Directory sync status and probe target (admin-only)
const url = 'https://example.com/api/admin/ldap/status';const options = {method: 'GET', headers: {'X-Ssoossh-Key-Secret': '<X-Ssoossh-Key-Secret>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://example.com/api/admin/ldap/status \ --header 'X-Ssoossh-Key-Secret: <X-Ssoossh-Key-Secret>'Reports whether directory enrichment is enabled, the connection and query the probe is pinned to, the sync settings, and the most recent sync pass on any instance. Names no credential: the bind password is never part of this response. Answers “is the sync even running”, which before the run record could only be answered by reading a log on whichever instance happened to run it.
Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”Directory status
object
ConfiguredAttributes are the attribute names the configured fields read, which is what the console highlights in a returned entry.
DisableAfterSeconds is how long an entry may stay missing before the user is auto-disabled. Zero means never.
Enabled is false when ldap.enabled is off, in which case everything below is unset and there is nothing to probe.
LastRun is the most recent pass on any instance, absent when none has ever run.
object
ActorUsername is the admin who triggered it, absent for a scheduled pass. The username rather than the id, since it is displayed.
Error is why the pass could not run — an unreachable directory, a failed bind. Empty for a pass that completed, whatever it concluded about individual users.
FinishedAt is absent while the pass runs, which is also how a pass that died with its process reads afterwards.
Instance is the host that ran it. Jobs are not leader-elected, so every instance runs its own pass and this says whose log to read.
NSS is what the NSS directory’s full sync concluded when an admin ran this pass by hand with nss.enabled on: POST /api/admin/ldap/sync runs both, except on a dry run. Absent otherwise, and on every scheduled pass, which the NSS sync does not ride on.
object
object
Failed is the entries that could not be checked or written.
Missing is the rows marked missing for the first time; Tombstoned the rows missing for nss.tombstone_after and now deleted.
Refused is the new entries not stored because another row, a tombstone included, holds their number or name.
Seen is the entries the directory returned.
Skipped is the entries rejected because a value did not parse (a name the POSIX rules refuse, a uid that is not a number, a relative home); each is logged with its DN.
Error is why the run stopped short: the directory could not be reached or searched, or another run was in progress on this instance. Nothing is marked missing by a run that stopped short.
FinishedAt is absent when the run stopped on an error.
Full is true for a full run, which is the only kind that marks entries missing; the admin trigger always runs one.
object
Failed is the entries that could not be checked or written.
Missing is the rows marked missing for the first time; Tombstoned the rows missing for nss.tombstone_after and now deleted.
Refused is the new entries not stored because another row, a tombstone included, holds their number or name.
Seen is the entries the directory returned.
Skipped is the entries rejected because a value did not parse (a name the POSIX rules refuse, a uid that is not a number, a relative home); each is logged with its DN.
Trigger is “schedule” or “manual”.
Reenable reports whether the sync clears its own disables when an entry reappears.
Running reports a pass in progress on the instance that answered this request. Passes are not leader-elected, so another instance may be running one too.
SyncIntervalSeconds is zero when the scheduled sync is off, which is itself the answer to “why has nothing synced”.
TLSInsecureSkipVerify reports that directory connections do not verify the server certificate. Reported rather than silently honoured: a probe that succeeds only because verification is off has to say so.
URL, BaseDN and UserFilter are the connection and query the probe is pinned to. The probe cannot be re-pointed, so these are the whole target.
Example generated
{ "base_dn": "example", "configured_attributes": [ "example" ], "disable_after_seconds": 1, "enabled": true, "last_run": { "actor_username": "example", "disabled": 1, "dry_run": true, "error": "example", "failed": 1, "finished_at": "example", "found": 1, "id": "example", "instance": "example", "missing": 1, "nss": { "accounts": { "created": 1, "failed": 1, "missing": 1, "refused": 1, "seen": 1, "skipped": 1, "tombstoned": 1, "updated": 1 }, "error": "example", "finished_at": "example", "full": true, "groups": { "created": 1, "failed": 1, "missing": 1, "refused": 1, "seen": 1, "skipped": 1, "tombstoned": 1, "updated": 1 }, "started_at": "example" }, "reenabled": 1, "started_at": "example", "trigger": "example", "users_seen": 1 }, "reenable": true, "running": true, "sync_interval_seconds": 1, "tls_insecure_skip_verify": true, "url": "example", "user_filter": "example"}Not authenticated
object
Data is always null on an error response.
Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.
ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.
Example
{ "error": "certificate request \"9f1c…\" not found", "error_code": "not_found"}Not authorized as admin
object
Data is always null on an error response.
Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.
ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.
Example
{ "error": "certificate request \"9f1c…\" not found", "error_code": "not_found"}