---
title: "POST /auth-method-create-oidc"
method: POST
path: "/auth-method-create-oidc"
tags: ["Authentication"]
---

# POST /auth-method-create-oidc

`POST /auth-method-create-oidc`

## Request

- Base URL: `https://api.akeyless.io`
- URL: `https://api.akeyless.io/auth-method-create-oidc`
- Auth: none declared

## Request body

- AuthMethodCreateOIDC: authMethodCreateOIDC is a command that creates a new auth method that will be available to authenticate using OIDC.
  - `access-expires` integer: Access expiration date in Unix timestamp (select 0 for access without expiry date)
  - `allowed-client-type` string[]: limit the auth method usage for specific client types [cli,ui,gateway-admin,sdk,mobile,extension]
  - `allowed-redirect-uri` string[]: Allowed redirect URIs after the authentication
  - `audience` string: Audience claim to be used as part of the authentication flow. In case set, it must match the one configured on the Identity Provider's Application
  - `audit-logs-claims` string[]: Subclaims to include in audit logs, e.g "--audit-logs-claims email --audit-logs-claims username"
  - `bound-ips` string[]: A CIDR whitelist with the IPs that the access is restricted to
  - `client-id` string: Client ID
  - `client-secret` string: Client Secret
  - `delete_protection` string: Protection from accidental deletion of this object [true/false]
  - `description` string: Auth Method description
  - `expiration-event-in` string[]: How many days before the expiration of the auth method would you like to be notified.
  - `force-sub-claims` boolean: if true: enforce role-association must include sub claims
  - `gateway-url` string: Akeyless Gateway URL (Configuration Management port). Relevant only when working with Gateway mode
  - `gw-bound-ips` string[]: A CIDR whitelist with the GW IPs that the access is restricted to
  - `issuer` string: Issuer URL
  - `json` boolean: Set output format to JSON
  - `jwt-ttl` integer: Jwt TTL
  - `name` string, required: Auth Method name
  - `product-type` string[]: Choose the relevant product type for the auth method [sm, sra, pm, dp, ca, ara]
  - `required-scopes` string[]: RequiredScopes is a list of required scopes that the oidc method will request from the oidc provider and the user must approve
  - `required-scopes-prefix` string: RequiredScopesPrefix is a a prefix to add to all required-scopes when requesting them from the oidc server (for example, azures' Application ID URI)
  - `scim-bearer-access-id` string: Access ID of the API Key auth method the IdP uses as the SCIM bearer
  - `scim-enabled` string: Enable SCIM provisioning for this auth method [true/false]
  - `scim-endpoint` string: Where the IdP reaches the SCIM endpoint [public/private]. public is served by Akeyless, private by your own Akeyless Gateway
  - `scim-gateway-url` string: URL of the Akeyless Gateway that serves the SCIM endpoint to the IdP, for example https://gateway.example.com:8000. Required for the private endpoint
  - `subclaims-delimiters` string[]: A list of additional sub claims delimiters (relevant only for SAML, OIDC, OAuth2/JWT)
  - `token` string: Authentication token (see `/auth` and `/configure`)
  - `uid-token` string: The universal identity token, Required only for universal_identity authentication
  - `unique-identifier` string, required: A unique identifier (ID) value should be configured for OIDC, OAuth2, LDAP and SAML authentication method types and is usually a value such as the email, username, or upn for example. Whenever a user logs in with a token, these authentication types issue a "sub claim" that contains details uniquely identifying that user. This sub claim includes a key containing the ID value that you configured, and is used to distinguish between different users from within the same organization.

## Response `201`

authMethodCreateOIDCResponse wraps response body.

- AuthMethodCreateOutput
  - `access_id` string
  - `access_key` string
  - `name` string
  - `prv_key` string
  - `scim_base_url` string: SCIM Base URL the IdP calls, set when SCIM flags were given

## Other responses

- `default`: errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.dev/akeyless/apis/identity-access.md) - [All operations](https://skmtc.dev/akeyless/apis/identity-access/llms.txt) - [OpenAPI document](https://skmtc.dev/akeyless/apis/identity-access/revisions/6fbc3858ec88?raw)