Connecting to Auth0

Using OAuth Authentication

To authenticate to Auth0, you need to create a Machine to Machine application in your Auth0 Dashboard. Navigate to Applications > Create Application and select Machine to Machine Applications. After creating the application, authorize it for the Auth0 Management API and configure the required scopes. The Scope connection property defaults to the full set of read, create, update, and delete scopes needed to support every table in this profile; narrow it to only the scopes your integration needs (for example, read:users and read:clients for read-only access to users and applications) if you want to limit access.

You will also need to specify your Auth0 tenant domain. For example, if your Auth0 dashboard URL is https://your-tenant.auth0.com, then the Domain should be your-tenant.auth0.com.

After setting the following connection properties, you are ready to connect:

AuthScheme: Set this to OAuth.
OAuthClientId: Set this to the Client ID from your Auth0 Machine to Machine application.
OAuthClientSecret: Set this to the Client Secret from your Auth0 Machine to Machine application.
Domain: Set this to your Auth0 tenant domain (e.g., your-tenant.auth0.com).
Scope: Set this to the required OAuth scopes for accessing Auth0 Management API resources.

Example OAuth Connection String

Profile=C:\profiles\Auth0.apip;ProfileSettings="Domain=your-tenant.auth0.com";AuthScheme=OAuth;OAuthClientId=your_client_id;OAuthClientSecret=your_client_secret;Scope="read:users update:users delete:users read:clients create:clients update:clients delete:clients read:connections create:connections update:connections delete:connections read:roles create:roles update:roles delete:roles read:role_members create:role_members delete:role_members read:resource_servers create:resource_servers update:resource_servers delete:resource_servers read:logs read:organizations create:organizations update:organizations delete:organizations read:organization_members create:organization_members delete:organization_members read:organization_connections create:organization_connections update:organization_connections delete:organization_connections read:organization_member_roles create:organization_member_roles delete:organization_member_roles read:organization_invitations create:organization_invitations delete:organization_invitations read:actions create:actions update:actions delete:actions read:client_grants create:client_grants update:client_grants delete:client_grants read:custom_domains create:custom_domains update:custom_domains delete:custom_domains read:rules create:rules update:rules delete:rules read:device_credentials create:device_credentials delete:device_credentials read:email_provider create:email_provider update:email_provider read:email_templates create:email_templates update:email_templates read:grants delete:grants read:guardian_factors update:guardian_factors read:guardian_enrollments delete:guardian_enrollments read:log_streams create:log_streams update:log_streams delete:log_streams read:prompts read:signing_keys read:stats read:tenant_settings read:attack_protection read:branding read:flows read:forms read:event_streams read:network_acls create:network_acls update:network_acls delete:network_acls read:refresh_tokens delete:refresh_tokens read:self_service_profiles read:sessions delete:sessions read:token_exchange_profiles read:user_attribute_profiles";

Available Tables

The Auth0 API Profile provides access to Auth0 Management API resources across 46 tables, covering authentication, identity management, and tenant configuration:

