/auth/api/v1/idp/clients

post https://example.com/auth/api/v1/idp/clients

Creates a new identity provider client configuration. client_id and client_secret are automatically generated by server.

Body Params

string

ID of the identity provider client config

name

string

Name of the identity provider client config

idp_type

string

Defaults to oidc

Identity provider client type, "oidc" or "saml"

oidc_issuer

string

Defaults to Provided by server

The authorization server's issuer identifier. Read-only.

oidc_audience

array of strings

Defaults to testdomain.local

Custom audience(s) for the IdP config. By default, the audience is your client_id. Use this to add more audiences.

oidc_audience

oidc_client_id

string

Defaults to Provided by server

OAuth 2.0 Client Identifier valid at the Authorization Server.

oidc_client_secret

string

Defaults to Provided by server

OAuth 2.0 Client secret valid at the Authorization Server.

oidc_scopes_enabled

array of strings

Defaults to Provided by server

Array containing a list of the enabled OAuth 2.0 [RFC6749] "scope" values. "openid" scope is implicitly enabled.

oidc_scopes_enabled

oidc_response_types_supported

array of strings

Defaults to Provided by server

Array containing a list of the OAuth 2.0 [RFC6749] "response_type" values. Read only.

oidc_response_types_supported

oidc_grant_types_supported

array of strings

Defaults to Provided by server

Array containing a list of the OAuth 2.0 [RFC6749] grant type values. Read only.

oidc_grant_types_supported

oidc_code_challenge_method_enabled

boolean

Defaults to true

Enable PKCE with S256 code_challenge_method

oidc_auth_method_enabled

string

Defaults to client_secret_basic

Selected client authentication method used by the Token Endpoint. Allowed values "none","client_secret_basic","client_secret_post" or "private_key_jwt".

oidc_auth_method_post

boolean

Defaults to true

Enable POST method for client_id/client_secret authentication in addition to HTTP Basic Auth.

oidc_grant_type_refresh_token

boolean

Defaults to true

Enable refresh_token grant use.

oidc_default_logout_redirect_uri

string

Default post logout redirect uri, if end_session is called without redirect uri.

oidc_allowed_redirect_uris

array of strings

Array containing a list of allowed redirect URIs for Code and Implicit flow.

oidc_allowed_redirect_uris

oidc_attribute_mapping

object

An object containing attribute:token mappings for mapping user attributes to idToken attributes. Allowed token attribute values are sub, name, preferred_username, family_name, given_name, locale, email, and phone_number.

oidc_signature_algorithm

string

Defaults to RS256

Token signature algorithm [RFC7518]. Allowed values are RS256,RS384,RS512,ES256,ES384,ES512,PS256,PS384,PS512

oidc_access_token_valid_in_minutes

integer

Defaults to 5

Access token validity in minutes.

oidc_refresh_token_valid_in_minutes

integer

Defaults to 480

Refresh token validity in minutes.

saml_identifier

string

Defaults to Provided by server

The authorization server's entity ID. Global setting, read-only.

saml_sso_service_url

string

Defaults to Provided by server

SAML SSO Service address. Global setting, read-only. TBD

saml_metadata_url

string

Defaults to Provided by server

SAML metadata address. Global setting, read-only. TBD

saml_acs_url

string

SAML Assorted Consumer Service url for authentication response. TBD

saml_attribute_mapping

object

An object containing mappings for SAML attributes.

saml_public_x509_certificate

string

Defaults to Provider by server

SAML public X509 certificate. Read-only.

user_filter

string

User filter. Only users matching this filter are allowed to log in. Leave empty to allow all users.

enabled

boolean

Defaults to true

Enable/disable IDP client config

200

Successful response, identity provider created.

