> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airmdr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Ping Identity

> The Ping Identity integration enables AirMDR to authenticate with the PingID API and perform supported PingID authentication and user-management operations according to the permissions associated with the configured PingID client.

<AccordionGroup>
  <Accordion title="Purpose">
    This guide explains how to obtain **Idp\_url**, **Org\_alias**, **Token**, and **Use\_base64\_key** from the PingID administration console and configure the Ping Identity connection in AirMDR.
  </Accordion>

  <Accordion title="Supported Versions">
    | Component             | Supported configuration              |
    | --------------------- | ------------------------------------ |
    | Ping service          | PingID cloud service                 |
    | Administration        | PingOne/PingID administration portal |
    | API                   | PingID REST API                      |
    | Authentication format | JSON Web Signature (JWS)             |
    | Signing algorithm     | HMAC SHA-256 (`HS256`)               |
    | Transport             | HTTPS                                |
  </Accordion>

  <Accordion title="Authentication">
    PingID uses **signed JWS request tokens** rather than a conventional bearer-token or OAuth authentication flow.

    Each request uses:

    * `org_alias` to identify the PingID organization.
    * `token` to identify the PingID API client.
    * `use_base64_key` to create the cryptographic signature.
    * `idp_url` as the tenant-specific PingID API endpoint.

    PingID uses **HS256** to sign the request. PingID validates the client information and message signature before processing the request.

    **Credential Reference**

    | AirMDR field         | PingID properties field | Purpose                                                                         | Sensitive                        |
    | -------------------- | ----------------------- | ------------------------------------------------------------------------------- | -------------------------------- |
    | **Idp\_url**         | `idp_url`               | Base URL of the PingID service used for API requests.                           | No                               |
    | **Org\_alias**       | `org_alias`             | Unique identifier for the PingID client organization.                           | Treat as sensitive configuration |
    | **Token**            | `token`                 | Unique identifier of the PingID API client.                                     | **Yes**                          |
    | **Use\_base64\_key** | `use_base64_key`        | Secret signing key used to generate the HMAC-SHA256 signature for API requests. | **Yes — Secret**                 |

    <Info>
      Ping Identity specifically identifies `token`, `org_alias`, and `use_base64_key` as values obtained from the PingID properties file. The `idp_url` in the file determines the PingID endpoint associated with the organization's region.
    </Info>

    <Warning>
      Never include the `token` or `use_base64_key` in screenshots, tickets, chat messages, application logs, or public documentation.
    </Warning>
  </Accordion>
</AccordionGroup>

## Pre-requisites

> <Check>
>   An active **PingID/PingOne** organization with administrative access to the **PingID admin portal**.
> </Check>
>
> <Check>
>   Permission to access **Setup → PingID → Client Integration** and to generate or download a PingID properties file.
> </Check>

<Tip>
  Ping Identity states that a PingID administrator requires appropriate administrative rights; the API documentation identifies **Global Administrator** as the administrator role with full account configuration permissions.
</Tip>

## Setup Steps

<Steps>
  <Step title="Sign in to the PingID admin portal">
    1. Sign in to your organization’s **PingOne administration console**.
    2. Select **Setup**.
    3. Select **PingID** or **PingID Configuration**, depending on the console.
    4. From the PingID administration portal, navigate to: **Setup → PingID → Client Integration.**
    5. Open **Client Integration**.
    6. Locate **Integrate with PingFederate** or **Integrate with PingFederate and Other Clients**.
           <Note>
             These navigation labels apply to the documented PingID administration interface. If your tenant displays a different interface, ask your PingID administrator to locate its properties-file management settings.
           </Note>
  </Step>

  <Step title="Generate and Download the Properties File">
    1. In the relevant section, click **Generate** to create a credential set.
    2. Click **Save** to enable downloading.
    3. Locate the new entry and click **Download**.
    4. Save the properties file in an access-controlled location.<br />(or)<br />If an existing credential set is approved for this connection, download its file instead.
           <Tip>
             This section supports up to five active properties files. If the limit is reached, identify an unused credential with its owner before revoking it.
           </Tip>
           <Note>
             The properties file for **Integrate with PingFederate and Other Clients** provides broader permissions, including authentication, enrollment, and device-management operations. Restricted Windows/Mac or SSH properties files might not provide permissions required for management API operations.
           </Note>
  </Step>

