---
title: "Create a Custom OIDC provider"
method: POST
path: "/api/v2/wif/oidc/provider"
tags: ["Cloud Authentication"]
---

# Create a Custom OIDC provider

`POST /api/v2/wif/oidc/provider`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/wif/oidc/provider`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `workload_identity_federation_write`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/wif/oidc/provider/post.ts> (a function with typed inputs; its response is checked against the schema)

Register an OIDC issuer, signing-key discovery configuration, and accepted audiences. Provider names and issuer URLs must be unique within the organization.

## Request body

- OIDCCloudAuthProviderCreateRequest: Request to create a Custom OIDC provider.
  - `data` OIDCCloudAuthProviderCreateData, required: Custom OIDC provider creation data.
    - `attributes` OIDCCloudAuthProviderCreateAttributes, required: Attributes for creating a Custom OIDC provider.
      - `audiences` string[], required: Expected token audiences. At least one audience is required. When `org_uuid_source` is `aud`, include datadog/{org_uuid} for the organization creating the provider.
      - `discovery_type` 'oidc_discovery' | 'direct_jwks', required: How the signing keys are discovered.
      - `identity_claim_name` string: Claim used by legacy identity_pattern mappings and in identity logs.
      - `issuer_url` string, required: HTTPS issuer URL that must match the token issuer. For oidc_discovery, signing keys are located through the issuer discovery document.
      - `jwks_url` string: HTTPS JSON Web Key Set URL. Required when `discovery_type` is `direct_jwks`.
      - `org_uuid_claim_name` string: Optional name of the token claim containing the Datadog organization UUID.
      - `org_uuid_source` 'dd_org_uuid' | 'aud': Source of the organization UUID in the signed token. The `aud` source accepts a datadog/{org_uuid} audience.
      - `provider_name` string, required: Name identifying the provider within the organization.
      - `required_claims` OIDCCloudAuthClaimMatcherCreate[]: Claim matchers required for every token from this provider, in addition to the persona mapping matchers. Shared issuers can require an exact tenant claim.
        - `claim` string, required: Name of the token claim.
        - `mode` 'exact' | 'glob': Case-sensitive matching mode. Exact compares strings. Glob matches the entire value: * matches any number of characters, including /, and ? matches one character. Other characters are literal; escaping is not supported.
        - `values` string[], required: Accepted values for this claim. Each value is limited to 500 UTF-8 bytes when creating the resource.
    - `type` 'custom_oidc_provider_config', required: Resource type.

## Response `201`

Created

- OIDCCloudAuthProviderResponse: Custom OIDC provider response.
  - `data` OIDCCloudAuthProviderDataResponse, required: Custom OIDC provider resource.
    - `attributes` OIDCCloudAuthProviderAttributesResponse, required: Stored Custom OIDC provider attributes.
      - `audiences` string[]: Expected token audiences. At least one audience is required. When `org_uuid_source` is `aud`, include datadog/{org_uuid} for the organization creating the provider.
      - `created_at` string, date-time: Time the configuration was created.
      - `created_by` string, uuid: UUID of the user who created the configuration.
      - `discovery_type` 'oidc_discovery' | 'direct_jwks': How the signing keys are discovered.
      - `identity_claim_name` string: Claim used by legacy identity_pattern mappings and in identity logs.
      - `issuer_url` string: HTTPS issuer URL that must match the token issuer. For oidc_discovery, signing keys are located through the issuer discovery document.
      - `jwks_url` string: HTTPS JSON Web Key Set URL. Required when `discovery_type` is `direct_jwks`.
      - `org_uuid_claim_name` string: Optional name of the token claim containing the Datadog organization UUID.
      - `org_uuid_source` 'dd_org_uuid' | 'aud': Source of the organization UUID in the signed token. The `aud` source accepts a datadog/{org_uuid} audience.
      - `provider_name` string: Name identifying the provider within the organization.
      - `required_claims` OIDCCloudAuthClaimMatcher[]: Claim matchers required for every token from this provider, in addition to the persona mapping matchers. Shared issuers can require an exact tenant claim.
        - `claim` string, required: Name of the token claim.
        - `mode` 'exact' | 'glob': Case-sensitive matching mode. Exact compares strings. Glob matches the entire value: * matches any number of characters, including /, and ? matches one character. Other characters are literal; escaping is not supported.
        - `values` string[], required: Accepted values for this claim.
    - `id` string, uuid, required: Unique resource identifier.
    - `type` 'custom_oidc_provider_config', required: Resource type.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `409`: Conflict
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)