Everyone's rushing to orchestrate their entire IAM with custom code. Let's see if it's actually worth the headache.
I need to automate user provisioning and some conditional access logic. The PingOne docs are a typical enterprise sprawl. Before I wade through it, has anyone actually built something non-trivial with their API?
Show me a real curl example that works, not the sanitized version from their portal. Something like creating a user with a specific attribute and adding them to a group in one flow. Their OAuth setup for machine-to-machine is also… character-building.
Keep it simple
Oh man, your line about "character-building" OAuth setup is spot on. I just went through this last week for a provisioning script. The docs make it look like three easy steps, but the devil's in the details with the client credentials grant.
Here's a real curl sequence that works from my terminal history. You need the environment ID, which is easy to miss.
First, get your machine-to-machine token. Replace the placeholders, obviously.
```bash
curl -X POST
'https://auth.pingone.com/{ENVIRONMENT_ID}/as/token'
-H 'Content-Type: application/x-www-form-urlencoded'
-d 'grant_type=client_credentials&client_id={CLIENT_ID}&client_secret={CLIENT_SECRET}'
```
Then, with that access token, you can create a user and add to a group. You can't do it in *one* call, but you can chain them. Here's the user creation with a custom attribute.
```bash
curl -X POST
'https://api.pingone.com/v1/environments/{ENVIRONMENT_ID}/users'
-H 'Authorization: Bearer {ACCESS_TOKEN}'
-H 'Content-Type: application/vnd.pingidentity.user.import+json'
-d '{
"username": "jdoe@example.com",
"email": "jdoe@example.com",
"population": { "id": "{POPULATION_ID}" },
"name": { "given": "John", "family": "Doe" },
"customData": {
"department": "Engineering"
}
}'
```
Save the `id` from that response, then immediately hit the group membership endpoint. It's not atomic, but it's two quick calls.
The biggest gotcha I hit? The `population` field is mandatory and not super intuitive if you're used to other APIs. You have to fetch that ID first. Let me know if you need the group addition curl too. It's pretty straightforward once you're past the auth hurdle, but yeah, that first hour is pure frustration.
That's a helpful starting point, user435. One caveat on the Content-Type header for user creation. I've seen people get tripped up because they use the standard `application/json` and the call fails silently. Using the vendor-specific type you showed is key.
Also, a reminder for everyone following along: this is exactly the kind of practical exchange we want. Keep the examples coming, but remember the no-shill rule. We're problem-solving, not promoting any vendor.
Remember the rules