  <Step title="Identify the required credentials">
    1. Open the downloaded properties file using a secure text editor.
    2. The file contains entries similar to the following:
       ```text theme={null}
       idp_url=<PINGID_API_URL_FROM_FILE>
       org_alias=<PINGID_ORGANIZATION_ALIAS>
       token=<PINGID_TOKEN>
       use_base64_key=<PINGID_BASE64_SIGNING_KEY>
       ```
    3. Locate the following four properties:

       ```text theme={null}
       idp_url
       org_alias
       token
       use_base64_key
       ```

           <Check>
             These are the values required by the AirMDR Ping Identity connector. Ping Identity's API documentation confirms these values are supplied through the properties file.
           </Check>

           <Warning>
             Copy only the value after the `=` character. Do not include the property name.
           </Warning>

           <Info>
             **Field-specific checks:**

             * **Idp\_url:** Use `idp_url`, including its path. Do not substitute `admin_url` or `authenticator_url`.
             * **Org\_alias:** Use the file’s alias, rather than the organization’s display name.
             * **Token:** Copy the complete value without quotation marks or surrounding spaces.
             * **Use\_base64\_key:** Keep the key in Base64 form when entering it in AirMDR.
           </Info>
  </Step>

  <Step title="Obtain the Idp_url">
    1. Locate: `idp_url=https://<tenant>.pingidentity.com/pingid`.
    2. Copy the complete URL after `idp_url=`.
       For example: https\://\<tenant>.pingidentity.com/pingid
    3. Enter this value in: [AirMDR Integration Credentials page → +New Connection → Idp\_url](https://app.airmdr.com/integrationsv2/d6125842-af5b-44f4-9e96-50ecded3e69d/connections?search=ping+id)
           <Accordion title="What is Idp_url?">
             The `idp_url` identifies the PingID server used for API requests. The value is tenant and region specific. Ping Identity specifically recommends using the value contained in your organization's properties file instead of manually constructing the endpoint.
           </Accordion>
  </Step>

  <Step title="Obtain the Org_alias">
    1. Locate: `org_alias=<ORGANIZATION_ALIAS>`.
    2. Copy the value after `org_alias=`.
       For example: 12345-aaaa-bbbb-1234-87654321abcd
    3. Enter this value in: [AirMDR Integration Credentials page → +New Connection → Org\_alias](https://app.airmdr.com/integrationsv2/d6125842-af5b-44f4-9e96-50ecded3e69d/connections?search=ping+id).
           <Accordion title="What is Org_alias?">
             `org_alias` uniquely identifies the PingID organization associated with the API client and is included in the JWS request header.
           </Accordion>
  </Step>

  <Step title="Obtain the Token">
    1. Locate: `token=<PINGID_CLIENT_TOKEN>`.
    2. Copy the value after `token=`.
       For example: c85c1234567890abcdef1234567894c1
    3. Enter this value in: [AirMDR Integration Credentials page → +New Connection → Token](https://app.airmdr.com/integrationsv2/d6125842-af5b-44f4-9e96-50ecded3e69d/connections?search=ping+id).
           <Warning>
             Treat the token as sensitive authentication configuration and do not expose it in documentation or logs.
           </Warning>
           <Accordion title="What is the Token?">
             The `token` uniquely identifies the calling PingID API client. Multiple clients can exist for the same organization. 
           </Accordion>
  </Step>

  <Step title="Obtain the Use_base64_key">
    1. Locate: `use_base64_key=<BASE64_SIGNING_KEY>`.
    2. Copy the value associated with `use_base64_key`.
       For example: APixxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx7ct4z7LOM=
    3. Enter this value in: [AirMDR Integration Credentials page → +New Connection → Use\_base64\_key](https://app.airmdr.com/integrationsv2/d6125842-af5b-44f4-9e96-50ecded3e69d/connections?search=ping+id).

           <Accordion title="What is Use_base64_key?">
             The `use_base64_key` is the secret used when generating the HMAC-SHA256 signature for PingID API requests. PingID validates the resulting signature before accepting the request.

