---
title: "Create a Custom OIDC persona mapping"
method: POST
path: "/api/v2/wif/oidc/persona_mapping"
tags: ["Cloud Authentication"]
---

# Create a Custom OIDC persona mapping

`POST /api/v2/wif/oidc/persona_mapping`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/wif/oidc/persona_mapping`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `workload_identity_federation_write`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/wif/oidc/persona_mapping/post.ts> (a function with typed inputs; its response is checked against the schema)

Map token claims from a registered Custom OIDC provider to a Datadog user or service account. The caller must be authorized to map to the target account.

## Request body

- OIDCCloudAuthPersonaMappingCreateRequest: Request to create a Custom OIDC persona mapping.
  - `data` OIDCCloudAuthPersonaMappingCreateData, required: Custom OIDC persona mapping creation data.
    - `attributes` OIDCCloudAuthPersonaMappingCreateAttributes, required: Attributes for creating a Custom OIDC persona mapping.
      - `account_uuid` string, required: UUID of the Datadog user or service account to authenticate as.
      - `claim_matchers` OIDCCloudAuthClaimMatcherCreate[]: Every claim condition must match. Supply claim_matchers or identity_pattern, but not both.
        - `claim` string, required: Name of the token claim.
        - `mode` 'exact' | 'glob': Case-sensitive matching mode. Exact compares strings. Glob matches the entire value: * matches any number of characters, including /, and ? matches one character. Other characters are literal; escaping is not supported.
        - `values` string[], required: Accepted values for this claim. Each value is limited to 500 UTF-8 bytes when creating the resource.
      - `identity_pattern` string: Legacy glob pattern, limited to 500 UTF-8 bytes when creating a mapping, matched against the provider identity claim. Supply this or claim_matchers, but not both. Prefer claim_matchers with exact mode for a single Kubernetes service account.
      - `provider_id` string, uuid, required: UUID of the registered Custom OIDC provider.
    - `type` 'custom_oidc_identity_mapping', required: Resource type returned by the existing Custom OIDC persona mapping API.

## Response `201`

Created

- OIDCCloudAuthPersonaMappingResponse: Custom OIDC persona mapping response.
  - `data` OIDCCloudAuthPersonaMappingDataResponse, required: Custom OIDC persona mapping resource.
    - `attributes` OIDCCloudAuthPersonaMappingAttributesResponse, required: Stored Custom OIDC persona mapping attributes.
      - `account_identifier` string: Handle resolved when the mapping was created; not updated if the account handle changes.
      - `account_uuid` string: UUID of the Datadog user or service account to authenticate as.
      - `claim_matchers` OIDCCloudAuthClaimMatcher[]: Every claim condition must match. Supply claim_matchers or identity_pattern, but not both.
        - `claim` string, required: Name of the token claim.
        - `mode` 'exact' | 'glob': Case-sensitive matching mode. Exact compares strings. Glob matches the entire value: * matches any number of characters, including /, and ? matches one character. Other characters are literal; escaping is not supported.
        - `values` string[], required: Accepted values for this claim.
      - `created_at` string, date-time: Time the configuration was created.
      - `created_by` string, uuid: UUID of the user who created the configuration.
      - `identity_pattern` string: Legacy glob pattern matched against the provider identity claim. Supply this or claim_matchers, but not both. Prefer claim_matchers with exact mode for a single Kubernetes service account.
      - `provider_id` string, uuid: UUID of the registered Custom OIDC provider.
    - `id` string, uuid, required: Unique resource identifier.
    - `type` 'custom_oidc_identity_mapping', required: Resource type returned by the existing Custom OIDC persona mapping API.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `409`: Conflict
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)