For the base URL, authentication and errors, see the REST API overview.

GET /v1/identity_providers

• Request: GET /v1/identity_providers
• Operation: ListIdentityProviders
• Operation ID: IdentityProvider_List
• Authentication: access token, Authorization: Bearer YOUR_TOKEN

Example request

curl 'https://YOUR_SERVER/v1/identity_providers' \
  -H 'Authorization: Bearer YOUR_TOKEN'

Responses

Status	Description
200	ok
401	unauthorized
403	forbidden

Response example (200)

[
  {
    "created": 1792263090753,
    "enabled": true,
    "identity_provider": "google",
    "modified": 1792263090753,
    "name": "Google",
    "type": "oidc"
  },
  {
    "created": 1792263090753,
    "enabled": true,
    "identity_provider": "entra",
    "modified": 1792263090753,
    "name": "Microsoft",
    "type": "oidc"
  }
]

POST /v1/identity_providers

• Request: POST /v1/identity_providers
• Operation: CreateIdentityProvider
• Operation ID: IdentityProvider_Create
• Authentication: access token, Authorization: Bearer YOUR_TOKEN

Request body (application/json, required)

OpenID Connect provider for the console login. Disabled by default: set accounts.limits.identity_providers.max_count in the host settings (and restart). Register https://<brand domain>/oauth/callback as redirect URI in the provider, check it with POST /v1/identity_providers/{id}/test, and offer it on a domain with the brand config accounts.federated_login / accounts.identity_providers.

Field	Type	Required	Constraints	Description
attribute_mapping	object	no
attribute_mapping.company	string	no	Default: organization	Claim to use for company - not a standard OIDC claim
attribute_mapping.email	string	no	Default: email
attribute_mapping.location	string	no	Default: locale	Claim to use for location
attribute_mapping.name	string	no	Default: name
attribute_mapping.picture	string	no	Default: picture
attribute_mapping.username	string	no	Default: preferred_username	Claim to use for username
attribute_mapping.website	string	no	Default: website	Claim to use for profile URL
client_id	string	yes		OAuth2 client ID registered with the IdP
client_secret	string	yes		OAuth2 client secret
description	string	no		Optional description
display	object	no
display.button_text	string	no
display.logo	string	no		Logo as base64 data URL
domain	string	yes		Identity provider domain, e.g. your-tenant.us.auth0.com
enabled	boolean	no	Default: true
identity_provider	string	yes	Pattern: ^[a-zA-Z0-9-_]{1,32}$	Unique identifier for the identity provider
name	string	yes		Display name for the identity provider
provisioning	object	no
provisioning.allowed_domains	array of string	no		Allowed email domains. Leave empty to allow all.
provisioning.email_trust_mode	string	no	One of: trust_idp, verify_with_claim, always_verify Default: verify_with_claim	Email verification mode
provisioning.mode	string	no	One of: auto_provision, match_only Default: auto_provision	User provisioning mode
scopes	array of string	no	Default: ["openid","profile","email"]	OAuth2 scopes to request
token_endpoint_auth_method	string	no	One of: client_secret_post, client_secret_basic, none Default: client_secret_post	Token endpoint authentication method
type	string	yes	One of: oidc	Identity provider type - currently only OIDC supported

Example request: Google, existing accounts only

curl -X POST 'https://YOUR_SERVER/v1/identity_providers' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
  "client_id": "<client-id>.apps.googleusercontent.com",
  "client_secret": "<client-secret>",
  "display": {
    "button_text": "Sign in with Google"
  },
  "domain": "accounts.google.com",
  "enabled": true,
  "identity_provider": "google",
  "name": "Google",
  "provisioning": {
    "email_trust_mode": "verify_with_claim",
    "mode": "match_only"
  },
  "type": "oidc"
}'

Example body: Microsoft Entra ID

{
  "client_id": "<application-id>",
  "client_secret": "<client-secret>",
  "display": {
    "button_text": "Sign in with Microsoft"
  },
  "domain": "login.microsoftonline.com/<tenant-id>/v2.0",
  "enabled": true,
  "identity_provider": "entra",
  "name": "Microsoft",
  "provisioning": {
    "allowed_domains": [
      "example.com"
    ],
    "email_trust_mode": "trust_idp",
    "mode": "auto_provision"
  },
  "scopes": [
    "openid",
    "profile",
    "email"
  ],
  "type": "oidc"
}

Responses

Status	Description
200	ok
401	unauthorized
403	forbidden

GET /v1/identity_providers/{identity_provider}

• Request: GET /v1/identity_providers/
• Operation: ReadIdentityProviderConfig
• Operation ID: IdentityProvider_ReadConfig
• Authentication: access token, Authorization: Bearer YOUR_TOKEN

