Identity Server tables¶

In one sentence

APIM 4.7.0 embeds WSO2 Identity Server (IS) components, mainly for its built-in Resident Key Manager, and the platform's user store and registry. Those components bring many tables that APIM's own flows barely touch. They're listed here, one line each, so that every table is accounted for.

The IS tables that APIM does rely on are explained on the domain pages:

OAuth clients, tokens and service providers: Keys & tokens
OAuth scopes: Scopes
Revocation: Revocation
Users, roles, tenants and organizations: Tenants & users
The main registry tables: Registry
The workflow engine: Workflows

Everything below is peripheral: it's used by IS features such as SSO, SAML, consent or account recovery. Most of it stays empty in a typical APIM deployment. Each entry links to its full column list.

OAuth & OpenID Connect extras¶

IDN_OAUTH1A_REQUEST_TOKEN¶

OAuth 1.0a request tokens (legacy protocol). FK to IDN_OAUTH_CONSUMER_APPS. Columns

IDN_OAUTH1A_ACCESS_TOKEN¶

OAuth 1.0a access tokens (legacy protocol). FK to IDN_OAUTH_CONSUMER_APPS. Columns

IDN_OAUTH2_CIBA_AUTH_CODE¶

Pending requests for the CIBA grant, where the user approves the login on a separate device. Columns

IDN_OAUTH2_CIBA_REQUEST_SCOPES¶

Scopes requested in a CIBA request. Columns

IDN_OAUTH2_DEVICE_FLOW¶

Device-code grant requests (e.g. a smart TV shows a code for the user to enter elsewhere). Columns

IDN_OAUTH2_DEVICE_FLOW_SCOPES¶

Scopes requested in a device-flow request. Columns

IDN_OAUTH2_SCOPE_VALIDATORS¶

Which scope validators (e.g. role-based) are enabled for each OAuth client (APP_ID → IDN_OAUTH_CONSUMER_APPS.ID). Columns

IDN_OAUTH2_TOKEN_BINDING¶

Binds a token to a client property such as a cookie or certificate, so a stolen token can't be reused. Columns

IDN_OAUTH2_USER_CONSENT¶

A user's recorded consent for an OAuth app. Columns

IDN_OAUTH2_USER_CONSENTED_SCOPES¶

The scopes covered by a user's consent. Columns

IDN_OIDC_PROPERTY¶

Extra OpenID Connect settings per OAuth client (CONSUMER_KEY), e.g. ID-token encryption and logout URLs. Columns

IDN_OIDC_JTI¶

Remembers used JWT IDs, to stop replay of signed request objects and client assertions. Columns

IDN_OIDC_REQ_OBJECT_REFERENCE¶

Links an OIDC request object to the authorization code or token it produced. Columns

IDN_OIDC_REQ_OBJECT_CLAIMS¶

Claims asked for in an OIDC request object. Columns

IDN_OIDC_REQ_OBJ_CLAIM_VALUES¶

Requested values for those claims. Columns

IDN_OIDC_SCOPE_CLAIM_MAPPING¶

Which user claims each OIDC scope releases (e.g. email → the email claim). Columns

Sessions & authentication¶

IDN_AUTH_SESSION_STORE¶

Serialized single-sign-on (SSO) login sessions. Columns

IDN_AUTH_TEMP_SESSION_STORE¶

Short-lived authentication context used during a login. Columns

IDN_AUTH_SESSION_APP_INFO¶

Which applications take part in an SSO session. Columns

IDN_AUTH_SESSION_META_DATA¶

Session metadata, such as the user agent and IP address. Columns

IDN_AUTH_USER¶

Users who have SSO sessions (local or federated). Columns

IDN_AUTH_USER_SESSION_MAPPING¶

Maps users to their SSO sessions, e.g. to terminate all of a user's sessions. Columns

IDN_AUTH_WAIT_STATUS¶

Status of long-running (asynchronous) login steps. Columns

IDN_FED_AUTH_SESSION_MAPPING¶

Maps a federated identity provider's session to the local session, for single logout. Columns

IDN_THRIFT_SESSION¶

Sessions for the legacy Thrift-based authentication service. Columns

IDN_STS_STORE¶

Tokens issued by the WS-Trust Security Token Service (legacy SOAP security). Columns

SAML & OpenID 2.0¶

IDN_SAML2_ASSERTION_STORE¶

Stored SAML2 assertions. Columns

IDN_SAML2_ARTIFACT_STORE¶

SAML2 artifacts for artifact-binding SSO. Columns

IDN_OPENID_ASSOCIATIONS¶

OpenID 2.0 association handles (legacy). Columns

IDN_OPENID_REMEMBER_ME¶

OpenID 2.0 "remember me" cookies (legacy). Columns

IDN_OPENID_USER_RPS¶

Relying parties each user has visited with OpenID 2.0 (legacy). Columns

Claims¶

IDN_CLAIM_DIALECT¶

Claim dialects (namespaces), such as local, OIDC and SCIM. Columns

IDN_CLAIM¶

Claims, each in a dialect. FK to IDN_CLAIM_DIALECT. Columns

IDN_CLAIM_MAPPED_ATTRIBUTE¶

Which user-store attribute backs each local claim. Columns

IDN_CLAIM_PROPERTY¶

Properties of local claims, such as display name and whether it's required. Columns

