS integrations): {syncStage, syncNotes, syncRatings, syncTags, syncReports, syncConversationReports, syncMessages} - overridden per job by job.settings.operation. NOTE: the generated model whitelists keys, so this property MUST be declared for the SDK to carry it."
|
|
183
183
|
},
|
|
184
|
+
"sso": {
|
|
185
|
+
"type": "object",
|
|
186
|
+
"description": "Enterprise SSO configuration. READ-ONLY here: the generic tenant PATCH strips this key, the only writers are the /v1/tenants/{tenantId}/sso doors. Sending it in a PATCH is ignored (not an error).",
|
|
187
|
+
"properties": {
|
|
188
|
+
"enabled": {
|
|
189
|
+
"type": "boolean",
|
|
190
|
+
"description": "Whether enterprise SSO is provisioned for this tenant"
|
|
191
|
+
},
|
|
192
|
+
"provider": {
|
|
193
|
+
"type": "string",
|
|
194
|
+
"enum": [
|
|
195
|
+
"microsoft"
|
|
196
|
+
],
|
|
197
|
+
"description": "Identity provider family behind the tenant's IdP"
|
|
198
|
+
},
|
|
199
|
+
"entraTenantId": {
|
|
200
|
+
"type": "string",
|
|
201
|
+
"description": "GUID of the customer's Entra tenant. One Cognito IdP serves exactly one Entra tenant: Cognito compares the token iss to a single configured issuer, and Entra mints iss per tenant, so a multi-tenant issuer can never match."
|
|
202
|
+
},
|
|
203
|
+
"idpName": {
|
|
204
|
+
"type": "string",
|
|
205
|
+
"description": "Name of the Cognito identity provider, ms-{shortCode}. Carries the tenant, which is how the auth triggers resolve it without scanning."
|
|
206
|
+
},
|
|
207
|
+
"domains": {
|
|
208
|
+
"type": "array",
|
|
209
|
+
"description": "Email domains of the customer. A domain gates JIT and auto-link ONLY once it carries verifiedAt - uniqueness in the claim registry is not proof of ownership.",
|
|
210
|
+
"items": {
|
|
211
|
+
"type": "object",
|
|
212
|
+
"properties": {
|
|
213
|
+
"name": {
|
|
214
|
+
"type": "string"
|
|
215
|
+
},
|
|
216
|
+
"verifiedAt": {
|
|
217
|
+
"type": "string"
|
|
218
|
+
},
|
|
219
|
+
"method": {
|
|
220
|
+
"type": "string",
|
|
221
|
+
"enum": [
|
|
222
|
+
"ops-confirmed",
|
|
223
|
+
"dns-txt",
|
|
224
|
+
"entra-verified"
|
|
225
|
+
]
|
|
226
|
+
}
|
|
227
|
+
}
|
|
228
|
+
}
|
|
229
|
+
},
|
|
230
|
+
"defaultRole": {
|
|
231
|
+
"type": "string",
|
|
232
|
+
"description": "Role granted when a pending JIT user is APPROVED - never granted by the act of signing in. Domain-gated JIT makes the whole customer workforce eligible, so an automatic operational role would expose candidate data to anyone who can authenticate at the customer's IdP."
|
|
233
|
+
},
|
|
234
|
+
"required": {
|
|
235
|
+
"type": "boolean",
|
|
236
|
+
"description": "When true, password login is refused for this tenant's users. Owner and sysowner are always exempt - a break-glass account, because an outage in the customer's Entra must not lock them out of the product."
|
|
237
|
+
},
|
|
238
|
+
"autoApprove": {
|
|
239
|
+
"type": "boolean",
|
|
240
|
+
"description": "When true, a JIT user is activated immediately with defaultRole instead of landing in a pending state. Off by default."
|
|
241
|
+
}
|
|
242
|
+
}
|
|
243
|
+
},
|
|
184
244
|
"language": {
|
|
185
245
|
"type": "string"
|
|
186
246
|
},
|
|
@@ -581,6 +641,66 @@
|
|
|
581
641
|
"type": "object",
|
|
582
642
|
"description": "Tenant-level outbound-sync defaults (ATS integrations): {syncStage, syncNotes, syncRatings, syncTags, syncReports, syncConversationReports, syncMessages} - overridden per job by job.settings.operation. NOTE: the generated model whitelists keys, so this property MUST be declared for the SDK to carry it."
