Permission

Purpose

Users: Read/Write

Required for all user operations — creating, retrieving, listing, and updating users, as well as activating, deactivating, and unlocking user accounts.

Populations: Read

Read population data to list available populations during user creation and assignment.

Groups: Read/Write

List available groups and manage group membership — adding and removing users from groups.

Environments: Read

List accessible environments. Required for the integration to operate within your PingOne tenant.

Password Management

Send password recovery codes to users for self-service account recovery.

Action

Description

Create user

Create a new user in PingOne with email, username, population, name, phone, title, and other attributes.

Get user

Retrieve detailed user information including account status, MFA enrollment, lifecycle state, and last sign-on.

Update user

Update user attributes such as email, username, name, title, phone, and language.

List users

List users in your PingOne environment with optional filtering and pagination.

Deactivate user

Disable a user account to revoke access while preserving the profile.

Activate user

Re-enable a previously deactivated user account to restore access.

Unlock user

Unlock a user account that has been locked due to failed login attempts.

Generate password recovery code

Send a password recovery code to the user's email for self-service password reset.

Add user to group

Add a user to a PingOne group to grant associated permissions and access.

Remove user from group

Remove a user from a PingOne group to revoke associated permissions.

Call API

Make a generic API call to any PingOne endpoint for custom operations.

Error

Cause

Resolution

Connection failure

Auth URL doesn't match your PingOne region. The API URL is derived from the auth URL (for example, https://auth.pingone.eu maps to https://api.pingone.eu).

Verify your Auth URL matches your PingOne region and re-enter the correct URL.

Authentication error

Client credentials are incorrect or the authorization code has expired.

Verify your Client ID and Client Secret, then re-authenticate the integration from Settings > App Store > PingOne.

Token refresh failure

The refresh token has expired or been revoked.

Re-authenticate the integration to generate new tokens.

Invalid API URL

The auth URL or environment ID is malformed, causing the API URL construction to fail.

Verify that both the auth URL and environment ID are correctly entered in the integration settings.

Action failure — permissions

The PingOne OAuth application is missing required permissions for the action being performed.

Check that all required permissions (Users, Groups, Populations, Environments, Password Management) are assigned to the application in the PingOne Admin Console.

Action failure — target not found

The target user or group doesn't exist, or a duplicate username/email was provided.

Verify the user or group exists and is active in your PingOne environment. For creation errors, check for duplicate usernames or emails.

Unlock user failure

The unlock operation uses a specific content type (application/vnd.pingidentity.account.unlock+json) that the PingOne environment may not support.

Confirm your PingOne environment and plan support user unlock operations.