IDN_CLAIM_MAPPING¶

Maps external-dialect claims to local claims. Columns

User account management¶

IDN_IDENTITY_USER_DATA¶

Key/value identity data per user, such as account-lock state and failed-login counts. Columns

IDN_IDENTITY_META_DATA¶

Identity metadata per user, such as confirmation codes. Columns

IDN_RECOVERY_DATA¶

Password-reset and account-recovery codes in progress. Columns

IDN_PASSWORD_HISTORY_DATA¶

Previous password hashes, to stop users reusing a password. Columns

IDN_ASSOCIATED_ID¶

Links a local user to their identity at a federated IdP. Columns

IDN_USER_ACCOUNT_ASSOCIATION¶

Links several local accounts that belong to the same person. Columns

IDN_USER_FUNCTIONALITY_MAPPING¶

Per-user locks on specific functions, such as a locked OTP login. Columns

IDN_USER_FUNCTIONALITY_PROPERTY¶

Properties of those per-user function locks. Columns

IDN_SCIM_GROUP¶

SCIM attributes of groups and roles. Columns

User-managed access (UMA)¶

IDN_UMA_RESOURCE¶

Resources registered for UMA 2.0 (user-managed access). Columns

IDN_UMA_RESOURCE_META_DATA¶

Metadata of UMA resources. Columns

IDN_UMA_RESOURCE_SCOPE¶

Scopes of UMA resources. Columns

IDN_UMA_PERMISSION_TICKET¶

UMA permission tickets. Columns

IDN_UMA_PT_RESOURCE¶

Resources covered by a permission ticket. Columns

IDN_UMA_PT_RESOURCE_SCOPE¶

Scopes covered by a permission ticket. Columns

Configuration, secrets & misc¶

IDN_BASE_TABLE¶

A marker row (PRODUCT_NAME) showing that the identity schema has been created. Columns

IDN_CONFIG_TYPE¶

Types of configuration resources in the IS configuration store. Columns

IDN_CONFIG_RESOURCE¶

Configuration resources, e.g. email-sender settings. FK to IDN_CONFIG_TYPE. Columns

IDN_CONFIG_ATTRIBUTE¶

Key/value attributes of a configuration resource. Columns

IDN_CONFIG_FILE¶

Files attached to a configuration resource. Columns

IDN_SECRET_TYPE¶

Types of stored secrets. Columns

IDN_SECRET¶

Encrypted secrets used by IS features. Columns

IDN_REMOTE_FETCH_CONFIG¶

Settings for pulling IS configuration from a remote repository (e.g. Git). Columns

IDN_REMOTE_FETCH_REVISIONS¶

Deployment history of remotely fetched configuration files. Columns

IDN_FUNCTION_LIBRARY¶

Reusable script functions for adaptive-authentication scripts. Columns

IDN_CERTIFICATE¶

Certificates stored by IS, e.g. for applications. Columns

IDN_CORS_ORIGIN¶

Allowed CORS origins per tenant. Columns

IDN_CORS_ASSOCIATION¶

Which service provider allows which CORS origin. Columns

Service providers (other SP tables)¶

SP_AUTH_STEP¶

Login steps configured for a service provider. FK to SP_APP. Columns

SP_FEDERATED_IDP¶

Federated authenticators used in a login step. FK to SP_AUTH_STEP. Columns

SP_AUTH_SCRIPT¶

Adaptive-authentication script of a service provider. Columns

SP_CLAIM_DIALECT¶

Claim dialects a service provider uses. FK to SP_APP. Columns

SP_CLAIM_MAPPING¶

Claim mappings requested by a service provider. FK to SP_APP. Columns

SP_ROLE_MAPPING¶

Role mappings for a service provider. FK to SP_APP. Columns

SP_REQ_PATH_AUTHENTICATOR¶

Request-path authenticators (e.g. Basic auth in the request) for a service provider. Columns

