{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/mongodb/main/json-schema/mongodb-connected-org-config-schema.json",
  "title": "ConnectedOrgConfig",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/mongodb-federated-authentication-api-openapi.yml#/components/schemas/ConnectedOrgConfig",
  "properties": {
    "dataAccessIdentityProviderIds": {
      "description": "The collection of unique ids representing the identity providers that can be used for data access in this organization.",
      "items": {
        "description": "Unique 24-hexadecimal digit string that represents the id of the identity providers that can be used for data access in this organization.",
        "type": "string"
      },
      "type": "array",
      "uniqueItems": true
    },
    "domainAllowList": {
      "description": "Approved domains that restrict users who can join the organization based on their email address.",
      "items": {
        "type": "string"
      },
      "type": "array",
      "uniqueItems": true
    },
    "domainRestrictionEnabled": {
      "description": "Value that indicates whether domain restriction is enabled for this connected organization.",
      "type": "boolean"
    },
    "identityProviderId": {
      "description": "Legacy 20-hexadecimal digit string that identifies the UI access identity provider that this connected organization configuration is associated with. This id can be found within the Federation Management Console > Identity Providers tab by clicking the info icon in the IdP ID row of a configured identity provider.",
      "pattern": "^([a-f0-9]{20})$",
      "type": "string"
    },
    "orgId": {
      "description": "Unique 24-hexadecimal digit string that identifies the connected organization configuration.",
      "pattern": "^([a-f0-9]{24})$",
      "readOnly": true,
      "type": "string"
    },
    "postAuthRoleGrants": {
      "description": "Atlas roles that are granted to a user in this organization after authenticating. Roles are a human-readable label that identifies the collection of privileges that MongoDB Cloud grants a specific MongoDB Cloud user. These roles can only be organization specific roles.",
      "items": {
        "enum": [
          "ORG_OWNER",
          "ORG_MEMBER",
          "ORG_GROUP_CREATOR",
          "ORG_BILLING_ADMIN",
          "ORG_BILLING_READ_ONLY",
          "ORG_STREAM_PROCESSING_ADMIN",
          "ORG_READ_ONLY"
        ],
        "type": "string"
      },
      "type": "array",
      "uniqueItems": true
    },
    "roleMappings": {
      "description": "Role mappings that are configured in this organization.",
      "items": {
        "$ref": "#/$defs/AuthFederationRoleMapping"
      },
      "type": "array",
      "uniqueItems": true
    },
    "userConflicts": {
      "description": "List that contains the users who have an email address that doesn't match any domain on the allowed list.",
      "items": {
        "$ref": "#/$defs/FederatedUser"
      },
      "type": "array"
    }
  },
  "required": [
    "domainRestrictionEnabled",
    "orgId"
  ],
  "type": "object",
  "$defs": {
    "AuthFederationRoleMapping": {
      "description": "Mapping settings that link one IdP and MongoDB Cloud.",
      "properties": {
        "externalGroupName": {
          "description": "Unique human-readable label that identifies the identity provider group to which this role mapping applies.",
          "maxLength": 200,
          "minLength": 1,
          "type": "string"
        },
        "id": {
          "description": "Unique 24-hexadecimal digit string that identifies this role mapping.",
          "pattern": "^([a-f0-9]{24})$",
          "readOnly": true,
          "type": "string"
        },
        "roleAssignments": {
          "description": "Atlas roles and the unique identifiers of the groups and organizations associated with each role. The array must include at least one element with an Organization role and its respective `orgId`. Each element in the array can have a value for `orgId` or `groupId`, but not both.",
          "items": {
            "$ref": "#/$defs/ConnectedOrgConfigRoleAssignment"
          },
          "type": "array",
          "uniqueItems": true
        }
      },
      "required": [
        "externalGroupName",
        "roleAssignments"
      ],
      "title": "Federated Authentication Role Mapping",
      "type": "object"
    },
    "ConnectedOrgConfigRoleAssignment": {
      "properties": {
        "groupId": {
          "description": "Unique 24-hexadecimal digit string that identifies the project to which this role belongs. Each element within `roleAssignments` can have a value for `groupId` or `orgId`, but not both.",
          "pattern": "^([a-f0-9]{24})$",
          "type": "string"
        },
        "orgId": {
          "description": "Unique 24-hexadecimal digit string that identifies the organization to which this role belongs. Each element within `roleAssignments` can have a value for `orgId` or `groupId`, but not both.",
          "pattern": "^([a-f0-9]{24})$",
          "type": "string"
        },
        "role": {
          "description": "Human-readable label that identifies the collection of privileges that MongoDB Cloud grants a specific API key, MongoDB Cloud user, or MongoDB Cloud team. These roles include organization- and project-level roles.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "FederatedUser": {
      "description": "MongoDB Cloud user linked to this federated authentication.",
      "properties": {
        "emailAddress": {
          "description": "Email address of the MongoDB Cloud user linked to the federated organization.",
          "format": "email",
          "type": "string"
        },
        "federationSettingsId": {
          "description": "Unique 24-hexadecimal digit string that identifies the federation to which this MongoDB Cloud user belongs.",
          "pattern": "^([a-f0-9]{24})$",
          "type": "string"
        },
        "firstName": {
          "description": "First or given name that belongs to the MongoDB Cloud user.",
          "type": "string"
        },
        "lastName": {
          "description": "Last name, family name, or surname that belongs to the MongoDB Cloud user.",
          "type": "string"
        },
        "userId": {
          "description": "Unique 24-hexadecimal digit string that identifies this user.",
          "pattern": "^([a-f0-9]{24})$",
          "readOnly": true,
          "type": "string"
        }
      },
      "required": [
        "emailAddress",
        "federationSettingsId",
        "firstName",
        "lastName"
      ],
      "title": "Federated User",
      "type": "object"
    }
  }
}