             <Check>
               Enter the original Base64 key supplied by PingID. AirMDR should perform the signing operation internally; do not manually transform or decode the credential before entering it into the connector unless specifically required by the connector implementation.
             </Check>
           </Accordion>
  </Step>

  <Step title="Save the connector">
    1. Verify the values entered in all required fields.
    2. Ensure that no leading or trailing spaces were copied with the credentials.
    3. Click **Save**.
           <Info>
             AirMDR stores the connector configuration and can use the supplied credentials for supported PingID operations.
           </Info>
  </Step>
</Steps>

## Ping Identity Credential Reference Table

Use the following table when configuring the **Ping Identity** connector in AirMDR.

| AirMDR Field         | What to Enter                                                            | Where to Get It in the PingID UI                                                                                       | Example                                        |
| -------------------- | ------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- |
| **Idp\_url**         | The PingID Identity Provider/API base URL assigned to your organization. | **PingID Admin Portal > Setup > PingID > Client Integration > Download properties file**. Copy the value of `idp_url`. | `https://<tenant-endpoint>/pingid`             |
| **Org\_alias**       | The unique alias that identifies your PingID organization.               | Open the downloaded `pingid.properties` file and copy the value of `org_alias`.                                        | `faxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx779`         |
| **Token**            | The API client token used to identify the PingID client.                 | Open the downloaded `pingid.properties` file and copy the value of `token`.                                            | `c85cxxxxxxxxxxxxxxxxxxxxxxxxx4c1`             |
| **Use\_base64\_key** | The Base64-encoded secret key used to sign PingID API requests.          | Open the downloaded `pingid.properties` file and copy the value of `use_base64_key`.                                   | `APixxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx7ct4z7LOM=` |

<Note>
  All four values should be copied from the **same downloaded PingID properties file**. Do not manually construct or modify these values.
</Note>

**Example properties file**

```text theme={null}
idp_url=https://<tenant-endpoint>/pingid
org_alias=faxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx779
token=c85cxxxxxxxxxxxxxxxxxxxxxxxxx4c1
use_base64_key=APixxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx7ct4z7LOM=
```

<Warning>
  Treat `token` and `use_base64_key` as sensitive credentials. Do not expose them in screenshots, logs, tickets, or public documentation.
</Warning>

## Validate Connectivity

After configuring the Ping Identity connector, validate that AirMDR can reach the **PingID service endpoint**.

<Tip>
  First validate the `/heartbeat` endpoint to confirm network connectivity. Then run a supported PingID API operation to confirm that the configured credentials are valid.
</Tip>

<AccordionGroup>
  <Accordion title="Validate network connectivity">
    1. Copy the hostname from the `idp_url` value in the downloaded `pingid.properties` file.<br />Example: idp\_url=[https://idpxxxxx.pingidentity.com/pingid](https://idpxxxxx.pingidentity.com/pingid)
    2. Append `/heartbeat` to the PingID URL.

    ```text theme={null}
    https://idpxxxxx.pingidentity.com/pingid/heartbeat
    ```

    3. Run the following command from the system where connectivity must be verified:

    ```text theme={null}
    curl -I https://idpxxxxx.pingidentity.com/pingid/heartbeat
    ```

    4. Verify that the endpoint returns an HTTP **200** response.<br />Example: `HTTP/1.1 200 OK`

    <Info>
      Ping Identity documents the `/pingid/heartbeat` endpoint specifically for verifying connectivity to the PingID server. If the request fails, verify that outbound **TCP port 443** is permitted to the PingID hostname.
    </Info>

    <Note>
      Use the hostname from your own `idp_url`. PingID endpoints can differ depending on the organization's region.
    </Note>
  </Accordion>

  <Accordion title="Validate the configured credentials">
    A successful heartbeat confirms **network connectivity only**. It does not validate the `org_alias`, `token`, or `use_base64_key`.

    To fully validate the connector, execute a supported PingID API operation through AirMDR. PingID API requests use:

    * `org_alias` to identify the organization.
    * `token` to identify the API client.
    * `use_base64_key` to sign the request using **HMAC SHA-256 (HS256)**.
    * `idp_url` as the API endpoint.

    PingID rejects requests when the client token or signing information is invalid. 