ActionBindings - Query Auth0 action trigger bindings.
ActionTriggers - Query the available Auth0 action triggers.
ActionVersions - Query the version history of Auth0 actions.
Actions - Query, insert, update, and delete Auth0 actions for custom authentication flows.
Applications - Query, insert, update, and delete Auth0 client applications and their configurations.
AttackProtection - Query Auth0 breached password detection settings.
Branding - Query Auth0 tenant branding and customization settings.
BruteForceProtection - Query Auth0 brute force attack protection settings.
ClientGrants - Query, insert, update, and delete Auth0 client application API access grants.
Connections - Query, insert, update, and delete Auth0 identity provider connections.
CustomDomains - Query, insert, update, and delete Auth0 custom domain configurations.
DeviceCredentials - Query, insert, and delete Auth0 device credentials.
EmailTemplates - Query, insert, and update Auth0 email template configurations.
Emails - Query, insert, and update the Auth0 email provider configuration.
EventStreams - Query Auth0 event stream configurations.
Flows - Query Auth0 flow configurations.
Forms - Query Auth0 form definitions.
Grants - Query and delete Auth0 user authorization grants.
Guardian - Query and update Auth0 Guardian MFA factor configurations.
GuardianEnrollments - Query and delete Auth0 Guardian MFA user enrollments.
Jobs - Query the status and results of Auth0 background jobs.
Keys - Query Auth0 tenant signing keys.
LogStreams - Query, insert, update, and delete Auth0 log streaming configurations.
Logs - Query Auth0 tenant activity logs and events.
NetworkAcls - Query, insert, update, and delete Auth0 Network ACL configurations.
OrganizationConnections - Query, insert, update, and delete Auth0 organization-connection relationships.
OrganizationInvitations - Query, insert, and delete Auth0 organization invitations.
OrganizationMemberRoles - Query, insert, and delete Auth0 organization member role assignments.
OrganizationMembers - Query, insert, and delete Auth0 organization member relationships.
Organizations - Query, insert, update, and delete Auth0 organizations for multi-tenant applications.
Prompts - Query Auth0 Universal Login prompt configurations.
RefreshTokens - Query and delete Auth0 refresh tokens.
ResourceServers - Query, insert, update, and delete Auth0 resource servers (APIs) and their configurations.
Roles - Query, insert, update, and delete Auth0 role-based access control roles.
Rules - Query, insert, update, and delete Auth0 rules for custom authentication logic.
SelfServiceProfiles - Query Auth0 self-service profile configurations.
Sessions - Query and delete Auth0 user sessions.
StatsDaily - Query Auth0 daily tenant statistics.
SuspiciousIpThrottling - Query Auth0 suspicious IP throttling settings.
TenantSettings - Query Auth0 tenant configuration and settings.
TokenExchangeProfiles - Query Auth0 token exchange profile configurations.
UserAttributeProfiles - Query Auth0 user attribute profile configurations.
UserPermissions - Query, insert, and delete permissions assigned to Auth0 users.
UserRoles - Query, insert, and delete roles assigned to Auth0 users.
Users - Query, update, and delete Auth0 user accounts and profiles.
UsersByEmail - Query Auth0 users by email address.

Usage Examples

Query all action bindings:

SELECT * FROM ActionBindings WHERE TriggerId = 'post-login'

Query all actions:

SELECT * FROM Actions WHERE IsDeployed = 'true'

Insert a new action:

INSERT INTO Actions (Name, SupportedTriggers) VALUES ('my-action', '[{"id":"post-login","version":"v3"}]')

Update an action:

UPDATE Actions SET Code = 'exports.onExecutePostLogin = async (event, api) => {};', Runtime = 'node18' WHERE Id = 'act_123456'

Delete an action:

DELETE FROM Actions WHERE Id = 'act_123456'

Query all action triggers:

SELECT * FROM ActionTriggers

Query all action versions:

SELECT * FROM ActionVersions WHERE ActionId = 'act_123456'

Query all applications:

SELECT * FROM Applications WHERE IsFirstParty = 'true'

Insert a new application:

INSERT INTO Applications (Name, Description) VALUES ('My Application', 'My example application')

Update an application:

UPDATE Applications SET Description = 'Updated example description' WHERE ClientId = 'client_123456'

Delete an application:

DELETE FROM Applications WHERE ClientId = 'client_123456'

Query attack protection settings:

SELECT * FROM AttackProtection WHERE IsEnabled = 'true'

Query branding settings:

SELECT * FROM Branding

Query brute force protection settings:

SELECT * FROM BruteForceProtection WHERE IsEnabled = 'true'

Query all client grants:

SELECT * FROM ClientGrants WHERE ClientId = 'abc123'

Insert a new client grant:

INSERT INTO ClientGrants (ClientId, Audience, Scopes) VALUES ('client_123456', 'https://api.example.com/', '["read:users"]')

Update a client grant:

UPDATE ClientGrants SET Scopes = '["read:users","read:clients"]' WHERE Id = 'cgr_123456'

Delete a client grant:

DELETE FROM ClientGrants WHERE Id = 'cgr_123456'

Query all connections:

SELECT * FROM Connections WHERE Strategy = 'auth0'

Insert a new connection:

INSERT INTO Connections (Name, Strategy) VALUES ('My-Connection', 'auth0')