|
|
583
643
|
},
|
|
644
|
+
"sso": {
|
|
645
|
+
"type": "object",
|
|
646
|
+
"description": "Enterprise SSO configuration. READ-ONLY here: the generic tenant PATCH strips this key, the only writers are the /v1/tenants/{tenantId}/sso doors. Sending it in a PATCH is ignored (not an error).",
|
|
647
|
+
"properties": {
|
|
648
|
+
"enabled": {
|
|
649
|
+
"type": "boolean",
|
|
650
|
+
"description": "Whether enterprise SSO is provisioned for this tenant"
|
|
651
|
+
},
|
|
652
|
+
"provider": {
|
|
653
|
+
"type": "string",
|
|
654
|
+
"enum": [
|
|
655
|
+
"microsoft"
|
|
656
|
+
],
|
|
657
|
+
"description": "Identity provider family behind the tenant's IdP"
|
|
658
|
+
},
|
|
659
|
+
"entraTenantId": {
|
|
660
|
+
"type": "string",
|
|
661
|
+
"description": "GUID of the customer's Entra tenant. One Cognito IdP serves exactly one Entra tenant: Cognito compares the token iss to a single configured issuer, and Entra mints iss per tenant, so a multi-tenant issuer can never match."
|
|
662
|
+
},
|
|
663
|
+
"idpName": {
|
|
664
|
+
"type": "string",
|
|
665
|
+
"description": "Name of the Cognito identity provider, ms-{shortCode}. Carries the tenant, which is how the auth triggers resolve it without scanning."
|
|
666
|
+
},
|
|
667
|
+
"domains": {
|
|
668
|
+
"type": "array",
|
|
669
|
+
"description": "Email domains of the customer. A domain gates JIT and auto-link ONLY once it carries verifiedAt - uniqueness in the claim registry is not proof of ownership.",
|
|
670
|
+
"items": {
|
|
671
|
+
"type": "object",
|
|
672
|
+
"properties": {
|
|
673
|
+
"name": {
|
|
674
|
+
"type": "string"
|
|
675
|
+
},
|
|
676
|
+
"verifiedAt": {
|
|
677
|
+
"type": "string"
|
|
678
|
+
},
|
|
679
|
+
"method": {
|
|
680
|
+
"type": "string",
|
|
681
|
+
"enum": [
|
|
682
|
+
"ops-confirmed",
|
|
683
|
+
"dns-txt",
|
|
684
|
+
"entra-verified"
|
|
685
|
+
]
|
|
686
|
+
}
|
|
687
|
+
}
|
|
688
|
+
}
|
|
689
|
+
},
|
|
690
|
+
"defaultRole": {
|
|
691
|
+
"type": "string",
|
|
692
|
+
"description": "Role granted when a pending JIT user is APPROVED - never granted by the act of signing in. Domain-gated JIT makes the whole customer workforce eligible, so an automatic operational role would expose candidate data to anyone who can authenticate at the customer's IdP."
|
|
693
|
+
},
|
|
694
|
+
"required": {
|
|
695
|
+
"type": "boolean",
|
|
696
|
+
"description": "When true, password login is refused for this tenant's users. Owner and sysowner are always exempt - a break-glass account, because an outage in the customer's Entra must not lock them out of the product."
|
|
697
|
+
},
|
|
698
|
+
"autoApprove": {
|
|
699
|
+
"type": "boolean",
|
|
700
|
+
"description": "When true, a JIT user is activated immediately with defaultRole instead of landing in a pending state. Off by default."
|
|
701
|
+
}
|
|
702
|
+
}
|
|
703
|
+
},
|
|
584
704
|
"language": {
|
|
585
705
|
"type": "string"
|
|
586
706
|
},
|
|
@@ -1103,6 +1223,131 @@
|
|
|
1103
1223
|
"operationId": "tenantPhoneNumbersUnassignOptions"
|
|
1104
1224
|
}
|
|
1105
1225
|
},
|
|
1226
|
+
{
|
|
1227
|
+
"name": "show_tenant_sso",
|
|
1228
|
+
"description": "Show Tenant Enterprise SSO",
|
|
1229
|
+
"inputSchema": {
|
|
1230
|
+
"type": "object",
|
|
1231
|
+
"properties": {}
|
|
1232
|
+
},
|
|
1233
|
+
"_meta": {
|
|
1234
|
+
"method": "GET",
|
|
1235
|
+
"path": "/v1/tenants/{tenantId}/sso",
|
|
1236
|
+
"operationId": "showTenantSso"
|
|
1237
|
+
}
|
|
1238
|
+
},
|
|
1239
|
+
{
|
|
1240
|
+
"name": "configure_tenant_sso",
|
|
1241
|
+
"description": "Configure Tenant Enterprise SSO",
|
|
1242
|
+
"inputSchema": {
|
|
1243
|
+
"type": "object",
|
|
1244
|
+
"properties": {
|
|
1245
|
+
"data": {
|
|
1246
|
+
"type": "object",
|
|
1247
|
+
"properties": {
|
|
1248
|
+
"type": {
|
|
1249
|
+
"type": "string",
|
|
1250
|
+
"enum": [
|
|
1251
|
+
"tenant-sso"
|
|
1252
|
+
]
|
|
1253
|
+
},
|
|
1254
|
+
"attributes": {
|
|
1255
|
+
"title": "TenantSsoAttributesSchema",
|
|
1256
|
+
"type": "object",
|
|
1257
|
+
"description": "Enterprise SSO configuration for one tenant. Written only by the /v1/tenants/{tenantId}/sso doors (sysowner); the generic tenant PATCH strips settings.sso.",
|
|
1258
|
+
"properties": {
|
|
1259
|
+
"provider": {
|
|
1260
|
+
"type": "string",
|
|
1261
|
+
"enum": [
|
|
1262
|
+
"microsoft"
|
|
1263
|
+
],
|
|
1264
|
+
"description": "Identity provider family behind the tenant's IdP"
|
|
1265
|
+
},
|
|
1266
|
+
"entraTenantId": {
|
|
1267
|
+
"type": "string",
|
|
1268
|
+
"description": "GUID of the customer's Entra tenant. One Cognito IdP serves exactly one Entra tenant: Cognito compares the token iss to a single configured issuer and Entra mints iss per tenant, so a multi-tenant issuer can never match. NOTE: CreateIdentityProvider accepts a /common issuer without error and only sign-in fails, which is why 'common' is rejected here."