    For example, a read-only **GetUserDetails** operation can be used when an appropriate PingID username is available: `POST <idp_url>/rest/4/getuserdetails/do`

    A successful PingID operation returns an `errorId` of **200**. 
  </Accordion>

  <Accordion title="Connectivity Validation Reference">
    | Validation                       | Expected Result     | Confirms                                          |
    | -------------------------------- | ------------------- | ------------------------------------------------- |
    | `GET /pingid/heartbeat`          | HTTP `200`          | PingID endpoint is reachable                      |
    | HTTPS connection on port `443`   | Connection succeeds | Network/firewall access                           |
    | Signed PingID API request        | `errorId: 200`      | Credentials and request signing are valid         |
    | Authentication/signature failure | Error response      | Verify `Org_alias`, `Token`, and `Use_base64_key` |

    <br />
  </Accordion>
</AccordionGroup>

## Configure Ping Identity in AirMDR Integrations Dashboard

1. Navigate to [AirMDR](https://app.airmdr.com/auth/login), provide the credentials and click **Login**
2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select **ADMIN → Integrations**.
3. Use the search option, enter the keyword "**PingID**", select the **Connections** tab, and click **+ New Connection** button.
4. Use the following values in the AirMDR integration configuration screen:

   | Field                | Value                                               |
   | -------------------- | --------------------------------------------------- |
   | **Instance**         | Enter a unique name for the PingID connection.      |
   | **Organization**     | Select the appropriate AirMDR organization.         |
   | **Description**      | Enter a short description of the integration.       |
   | **Idp\_url**         | Paste the `idp_url` value from `pingid.properties`. |
   | **Org\_alias**       | Paste the `org_alias` value.                        |
   | **Token**            | Paste the `token` value.                            |
   | **Use\_base64\_key** | Paste the `use_base64_key` value.                   |

   <Accordion title="Expand Advanced Configuration if required. (Optional)">
     1. **In Remote Agent**, select an AirMDR Remote Agent only when the PingID service must be accessed through an approved private network route, proxy, or controlled network environment. For standard publicly accessible PingID SaaS endpoints, leave this field unselected unless instructed otherwise by your AirMDR administrator.
     2. **In Expiry**, select the date on which AirMDR should treat the stored PingID credentials as expired, according to your organization’s credential-rotation policy.

     <Note>
       The **Expiry** date controls credential validity in AirMDR. It does not automatically rotate or revoke the PingID properties file or its associated credentials. Generate a new PingID properties file, update the **Idp\_url**, **Org\_alias**, **Token**, and **Use\_base64\_key** values in AirMDR, validate the connection, and then revoke the previous PingID properties file.
     </Note>
   </Accordion>
5. Click **Save**.

## Skills provided by this Integration

The Ping Identity integration provides **investigation, containment, access-control, and recovery skills** for managing PingID users and their registered MFA devices.

<AccordionGroup>
  <Accordion title="Investigation Skills">
    Use these skills to retrieve information without changing the PingID user or device configuration.

    | Skill                       | Purpose                                                                                                                                                                                                   | Access Type |
    | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
    | **Get PingID User Details** | Retrieves the user's profile, PingID status, MFA bypass state, and paired authentication devices. Use this skill during investigations to understand the user's MFA configuration and registered devices. | Read        |

    <Note>
      PingID's `GetUserDetails` operation is part of the User Management API and returns user status and device details.
    </Note>
  </Accordion>

  <Accordion title="Containment Skills">
    Use these skills when responding to a potentially compromised user account or MFA device.

    | Skill                    | Purpose                                                                                                                                     | Access Type |
    | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
    | **Suspend PingID User**  | Temporarily suspends the user and prevents the user from authenticating through PingID. Use when an account is suspected to be compromised. | Write       |
    | **Unpair PingID Device** | Removes a paired authentication device from the user's PingID account. Use for lost, stolen, compromised, or attacker-controlled devices.   | Write       |

    <Note>
      PingID documents `SuspendUser` for temporarily preventing authentication and `UnpairDevice` as a device-management operation.
    </Note>

    <Warning>
      These skills modify the user's authentication state and can affect the user's ability to access applications protected by PingID.
    </Warning>
  </Accordion>

  <Accordion title="Access-Control Skill">
    | Skill                         | Purpose                                                                                                                                                                                             | Access Type         |
    | :---------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------ |
    | **Toggle PingID User Bypass** | Enables or disables MFA bypass for a PingID user. Disable bypass to restore normal MFA enforcement. Enable bypass only when explicitly required by an approved response or administrative workflow. | Write – High Impact |

    <Note>
      PingID's `ToggleUserBypass` operation changes whether a user is placed into bypass mode and is categorized by PingID as a user-status management operation.
    </Note>