Parameters

Name	In	Type	Required	Description
identity_provider	path	string	yes

Example request

curl 'https://YOUR_SERVER/v1/identity_providers/YOUR_IDENTITY_PROVIDER' \
  -H 'Authorization: Bearer YOUR_TOKEN'

Responses

Status	Description
200	ok
401	unauthorized
403	forbidden

Response example (200, Google, existing accounts only)

{
  "client_id": "<client-id>.apps.googleusercontent.com",
  "client_secret": "<client-secret>",
  "created": 1792263090753,
  "display": {
    "button_text": "Sign in with Google"
  },
  "domain": "accounts.google.com",
  "enabled": true,
  "identity_provider": "google",
  "modified": 1792263090753,
  "name": "Google",
  "provisioning": {
    "email_trust_mode": "verify_with_claim",
    "mode": "match_only"
  },
  "type": "oidc"
}

Response example (200, Microsoft Entra ID)

{
  "client_id": "<application-id>",
  "client_secret": "<client-secret>",
  "created": 1792263090753,
  "display": {
    "button_text": "Sign in with Microsoft"
  },
  "domain": "login.microsoftonline.com/<tenant-id>/v2.0",
  "enabled": true,
  "identity_provider": "entra",
  "modified": 1792263090753,
  "name": "Microsoft",
  "provisioning": {
    "allowed_domains": [
      "example.com"
    ],
    "email_trust_mode": "trust_idp",
    "mode": "auto_provision"
  },
  "scopes": [
    "openid",
    "profile",
    "email"
  ],
  "type": "oidc"
}

PUT /v1/identity_providers/{identity_provider}

• Request: PUT /v1/identity_providers/
• Operation: UpdateIdentityProvider
• Operation ID: IdentityProvider_Update
• Authentication: access token, Authorization: Bearer YOUR_TOKEN

Parameters

Name	In	Type	Required	Description
identity_provider	path	string	yes

Request body (application/json, required)

Field	Type	Required	Constraints	Description
attribute_mapping	object	no
attribute_mapping.company	string	no
attribute_mapping.email	string	no
attribute_mapping.location	string	no
attribute_mapping.name	string	no
attribute_mapping.picture	string	no
attribute_mapping.username	string	no
attribute_mapping.website	string	no
client_id	string	no
client_secret	string	no
description	string	no
display	object	no
display.button_text	string	no
display.logo	string	no
domain	string	no
enabled	boolean	no
name	string	no
provisioning	object	no
provisioning.allowed_domains	array of string	no
provisioning.email_trust_mode	string	no	One of: trust_idp, verify_with_claim, always_verify
provisioning.mode	string	no	One of: auto_provision, match_only
scopes	array of string	no
token_endpoint_auth_method	string	no	One of: client_secret_post, client_secret_basic, none

Example request: Full Update

curl -X PUT 'https://YOUR_SERVER/v1/identity_providers/YOUR_IDENTITY_PROVIDER' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
  "client_id": "<client-id>.apps.googleusercontent.com",
  "client_secret": "<client-secret>",
  "display": {
    "button_text": "Sign in with Google"
  },
  "domain": "accounts.google.com",
  "enabled": true,
  "identity_provider": "google",
  "name": "Google",
  "provisioning": {
    "email_trust_mode": "verify_with_claim",
    "mode": "match_only"
  },
  "type": "oidc"
}'

Example body: Update 'client_id'

{
  "client_id": "<client-id>.apps.googleusercontent.com"
}

Example body: Update 'client_secret'

{
  "client_secret": "<client-secret>"
}

Example body: Update 'display'

{
  "display": {
    "button_text": "Sign in with Google"
  }
}

Example body: Update 'domain'

{
  "domain": "accounts.google.com"
}

Example body: Update 'enabled'

{
  "enabled": true
}

Example body: Update 'name'

{
  "name": "Google"
}

Example body: Update 'provisioning'

{
  "provisioning": {
    "email_trust_mode": "verify_with_claim",
    "mode": "match_only"
  }
}

Example body: Update 'type'

{
  "type": "oidc"
}

Responses

Status	Description
200	ok
401	unauthorized
403	forbidden

DELETE /v1/identity_providers/{identity_provider}

• Request: DELETE /v1/identity_providers/
• Operation: DeleteIdentityProvider
• Operation ID: IdentityProvider_Delete
• Authentication: access token, Authorization: Bearer YOUR_TOKEN

Parameters

Name	In	Type	Required	Description
identity_provider	path	string	yes

Example request

curl -X DELETE 'https://YOUR_SERVER/v1/identity_providers/YOUR_IDENTITY_PROVIDER' \
  -H 'Authorization: Bearer YOUR_TOKEN'

Responses

Status	Description
200	ok
401	unauthorized
403	forbidden