From 42af47d057849c6aaca6caa859aacc7376c8427b Mon Sep 17 00:00:00 2001
From: NipuniBhagya <nipunib@wso2.com>
Date: Tue, 25 Nov 2025 22:28:39 +0530
Subject: [PATCH] Add Credential Management API resources

---
 .../resources/system-api-resource.xml.j2      | 20 +++++++++++++++++++
 .../resource-access-control-v2.xml.j2         | 16 +++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2 b/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2
index 3241c76f80d0..6a896ce5c464 100644
--- a/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2
+++ b/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2
@@ -2163,4 +2163,24 @@
                    description="Delete workflow instance"/>
         </Scopes>
     </APIResource>
+    <APIResource name="Credential Management API" identifier="/api/server/v1/users/(.*)/credentials"
+                             requiresAuthorization="true"
+                             description="API representation of the Credential Management API" type="TENANT">
+        <Scopes>
+            <Scope displayName="View Credential" name="internal_user_mgt_view"
+                   description="View credentials of users in the organization"/>
+            <Scope displayName="Delete Credential" name="internal_user_mgt_delete"
+                   description="Delete credentials of users in the organization"/>
+        </Scopes>
+    </APIResource>
+    <APIResource name="Credential Management API" identifier="/o/api/server/v1/users/(.*)/credentials"
+                 requiresAuthorization="true"
+                 description="API representation of the Credential Management API" type="ORGANIZATION">
+        <Scopes>
+            <Scope displayName="View Credential" name="internal_org_user_mgt_view"
+                   description="View credentials of users in the organization"/>
+            <Scope displayName="Delete Credential" name="internal_org_user_mgt_delete"
+                   description="Delete credentials of users in the organization"/>
+        </Scopes>
+    </APIResource>
 </APIResources>
diff --git a/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2 b/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2
index 7e5c3e3b1df2..17d8062cae04 100644
--- a/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2
+++ b/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2
@@ -2061,6 +2061,22 @@
               <Scopes>internal_workflow_instance_delete</Scopes>
           </Resource>
 
+          <!-- [Organization] End User Credential Management API -->
+          <Resource context="(.*)/o/api/server/v1/users/(.*)/credentials" secured="true" http-method="GET">
+              <Scopes>internal_org_user_mgt_view</Scopes>
+          </Resource>
+          <Resource context="(.*)/o/api/server/v1/users/(.*)/credentials/(.*)" secured="true" http-method="DELETE">
+              <Scopes>internal_org_user_mgt_delete</Scopes>
+          </Resource>
+
+          <!-- End User Credential Management API -->
+          <Resource context="(.*)/api/server/v1/users/(.*)/credentials" secured="true" http-method="GET">
+              <Scopes>internal_user_mgt_view</Scopes>
+          </Resource>
+          <Resource context="(.*)/api/server/v1/users/(.*)/credentials/(.*)" secured="true" http-method="DELETE">
+              <Scopes>internal_user_mgt_delete</Scopes>
+          </Resource>
+
         <!-- Wild Cards; These scopes are not avaiable in the V2 runtime, therefore any other API will be blocked. -->
         <Resource context="(.*)/api/server/v1/(?!(tenants|channel-verified-tenants))(.*)" secured="true" http-method="all">
             <Scopes>internal_identity_mgt_view</Scopes>