Response body

object

string

ID of the identity provider client config

name

string

Name of the identity provider client config

idp_type

string

Defaults to oidc

Identity provider client type, "oidc" or "saml"

oidc_issuer

string

Defaults to Provided by server

The authorization server's issuer identifier. Read-only.

oidc_audience

array of strings

Defaults to testdomain.local

Custom audience(s) for the IdP config. By default, the audience is your client_id. Use this to add more audiences.

oidc_audience

oidc_client_id

string

Defaults to Provided by server

OAuth 2.0 Client Identifier valid at the Authorization Server.

oidc_client_secret

string

Defaults to Provided by server

OAuth 2.0 Client secret valid at the Authorization Server.

oidc_scopes_enabled

array of strings

Defaults to Provided by server

Array containing a list of the enabled OAuth 2.0 [RFC6749] "scope" values. "openid" scope is implicitly enabled.

oidc_scopes_enabled

oidc_response_types_supported

array of strings

Defaults to Provided by server

Array containing a list of the OAuth 2.0 [RFC6749] "response_type" values. Read only.

oidc_response_types_supported

oidc_grant_types_supported

array of strings

Defaults to Provided by server

Array containing a list of the OAuth 2.0 [RFC6749] grant type values. Read only.

oidc_grant_types_supported

oidc_code_challenge_method_enabled

boolean

Defaults to true

Enable PKCE with S256 code_challenge_method

oidc_auth_method_enabled

string

Defaults to client_secret_basic

Selected client authentication method used by the Token Endpoint. Allowed values "none","client_secret_basic","client_secret_post" or "private_key_jwt".

oidc_auth_method_post

boolean

Defaults to true

Enable POST method for client_id/client_secret authentication in addition to HTTP Basic Auth.

oidc_grant_type_refresh_token

boolean

Defaults to true

Enable refresh_token grant use.

oidc_default_logout_redirect_uri

string

Default post logout redirect uri, if end_session is called without redirect uri.

oidc_allowed_redirect_uris

array of strings

Array containing a list of allowed redirect URIs for Code and Implicit flow.

oidc_allowed_redirect_uris

oidc_attribute_mapping

object

Has additional fields

oidc_signature_algorithm

string

Defaults to RS256

Token signature algorithm [RFC7518]. Allowed values are RS256,RS384,RS512,ES256,ES384,ES512,PS256,PS384,PS512

oidc_access_token_valid_in_minutes

integer

Defaults to 5

Access token validity in minutes.

oidc_refresh_token_valid_in_minutes

integer

Defaults to 480

Refresh token validity in minutes.

saml_identifier

string

Defaults to Provided by server

The authorization server's entity ID. Global setting, read-only.

saml_sso_service_url

string

Defaults to Provided by server

SAML SSO Service address. Global setting, read-only. TBD

saml_metadata_url

string

Defaults to Provided by server

SAML metadata address. Global setting, read-only. TBD

saml_acs_url

string

SAML Assorted Consumer Service url for authentication response. TBD

saml_attribute_mapping

object

An object containing mappings for SAML attributes.

Has additional fields

saml_public_x509_certificate

string

Defaults to Provider by server

SAML public X509 certificate. Read-only.

user_filter

string

User filter. Only users matching this filter are allowed to log in. Leave empty to allow all users.

enabled

boolean

Defaults to true

Enable/disable IDP client config

xxxxxxxxxx
curl --request POST \
     --url https://example.com/auth/api/v1/idp/clients \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '
{
  "idp_type": "oidc",
  "oidc_issuer": "Provided by server",
  "oidc_audience": [
    "testdomain.local"
  ],
  "oidc_client_id": "Provided by server",
  "oidc_client_secret": "Provided by server",
  "oidc_scopes_enabled": "Provided by server",
  "oidc_response_types_supported": "Provided by server",
  "oidc_grant_types_supported": "Provided by server",
  "oidc_code_challenge_method_enabled": true,
  "oidc_auth_method_enabled": "client_secret_basic",
  "oidc_auth_method_post": true,
  "oidc_grant_type_refresh_token": true,
  "oidc_signature_algorithm": "RS256",
  "oidc_access_token_valid_in_minutes": 5,
  "oidc_refresh_token_valid_in_minutes": 480,
  "saml_identifier": "Provided by server",
  "saml_sso_service_url": "Provided by server",
  "saml_metadata_url": "Provided by server",
  "saml_public_x509_certificate": "Provider by server",
  "enabled": true
}

200Successful response, identity provider created.

400Bad request

401Unauthorized request, OAuth2 authorization missing or invalid

403Unauthorized request, OAuth2 authorization OK but scope insufficient

404Resource not found

500Internal server error