|
|
1269
|
+
},
|
|
1270
|
+
"idpName": {
|
|
1271
|
+
"type": "string",
|
|
1272
|
+
"description": "Derived server-side as ms-{shortCode} and ignored if sent. The name carries the tenant, which is how the auth triggers resolve it without scanning; it must fit Cognito's 32-character IdP name limit."
|
|
1273
|
+
},
|
|
1274
|
+
"domains": {
|
|
1275
|
+
"type": "array",
|
|
1276
|
+
"description": "Email domains of the customer. A domain gates JIT and auto-link ONLY once it carries verifiedAt - uniqueness in the claim registry is not proof of ownership. Public mail providers (gmail.com and friends) are rejected: a shared domain can never prove its holder employs the person signing in.",
|
|
1277
|
+
"items": {
|
|
1278
|
+
"type": "object",
|
|
1279
|
+
"properties": {
|
|
1280
|
+
"name": {
|
|
1281
|
+
"type": "string"
|
|
1282
|
+
},
|
|
1283
|
+
"verifiedAt": {
|
|
1284
|
+
"type": "string"
|
|
1285
|
+
},
|
|
1286
|
+
"method": {
|
|
1287
|
+
"type": "string",
|
|
1288
|
+
"enum": [
|
|
1289
|
+
"ops-confirmed",
|
|
1290
|
+
"dns-txt",
|
|
1291
|
+
"entra-verified"
|
|
1292
|
+
]
|
|
1293
|
+
}
|
|
1294
|
+
}
|
|
1295
|
+
}
|
|
1296
|
+
},
|
|
1297
|
+
"defaultRole": {
|
|
1298
|
+
"type": "string",
|
|
1299
|
+
"description": "Role granted when a pending JIT user is APPROVED - never granted by the act of signing in. Domain-gated JIT makes the whole customer workforce eligible, so an automatic operational role would expose candidate data to anyone who can authenticate at the customer's IdP. Privileged roles (owner/admin/sysowner) are rejected."
|
|
1300
|
+
},
|
|
1301
|
+
"required": {
|
|
1302
|
+
"type": "boolean",
|
|
1303
|
+
"description": "When true, password login is refused for this tenant's users. Owner and sysowner are always exempt - a break-glass account, because an outage in the customer's Entra must not lock them out of the product."
|
|
1304
|
+
},
|
|
1305
|
+
"autoApprove": {
|
|
1306
|
+
"type": "boolean",
|
|
1307
|
+
"description": "When true, a JIT user is activated immediately with defaultRole instead of landing in a pending state. Off by default."
|
|
1308
|
+
},
|
|
1309
|
+
"enabled": {
|
|
1310
|
+
"type": "boolean",
|
|
1311
|
+
"description": "Whether a Cognito identity provider exists for this tenant. Owned by the provisioning step and ignored if sent."
