---
title: "POST /providers/wsfed/"
method: POST
path: "/providers/wsfed/"
tags: ["providers"]
---

# POST /providers/wsfed/

`POST /providers/wsfed/`

WSFederationProvider Viewset

## Request body

- WSFederationProviderRequest — WSFederationProvider Serializer
  - `name` string, required
  - `authentication_flow` string, uuid, nullable — Flow used for authentication when the associated application is accessed by an un-authenticated user.
  - `authorization_flow` string, uuid, required — Flow used when authorizing this provider.
  - `invalidation_flow` string, uuid, required — Flow used ending the session from a provider.
  - `property_mappings` string[]
  - `reply_url` string, uri, required
  - `wtrealm` string, required
  - `assertion_valid_not_before` string — Assertion valid not before current time + this value (Format: hours=-1;minutes=-2;seconds=-3).
  - `assertion_valid_not_on_or_after` string — Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
  - `session_valid_not_on_or_after` string — Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
  - `name_id_mapping` string, uuid, nullable — Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be considered
  - `authn_context_class_ref_mapping` string, uuid, nullable — Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
  - `saml_version` '1.1' | '2.0'
  - `digest_algorithm` 'http://www.w3.org/2000/09/xmldsig#sha1' | 'http://www.w3.org/2001/04/xmlenc#sha256' | 'http://www.w3.org/2001/04/xmldsig-more#sha384' | 'http://www.w3.org/2001/04/xmlenc#sha512'
  - `signature_algorithm` 'http://www.w3.org/2000/09/xmldsig#rsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512' | 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
  - `signing_kp` string, uuid, nullable — Keypair used to sign outgoing Responses going to the Service Provider.
  - `encryption_kp` string, uuid, nullable — When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the the private key.
  - `sign_assertion` boolean
  - `sign_logout_request` boolean
  - `default_name_id_policy` 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'

## Response `201`

- WSFederationProvider — WSFederationProvider Serializer
  - `pk` integer, required
  - `name` string, required
  - `authentication_flow` string, uuid, nullable — Flow used for authentication when the associated application is accessed by an un-authenticated user.
  - `authorization_flow` string, uuid, required — Flow used when authorizing this provider.
  - `invalidation_flow` string, uuid, required — Flow used ending the session from a provider.
  - `property_mappings` string[]
  - `component` string, required — Get object component so that we know how to edit the object
  - `assigned_application_slug` string, nullable, required — Internal application name, used in URLs.
  - `assigned_application_name` string, nullable, required — Application's display Name.
  - `assigned_backchannel_application_slug` string, nullable, required — Internal application name, used in URLs.
  - `assigned_backchannel_application_name` string, nullable, required — Application's display Name.
  - `verbose_name` string, required — Return object's verbose_name
  - `verbose_name_plural` string, required — Return object's plural verbose_name
  - `meta_model_name` string, required — Return internal model name
  - `reply_url` string, uri, required
  - `wtrealm` string, required
  - `assertion_valid_not_before` string — Assertion valid not before current time + this value (Format: hours=-1;minutes=-2;seconds=-3).
  - `assertion_valid_not_on_or_after` string — Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
  - `session_valid_not_on_or_after` string — Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
  - `name_id_mapping` string, uuid, nullable — Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be considered
  - `authn_context_class_ref_mapping` string, uuid, nullable — Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
  - `saml_version` '1.1' | '2.0'
  - `digest_algorithm` 'http://www.w3.org/2000/09/xmldsig#sha1' | 'http://www.w3.org/2001/04/xmlenc#sha256' | 'http://www.w3.org/2001/04/xmldsig-more#sha384' | 'http://www.w3.org/2001/04/xmlenc#sha512'
  - `signature_algorithm` 'http://www.w3.org/2000/09/xmldsig#rsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512' | 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
  - `signing_kp` string, uuid, nullable — Keypair used to sign outgoing Responses going to the Service Provider.
  - `encryption_kp` string, uuid, nullable — When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the the private key.
  - `sign_assertion` boolean
  - `sign_logout_request` boolean
  - `default_name_id_policy` 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
  - `url_download_metadata` string, required — Get metadata download URL
  - `url_wsfed` string, required — Get WS-Fed url
  - `url_issuer` string, required — Get Issuer/EntityID URL

## Other responses

- `400`
- `403`

---

[API](https://skmtc.dev/goauthentik/apis/authentik.md) · [All operations](https://skmtc.dev/goauthentik/apis/authentik/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/goauthentik/authentik/revisions/4e42e86021d7/schema)