SP_PROVISIONING_CONNECTOR¶

Outbound provisioning connectors for a service provider. Columns

SP_METADATA¶

Key/value metadata of a service provider. Columns

SP_TEMPLATE¶

Service-provider templates. Columns

SP_SHARED_APP¶

Applications shared from a parent organization with a sub-organization. Columns

Identity providers¶

IDP¶

Identity providers (federated login sources), per tenant. Columns

IDP_AUTHENTICATOR¶

Authenticators (e.g. OIDC or SAML) configured for an IdP. Columns

IDP_AUTHENTICATOR_PROPERTY¶

Settings of an IdP authenticator. Columns

IDP_METADATA¶

Key/value metadata of an IdP. Columns

IDP_CLAIM¶

Claims an IdP sends. Columns

IDP_CLAIM_MAPPING¶

Maps IdP claims to local claims. Columns

IDP_LOCAL_CLAIM¶

Local claims requested from an IdP. Columns

IDP_ROLE¶

Roles an IdP sends. Columns

IDP_ROLE_MAPPING¶

Maps IdP roles to local roles. Columns

IDP_PROVISIONING_CONFIG¶

Outbound provisioning settings of an IdP. Columns

IDP_PROV_CONFIG_PROPERTY¶

Properties of an IdP provisioning connector. Columns

IDP_PROVISIONING_ENTITY¶

Users and groups provisioned to an IdP, with their remote IDs. Columns

CM_PII_CATEGORY¶

Categories of personal data (PII). Columns

CM_PURPOSE¶

Purposes for which personal data is collected. Columns

CM_PURPOSE_CATEGORY¶

Groups of purposes. Columns

CM_PURPOSE_PII_CAT_ASSOC¶

Which PII categories each purpose uses. Columns

CM_RECEIPT¶

Consent receipts: a record that a person gave consent. Columns

CM_CONSENT_RECEIPT_PROPERTY¶

Extra properties of a consent receipt. Columns

CM_RECEIPT_SP_ASSOC¶

The service providers covered by a receipt. Columns

CM_SP_PURPOSE_ASSOC¶

Purposes agreed for a service provider in a receipt. Columns

CM_SP_PURPOSE_PURPOSE_CAT_ASSC¶

Purpose categories of those purposes. Columns

CM_SP_PURPOSE_PII_CAT_ASSOC¶

The PII categories consented to for a purpose. Columns

FIDO¶

FIDO_DEVICE_STORE¶

Registered U2F (FIDO 1) security keys. Columns

FIDO2_DEVICE_STORE¶

Registered FIDO2 / WebAuthn authenticators (passkeys). Columns

User store: other tables¶

UM_DOMAIN¶

User-store domains per tenant, such as PRIMARY and INTERNAL. Columns

UM_SYSTEM_USER¶

Internal system users. Columns

UM_SYSTEM_ROLE¶

Internal system roles. Columns

UM_SYSTEM_USER_ROLE¶

System-user role assignments. Columns

UM_HYBRID_GROUP_ROLE¶

Internal roles assigned to groups. Columns

UM_HYBRID_REMEMBER_ME¶

"Remember me" login cookies. Columns

UM_SHARED_USER_ROLE¶

Cross-tenant shared-role assignments. Columns

UM_PERMISSION¶

Permission resources and actions (e.g. /permission/admin/manage/api/publish). Columns

UM_ROLE_PERMISSION¶

Which permissions each role has. Columns

UM_USER_PERMISSION¶

Permissions granted directly to a user. Columns

UM_MODULE¶

Permission modules. Columns

UM_MODULE_ACTIONS¶

Actions available in a permission module. Columns

UM_USER_ATTRIBUTE¶

User profile attributes (email, first name and so on) in the JDBC user store. Columns

UM_DIALECT¶

Claim dialects in the user store (legacy claim model). Columns

UM_CLAIM¶

Claims in the user store (legacy claim model). Columns

UM_PROFILE_CONFIG¶

User profile configurations. Columns

UM_CLAIM_BEHAVIOR¶

How each claim behaves in each profile. Columns

UM_ACCOUNT_MAPPING¶

Links between user accounts. Columns

UM_UUID_DOMAIN_MAPPER¶

Maps user UUIDs to their user-store domain. Columns

UM_GROUP_UUID_DOMAIN_MAPPER¶

Maps group UUIDs to their user-store domain. Columns

Registry: other tables¶

REG_CONTENT_HISTORY¶

Content of older resource versions. Columns

REG_RESOURCE_HISTORY¶

Older versions of registry resources. Columns

REG_SNAPSHOT¶

Snapshots of a resource's version set. Columns

REG_COMMENT¶

Comments on registry resources (not the Developer Portal comments, which are in AM_API_COMMENTS). Columns

REG_RESOURCE_COMMENT¶

Links comments to resources. Columns

REG_RATING¶

Ratings of registry resources. Columns

REG_RESOURCE_RATING¶

Links ratings to resources. Columns

REG_TAG¶

Tags. APIM stores API tags here. Columns

REG_RESOURCE_TAG¶

Links tags to resources, for example tags to an API artifact. Columns

REG_LOG¶

An audit log of registry changes. Columns

REG_CLUSTER_LOCK¶

A lock used while the registry schema is being initialized. Columns