    <Tip>
      Enabling MFA bypass reduces the authentication controls applied to the user. Restrict this action to authorized workflows and validate the intended user before execution.
    </Tip>
  </Accordion>

  <Accordion title="Recovery Skill">
    Use this skill after the security condition that resulted in suspension has been investigated and resolved.

    | Skill                    | Purpose                                                                                                   | Access Type |
    | ------------------------ | --------------------------------------------------------------------------------------------------------- | ----------- |
    | **Activate PingID User** | Reactivates a previously suspended PingID user and restores their ability to authenticate through PingID. | Write       |

    <Note>
      PingID specifies that a user suspended with `SuspendUser` can subsequently be reactivated using `ActivateUser`.
    </Note>
  </Accordion>
</AccordionGroup>

<Tip>
  To view the details of Input Parameters and Output for the respective skills

  * Go to [AirMDR → PingID](https://app.airmdr.com/integrationsv2/d6125842-af5b-44f4-9e96-50ecded3e69d/skills?search=PingID) Integration page.
  * Select the **Skills** tab and click on the required listed skills.
</Tip>

### **Permission Summary**

| Skill                     | Category       | Required Capability    |
| ------------------------- | -------------- | ---------------------- |
| Get PingID User Details   | Investigation  | User management – Read |
| Suspend PingID User       | Containment    | User status management |
| Unpair PingID Device      | Containment    | Device management      |
| Toggle PingID User Bypass | Access Control | User status management |
| Activate PingID User      | Recovery       | User status management |

<Check>
  **Recommended configuration:** Generate the PingID properties file from **Setup → PingID → Client Integration → Integrate with PingFederate** so that the AirMDR connector has the management capabilities required by these skills.
</Check>

## Additional Information

<AccordionGroup>
  <Accordion title="🧰 Error Handling">
    | Issue                                   | Possible cause                                                             | Resolution                                                                          |
    | --------------------------------------- | -------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
    | Authentication fails                    | Incorrect `token`                                                          | Verify the token against the downloaded properties file.                            |
    | Signature validation fails              | Incorrect `use_base64_key` or credentials from different property files    | Re-copy the key and ensure all credentials originate from the same properties file. |
    | Unable to connect to PingID             | Incorrect `idp_url`                                                        | Use the exact `idp_url` contained in the properties file.                           |
    | Connection fails only in some regions   | Wrong regional PingID endpoint                                             | Do not manually copy an endpoint from API examples; use the tenant's `idp_url`.     |
    | Permission denied                       | Properties file does not provide permissions required by the API operation | Verify that the appropriate client-integration properties file was generated.       |
    | Cannot generate another properties file | Active-file limit reached                                                  | Revoke an unused properties file after confirming it is no longer in use.           |
    | Connection times out                    | Firewall/proxy blocking HTTPS                                              | Allow outbound HTTPS access to the hostname specified by `idp_url`.                 |
    | Connector cannot be saved               | Required fields missing                                                    | Verify `Idp_url`, `Org_alias`, `Token`, and `Use_base64_key`.                       |

    PingID explicitly rejects requests when required client/signature values are invalid.

    **Troubleshooting Tip**

    PingID API responses contain a `uniqueMsgId`. Ping Identity documents this identifier as useful for identifying and troubleshooting individual transactions. Record the `uniqueMsgId`, timestamp, API operation, `errorId`, and `errorMsg` when escalating an issue.<br />Do **not** include the signing key or client credentials in a support ticket.
  </Accordion>

  <Accordion title="🔄 Monitoring & Logs">
    **PingID Monitoring**

    PingID provides activity and administrative reporting through the PingOne administration console.

    Navigate to: **Dashboard → Reporting → Reports**

    Administrators can use the **PingID Admin Activity Report** to review administrative activity. PingID reports can include timestamp, administrator, action, resource, status, IP address, and detailed messages.

    PingID activity reporting can also provide information about:

    * User creation, modification, and deletion.
    * Device pairing and unpairing.
    * Authentication activity.
    * Device lifecycle events.
    * SMS, voice, and email-related events where applicable.

    Ping Identity also supports streaming PingID event information to third-party systems such as Splunk through its subscription capabilities. 