|
|
1312
|
+
}
|
|
1313
|
+
}
|
|
1314
|
+
}
|
|
1315
|
+
}
|
|
1316
|
+
}
|
|
1317
|
+
}
|
|
1318
|
+
},
|
|
1319
|
+
"_meta": {
|
|
1320
|
+
"method": "POST",
|
|
1321
|
+
"path": "/v1/tenants/{tenantId}/sso",
|
|
1322
|
+
"operationId": "configureTenantSso"
|
|
1323
|
+
}
|
|
1324
|
+
},
|
|
1325
|
+
{
|
|
1326
|
+
"name": "delete_tenant_sso",
|
|
1327
|
+
"description": "Delete Tenant Enterprise SSO",
|
|
1328
|
+
"inputSchema": {
|
|
1329
|
+
"type": "object",
|
|
1330
|
+
"properties": {}
|
|
1331
|
+
},
|
|
1332
|
+
"_meta": {
|
|
1333
|
+
"method": "DELETE",
|
|
1334
|
+
"path": "/v1/tenants/{tenantId}/sso",
|
|
1335
|
+
"operationId": "deleteTenantSso"
|
|
1336
|
+
}
|
|
1337
|
+
},
|
|
1338
|
+
{
|
|
1339
|
+
"name": "tenant_sso_options",
|
|
1340
|
+
"description": "Tenant SSO Options",
|
|
1341
|
+
"inputSchema": {
|
|
1342
|
+
"type": "object",
|
|
1343
|
+
"properties": {}
|
|
1344
|
+
},
|
|
1345
|
+
"_meta": {
|
|
1346
|
+
"method": "OPTIONS",
|
|
1347
|
+
"path": "/v1/tenants/{tenantId}/sso",
|
|
1348
|
+
"operationId": "tenantSsoOptions"
|
|
1349
|
+
}
|
|
1350
|
+
},
|
|
1106
1351
|
{
|
|
1107
1352
|
"name": "purchase_tenant_phone_number",
|
|
1108
1353
|
"description": "Purchase Phone Number",
|
|
@@ -1321,6 +1566,26 @@
|
|
|
1321
1566
|
"type": "object",
|
|
1322
1567
|
"additionalProperties": true
|
|
1323
1568
|
},
|
|
1569
|
+
"identities": {
|
|
1570
|
+
"type": "array",
|
|
1571
|
+
"description": "Federated logins linked to this account. System-owned: written only by the auth triggers and the linking doors, never by a PATCH. Linking must happen BEFORE the first federated sign-in, otherwise Cognito mints a separate profile that has to be deleted.",
|
|
1572
|
+
"items": {
|
|
1573
|
+
"type": "object",
|
|
1574
|
+
"properties": {
|
|
1575
|
+
"provider": {
|
|
1576
|
+
"type": "string",
|
|
1577
|
+
"description": "Cognito identity provider name (Google, LinkedIn, or ms-{shortCode})"
|
|
1578
|
+
},
|
|
1579
|
+
"sub": {
|
|
1580
|
+
"type": "string",
|
|
1581
|
+
"description": "The provider's subject identifier. Pairwise per client_id at Entra, so it only matches tokens issued to the same app registration as the IdP."
|
|
1582
|
+
},
|
|
1583
|
+
"linkedAt": {
|
|
1584
|
+
"type": "string"
|
|
1585
|
+
}
|
|
1586
|
+
}
|
|
1587
|
+
}
|
|
1588
|
+
},
|
|
1324
1589
|
"avatarUrl": {
|
|
1325
1590
|
"type": "string",
|
|
1326
1591
|
"description": "CDN URL of the profile picture. Either a per-user upload (users/... key, minted via the upload door) or a shared gallery image (avatars/...). Must point at an existing CDN object - updateUser head-checks it."
|
|
@@ -1639,6 +1904,26 @@
|
|
|
1639
1904
|
"type": "object",
|
|
1640
1905
|
"additionalProperties": true
|
|
1641
1906
|
},
|
|
1907
|
+
"identities": {
|
|
1908
|
+
"type": "array",
|
|
1909
|
+
"description": "Federated logins linked to this account. System-owned: written only by the auth triggers and the linking doors, never by a PATCH. Linking must happen BEFORE the first federated sign-in, otherwise Cognito mints a separate profile that has to be deleted.",
|
|
1910
|
+
"items": {
|
|
1911
|
+
"type": "object",
|
|
1912
|
+
"properties": {
|
|
1913
|
+
"provider": {
|
|
1914
|
+
"type": "string",
|
|
1915
|
+
"description": "Cognito identity provider name (Google, LinkedIn, or ms-{shortCode})"
|
|
1916
|
+
},
|
|
1917
|
+
"sub": {
|
|
1918
|
+
"type": "string",
|
|
1919
|
+
"description": "The provider's subject identifier. Pairwise per client_id at Entra, so it only matches tokens issued to the same app registration as the IdP."
|
|
1920
|
+
},
|
|
1921
|
+
"linkedAt": {
|
|
1922
|
+
"type": "string"
|
|
1923
|
+
}
|
|
1924
|
+
}
|
|
1925
|
+
}
|
|
1926
|
+
},
|
|
1642
1927
|
"avatarUrl": {
|
|
1643
1928
|
"type": "string",
|
|
1644
1929
|
"description": "CDN URL of the profile picture. Either a per-user upload (users/... key, minted via the upload door) or a shared gallery image (avatars/...). Must point at an existing CDN object - updateUser head-checks it."
|