---
title: "Create Provider"
method: POST
path: "/api/v1/workload_federation/providers"
tags: ["Workload Federation"]
---

# Create Provider

`POST /api/v1/workload_federation/providers`

CreateProvider registers a new external OIDC issuer for the tenant.
 Validates the issuer URL via OIDC discovery synchronously.

## Request body

- C1ApiWorkloadFederationV1WorkloadFederationServiceCreateProviderRequest — The WorkloadFederationServiceCreateProviderRequest message.
  - `description` string — A description of what this provider is for.
  - `displayName` string — The display name for the new provider.
  - `issuerUrl` string — The OIDC issuer URL. Will be validated via OIDC discovery. Normalized on write: lowercase host, no trailing slash, HTTPS only.
  - `wellKnownProvider` 'WELL_KNOWN_WORKLOAD_PROVIDER_UNSPECIFIED' | 'WELL_KNOWN_WORKLOAD_PROVIDER_CUSTOM' | 'WELL_KNOWN_WORKLOAD_PROVIDER_GITHUB_ACTIONS' | 'WELL_KNOWN_WORKLOAD_PROVIDER_GITLAB_CI' | 'WELL_KNOWN_WORKLOAD_PROVIDER_HCP_TERRAFORM' | 'WELL_KNOWN_WORKLOAD_PROVIDER_AWS_IAM_OUTBOUND' — Well-known provider type. Required -- UNSPECIFIED is rejected. When set to a named source, the backend validates issuer_url consistency.

## Response `200`

Successful response

- C1ApiWorkloadFederationV1WorkloadFederationServiceCreateProviderResponse — The WorkloadFederationServiceCreateProviderResponse message.
  - `provider` C1ApiWorkloadFederationV1WorkloadFederationProvider — WorkloadFederationProvider represents a tenant-level OIDC issuer registration.
    - `createdAt` string, date-time
    - `description` string — A description of what this provider is for.
    - `disabled` boolean — Whether the provider is disabled. Disabled providers reject all token exchanges.
    - `displayName` string — The display name of the provider.
    - `id` string — The unique ID of the provider.
    - `issuerUrl` string — The OIDC issuer URL. Immutable after creation.
    - `updatedAt` string, date-time
    - `wellKnownProvider` 'WELL_KNOWN_WORKLOAD_PROVIDER_UNSPECIFIED' | 'WELL_KNOWN_WORKLOAD_PROVIDER_CUSTOM' | 'WELL_KNOWN_WORKLOAD_PROVIDER_GITHUB_ACTIONS' | 'WELL_KNOWN_WORKLOAD_PROVIDER_GITLAB_CI' | 'WELL_KNOWN_WORKLOAD_PROVIDER_HCP_TERRAFORM' | 'WELL_KNOWN_WORKLOAD_PROVIDER_AWS_IAM_OUTBOUND' — Well-known provider type. Drives UX (wizard presets, docs, icons). Set at creation time, immutable.

## Changes

- **2026-03-10** `7fa698b04b81` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/workload_federation/providers/post.md)

---

[API](https://skmtc.dev/conductorone/apis/c1-api.md) · [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/fa2bb307d6fa/schema)