    **Recommended AirMDR Log Levels**

    | Level   | Recommended usage                                     |
    | ------- | ----------------------------------------------------- |
    | `INFO`  | Successful connection or API operation                |
    | `WARN`  | Retryable API or connectivity issue                   |
    | `ERROR` | Authentication, permission, signing, or API failure   |
    | `DEBUG` | Temporary troubleshooting only; never log credentials |

    **Illustrative entries:**

    ```text theme={null}
    INFO  PingID request completed operation=GetUserDetails status=200

    WARN  PingID request retry operation=GetUserDetails reason=request_timeout

    ERROR PingID request failed operation=GetUserDetails reason=authentication_failed
    ```

    <Warning>
      Never log `token`, `use_base64_key`, signed JWS values, or the complete properties file.
    </Warning>
  </Accordion>

  <Accordion title="🛑 Security & Access Best Practices">
    **✅ Do**

    * Restrict PingID properties-file access to authorized administrators.
    * Use credentials from the same properties file.
    * Treat `token` and `use_base64_key` as secrets.
    * Use the tenant-specific `idp_url` supplied by PingID.
    * Permit only required outbound HTTPS connectivity.
    * Rotate credentials according to organizational security policy.
    * Update AirMDR with the replacement credentials before revoking the previous properties file.
    * Review PingID activity and administrative reports regularly.
    * Remove downloaded properties files from temporary or unsecured locations after the credentials are configured.

    **❌ Don’t**

    * Do not share the PingID properties file through email, Slack, or support tickets.
    * Do not expose `use_base64_key` in screenshots.
    * Do not store credentials in source-control repositories.
    * Do not copy `idp_url` from generic PingID API examples because the region or tenant can differ.
    * Do not combine `token` and `use_base64_key` values from different properties files.
    * Do not revoke an active properties file before deploying its replacement.
    * Do not enable verbose logging that exposes signed requests or authentication material.
  </Accordion>

  <Accordion title="👉 Support & Maintenance">
    * 📧 Contact [**AirMDR Support**](mailto:support@airmdr.com) through your designated support channel.
    * 🔁 Rotate credentials regularly. Recommended cadence: Every 90 days or as per internal security policy
    * 🔄 **Reconnect in AirMDR immediately when API Keys are changed.**
          <Warning>
            Revoking a properties file immediately invalidates clients relying on that file. Verify that no production connector is still using it before revocation. 
          </Warning>
      **Recommended sequence:**
      1. Navigate to **Setup → PingID → Client Integration**.
      2. Click **Generate**.
      3. Click **Save**.
      4. Download the new properties file.
      5. Extract the new `idp_url`, `org_alias`, `token`, and `use_base64_key` values.
      6. Update the AirMDR connector.
      7. Validate the integration.
      8. Revoke the previous properties file only after confirming the new configuration works.
  </Accordion>

  <Accordion title="🛑 Data Flow & Security">
    **Data Flow**

    The typical request flow is:

    1. AirMDR identifies the PingID tenant using `idp_url`.
    2. AirMDR constructs the PingID API request.
    3. `org_alias` and `token` identify the organization and API client.
    4. The request is signed using `use_base64_key`.
    5. PingID validates the signature.
    6. PingID processes the requested operation.
    7. PingID returns the API response.

    PingID's API uses JWS messages and HMAC-SHA256 signatures.

    **Network Requirements**

    | Requirement            | Value                                    |
    | :--------------------- | :--------------------------------------- |
    | Protocol               | HTTPS                                    |
    | Standard outbound port | TCP 443                                  |
    | Destination            | Host contained in the tenant's `idp_url` |
    | Request method         | Primarily HTTP `POST`                    |
    | Content type           | `application/json`                       |
    | Signing algorithm      | HS256                                    |

    Ping Identity documents regional PingID API domains for North America, Europe, and Australia and recommends using the `idp_url` from the organization's own properties file. 

    **Example PingID API Request**<br />AirMDR handles request construction and signing automatically. At the API level, a PingID call follows this pattern:

    ```text theme={null}
    curl -X POST \
      "${IDP_URL}/rest/4/getuserdetails/do" \
      -H "Content-Type: application/json" \
      --data-binary "${SIGNED_JWS}"
    ```

    A PingID JWS header contains information similar to:

    ```text theme={null}
    {
      "alg": "HS256",
      "org_alias": "<organization-alias>",
      "token": "<client-token>"
    }
    ```

    The JWS is signed using the `use_base64_key`.
  </Accordion>
</AccordionGroup>