Update a connection:

UPDATE Connections SET DisplayName = 'My Updated Connection' WHERE Id = 'con_123456'

Delete a connection:

DELETE FROM Connections WHERE Id = 'con_123456'

Query all custom domains:

SELECT * FROM CustomDomains WHERE CustomDomainId = 'cd_123456'

Insert a new custom domain:

INSERT INTO CustomDomains (Domain, Type) VALUES ('login.example.com', 'auth0_managed_certs')

Update a custom domain:

UPDATE CustomDomains SET TlsPolicy = 'recommended' WHERE CustomDomainId = 'cd_123456'

Delete a custom domain:

DELETE FROM CustomDomains WHERE CustomDomainId = 'cd_123456'

Query all device credentials:

SELECT * FROM DeviceCredentials

Insert a new device credential:

INSERT INTO DeviceCredentials (DeviceName, Type, Value, DeviceId) VALUES ('My Device', 'public_key', 'public_key_value', 'device_123')

Delete a device credential:

DELETE FROM DeviceCredentials WHERE Id = 'dcr_123456'

Query email provider settings:

SELECT * FROM Emails WHERE IsEnabled = 'true'

Insert email provider settings:

INSERT INTO Emails (Name, Credentials, DefaultFromAddress) VALUES ('smtp', '{"smtp_host":"smtp.example.com","smtp_port":587,"smtp_user":"user","smtp_pass":"pass"}', '[email protected]')

Update email provider settings:

UPDATE Emails SET IsEnabled = true WHERE Name = 'smtp'

Query all email templates:

SELECT * FROM EmailTemplates WHERE Template = 'welcome_email'

Insert a new email template:

INSERT INTO EmailTemplates (Template, Body, [From], Subject, Syntax, IsEnabled) VALUES ('welcome_email', 'Welcome', '[email protected]', 'Welcome', 'liquid', true)

Update an email template:

UPDATE EmailTemplates SET Subject = 'Updated Welcome' WHERE Template = 'welcome_email'

Query all event streams:

SELECT * FROM EventStreams WHERE Id = 'evs_123456'

Query all flows:

SELECT * FROM Flows WHERE ShouldSynchronous = 'true'

Query all forms:

SELECT * FROM Forms WHERE Id = 'form_123'

Query all grants:

SELECT * FROM Grants WHERE UserId = 'auth0|123456'

Delete a grant:

DELETE FROM Grants WHERE Id = 'gr_123456'

Query Guardian factors:

SELECT * FROM Guardian WHERE IsEnabled = 'true'

Update a Guardian factor:

UPDATE Guardian SET IsEnabled = true WHERE Name = 'otp'

Query Guardian enrollments:

SELECT * FROM GuardianEnrollments WHERE Id = 'dev_123456'

Delete a Guardian enrollment:

DELETE FROM GuardianEnrollments WHERE Id = 'dev_123456'

Query all jobs:

SELECT * FROM Jobs WHERE Id = 'job_123456'

Query all signing keys:

SELECT * FROM Keys WHERE KeyId = 'key_123456'

Query authentication logs:

SELECT * FROM Logs WHERE Type = 'success_login'

Query all log streams:

SELECT * FROM LogStreams WHERE Id = 'ls_123456'

Insert a new log stream:

INSERT INTO LogStreams (Type, Sink) VALUES ('http', '{"httpEndpoint":"https://example.com/logs","httpContentType":"application/json","httpContentFormat":"JSONLINES"}')

Update a log stream:

UPDATE LogStreams SET Name = 'My Updated Log Stream' WHERE Id = 'ls_123456'

Delete a log stream:

DELETE FROM LogStreams WHERE Id = 'ls_123456'

Query network ACLs:

SELECT * FROM NetworkAcls WHERE Id = 'acl_123456'

Insert a new network ACL:

INSERT INTO NetworkAcls (Description, IsActive, Rule) VALUES ('Block bad actors', true, '{"action":{"block":true},"scope":"management","match":{"ipv4_cidrs":["192.0.2.0/24"]}}')

Update a network ACL:

UPDATE NetworkAcls SET IsActive = false WHERE Id = 'acl_123456'

Delete a network ACL:

DELETE FROM NetworkAcls WHERE Id = 'acl_123456'

Query organization connections:

SELECT * FROM OrganizationConnections WHERE OrganizationId = 'org_123456'

Insert an organization connection:

INSERT INTO OrganizationConnections (OrganizationId, ConnectionId) VALUES ('org_123456', 'con_123456')

Update an organization connection:

UPDATE OrganizationConnections SET IsMembershipOnLoginAssigned = true WHERE OrganizationId = 'org_123456' AND ConnectionId = 'con_123456'

Delete an organization connection:

DELETE FROM OrganizationConnections WHERE OrganizationId = 'org_123456' AND ConnectionId = 'con_123456'

Query organization invitations:

SELECT * FROM OrganizationInvitations WHERE OrganizationId = 'org_123456'

Insert a new organization invitation:

INSERT INTO OrganizationInvitations (OrganizationId, Inviter, Invitee, ClientId) VALUES ('org_123456', '{"name":"Admin User"}', '{"email":"[email protected]"}', 'client_123456')

Delete an organization invitation:

DELETE FROM OrganizationInvitations WHERE OrganizationId = 'org_123456' AND Id = 'inv_123456'

Query organization member roles:

SELECT * FROM OrganizationMemberRoles WHERE OrganizationId = 'org_123456' AND UserId = 'auth0|123456'

Insert an organization member role:

INSERT INTO OrganizationMemberRoles (OrganizationId, UserId, RoleId) VALUES ('org_123456', 'auth0|123456', '["rol_123456"]')

Delete an organization member role:

DELETE FROM OrganizationMemberRoles WHERE OrganizationId = 'org_123456' AND UserId = 'auth0|123456' AND RoleId = '["rol_123456"]'

Query organization members:

SELECT * FROM OrganizationMembers WHERE OrganizationId = 'org_123456'

Insert an organization member:

INSERT INTO OrganizationMembers (OrganizationId, UserId) VALUES ('org_123456', '["auth0|123456"]')

Delete an organization member:

DELETE FROM OrganizationMembers WHERE OrganizationId = 'org_123456' AND UserId = '["auth0|123456"]'

Query all organizations:

SELECT * FROM Organizations WHERE Id = 'org_123456'

Insert a new organization:

INSERT INTO Organizations (Name, DisplayName) VALUES ('my-organization', 'My Organization')

Update an organization:

UPDATE Organizations SET DisplayName = 'My Updated Organization' WHERE Id = 'org_123456'

Delete an organization:

DELETE FROM Organizations WHERE Id = 'org_123456'

Query prompt settings:

SELECT * FROM Prompts

Query refresh tokens:

SELECT * FROM RefreshTokens WHERE IsRotating = 'true'

Delete a refresh token:

DELETE FROM RefreshTokens WHERE Id = 'rt_123456'

Query resource servers:

SELECT * FROM ResourceServers WHERE IsSystem = 'false'

Insert a new resource server:

INSERT INTO ResourceServers (Identifier, Name, Scopes) VALUES ('https://api.example.com', 'My API', '[{"value":"read:test","description":"Read test"}]')

Update a resource server:

UPDATE ResourceServers SET Name = 'My Updated API' WHERE Id = 'rs_123456'

Delete a resource server:

DELETE FROM ResourceServers WHERE Id = 'rs_123456'

Query all roles:

SELECT * FROM Roles WHERE Id = 'rol_123456'

Insert a new role:

INSERT INTO Roles (Name, Description) VALUES ('My Role', 'My example role')

Update a role:

UPDATE Roles SET Description = 'Updated example description' WHERE Id = 'rol_123456'

Delete a role:

DELETE FROM Roles WHERE Id = 'rol_123456'

Query all rules:

SELECT * FROM Rules WHERE IsEnabled = 'true'

Insert a new rule:

INSERT INTO Rules (Name, Script) VALUES ('my-rule', 'function (user, context, callback) { callback(null, user, context); }')

Update a rule:

UPDATE Rules SET IsEnabled = false WHERE Id = 'rul_123456'

Delete a rule:

DELETE FROM Rules WHERE Id = 'rul_123456'

Query self-service profiles:

SELECT * FROM SelfServiceProfiles WHERE Id = 'ssp_123456'

Query user sessions:

SELECT * FROM Sessions WHERE Id = 'sess_123456'

Delete a user session:

DELETE FROM Sessions WHERE Id = 'sess_123456'

Query daily statistics:

SELECT * FROM StatsDaily WHERE Date >= '2024-01-01'

Query suspicious IP throttling:

SELECT * FROM SuspiciousIpThrottling WHERE IsEnabled = 'true'

Query tenant settings:

SELECT * FROM TenantSettings

Query token exchange profiles:

SELECT * FROM TokenExchangeProfiles WHERE Id = 'tep_123456'

Query user attribute profiles:

SELECT * FROM UserAttributeProfiles WHERE Id = 'uap_123456'

Query user permissions:

SELECT * FROM UserPermissions WHERE UserId = 'auth0|123456'

Insert a user permission:

INSERT INTO UserPermissions (UserId, PermissionName, ResourceServerIdentifier) VALUES ('auth0|123456', 'read:reports', 'https://api.example.com/')

Delete a user permission:

DELETE FROM UserPermissions WHERE UserId = 'auth0|123456' AND PermissionName = 'read:reports' AND ResourceServerIdentifier = 'https://api.example.com/'

Query user roles:

SELECT * FROM UserRoles WHERE UserId = 'auth0|123456'

Insert a user role:

INSERT INTO UserRoles (UserId, RoleId) VALUES ('auth0|123456', '["rol_123456"]')

Delete a user role:

DELETE FROM UserRoles WHERE UserId = 'auth0|123456' AND RoleId = '["rol_123456"]'

Query all users:

SELECT * FROM Users WHERE IsBlocked = 'false'

Update a user:

UPDATE Users SET UserMetadata = '{"my_key":"my_value"}' WHERE UserId = 'auth0|123456'

Delete a user:

DELETE FROM Users WHERE UserId = 'auth0|123456'

Query users by email:

SELECT * FROM UsersByEmail WHERE Email = '[email protected]'

Connection Properties

The connection string properties are the various options that can be used to establish a connection. This section provides a complete list of the options you can configure in the connection string for this provider.

Property	Description
AuthScheme	The scheme used for authentication. Accepted entries are OAuth, or None. Allowed values are: BASIC, NONE, NTLM, OAUTH, APIKEY, OAUTH_CLIENT, OAUTH_PASSWORD
CallbackURL	Identifies the URL users return to after authenticating to API via OAuth (Custom OAuth applications only).
Domain	Your Auth0 tenant domain. This should be the domain from your Auth0 Dashboard URL.
InitiateOAuth	Specifies the process for obtaining or refreshing the OAuth access token, which maintains user access while an authenticated, authorized user is working. Allowed values are: OFF, REFRESH, GETANDREFRESH
OAuthAccessToken	Specifies the OAuth access token used to authenticate requests to the data source. This token is issued by the authorization server after a successful OAuth exchange.
OAuthClientId	Specifies the client ID (also known as the consumer key) assigned to your custom OAuth application. This ID is required to identify the application to the OAuth authorization server during authentication.
OAuthClientSecret	Specifies the client secret assigned to your custom OAuth application. This confidential value is used to authenticate the application to the OAuth authorization server. (Custom OAuth applications only.).
OAuthExpiresIn	Specifies the duration in seconds, of an OAuth Access Token's lifetime. The token can be reissued to keep access alive as long as the user keeps working.
OAuthRefreshToken	Specifies the OAuth refresh token used to request a new access token after the original has expired.
OAuthSettingsLocation	Specifies the location of the settings file where OAuth values are saved.
OAuthTokenTimestamp	Displays a Unix epoch timestamp in milliseconds that shows how long ago the current access token was created.
OAuthVerifier	Specifies a verifier code returned from the OAuthAuthorizationURL . Used when authenticating to OAuth on a headless server, where a browser can't be launched. Requires both OAuthSettingsLocation and OAuthVerifier to be set.
Scope	The OAuth scopes requested when authenticating to the Auth0 Management API, which determine which resources and operations (read, create, update, or delete) this connection is authorized to perform.