Skip to main content

​
What is a Unified API?

A unified API provides a single, standardized interface to interact with multiple third-party providers. Instead of learning each provider’s unique API format, authentication scheme, and data model, you write code once, and StackOne handles the differences. What StackOne normalizes:
  • Data models – Consistent field names and structures across providers (e.g., files in Google Drive, SharePoint, and Dropbox all return the same schema; users in Google Workspace, Okta, and 1Password all return the same schema)
  • Authentication – OAuth, API keys, and tokens are managed per-provider; you just pass an x-account-id header
  • Pagination – Cursor-based pagination works the same regardless of whether the provider uses offsets, pages, or cursors
  • Error formats – Standardized error responses with provider-specific details when available
Building AI agents? Use the MCP Server, an AI Toolset SDK, or the Actions API (RPC) instead — same data, optimized for LLM tool calling.

​
Entity Model

The IAM API is built around six core entities.
IamCredentials is not included in the diagram above. It is a snapshot of the current connection’s auth state, not a stored identity object. It carries a user reference when the credential corresponds to a known principal (such as an OAuth user or named service account).

​
Permission and scope model

IamPermission has a type (the action) and a scopes array. Each scope entry has a resource_type (e.g. file, channel, user) and an optional resource_id. When resource_id is absent, the permission applies to all resources of that type. Roles carry the same scoping via IamRoleScope on the role itself, allowing a role to be valid only within a specific organizational context.

​
Endpoints

​
Permission types

IamPermission.type is one of the values below. The OAS admits the full set; providers expose only the permission types that map to their model.

​
User filters

GET /unified/iam/users accepts the following keys on the filter query object. Filter support varies per connector; passing a filter key the connector does not support returns a 400.

​
Resource types

GET /unified/iam/resource_types returns the resource type identifiers a connected provider supports for resource-scoped queries. The response shape is { data: string[] }; values are connector-defined, not a fixed enum. Use these values as the resource_type query parameter on GET /unified/iam/resource_users. The type field on an embedded IamResource is declared as oneOf: [string, IamResourceTypeEnum] in the OAS. Falcon connectors emit a plain string from the connector-defined set returned by this endpoint (e.g. "file", "channel", "group"). Legacy V2 connectors emit the { value, source_value } envelope where value is from the fixed IamResourceTypeEnum set. Parse both shapes when consuming the field.

​
Listing users by resource

GET /unified/iam/resource_users returns users with access to a specific resource, including their resource-scoped roles. Same response shape as IamUser. Required query parameters:
  • resource_type — one of the values returned by GET /unified/iam/resource_types for the connected provider.
  • resource_id — the raw provider remote_id of the resource. Not a StackOne-encoded id from a list endpoint. Pass the provider’s native id (e.g. a Drive file id, Slack channel id, group remote_id).
Standard pagination, fields, and expand apply as on the other list endpoints.

​
StackOne SDKs & OpenAPI Specification

Use our official SDKs for faster integration. Build with language-native libraries. Full list here.

OpenAPI Specification

Popular SDKs

Node.js Java (JVM) PHP Ruby