Authentication

post/admin/oidc/providers

Request

  • Base URL: /api (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/admin/oidc/providers
  • Auth: HTTP bearer

Request body

client_idstring required
client_secretstring required
default_rolestring
enabledboolean
group_claimstring
issuer_urlstring required
jit_provisioningboolean
namestring required
role_claimstring
scopesstring
templatestring
trust_idp_emailboolean

Defaults false. Set to true only for IdPs where an admin controls user provisioning (corporate Okta, Azure AD) and self-signup of arbitrary emails is not possible — see the trust_idp_email field on oidc_providers::Model for the security tradeoff this enables.

Response

OIDC provider created

client_idstring required
client_secretstring required

Always masked — the secret is never returned after creation.

default_rolestring required
enabledboolean required
group_claimstring required
idinteger required
issuer_urlstring required
jit_provisioningboolean required
managed_by_cloudboolean required

ADR-045 §4: true only for the provider Temps Cloud provisions for console access. The admin UI should disable edit/delete controls for such a row — the API itself refuses those requests regardless (OidcError::ManagedByCloudEdit/ManagedByCloudDelete).

namestring required
role_claimstring required
scopesstring required
templatestring required
trust_idp_emailboolean required

When true, the resolver skips the email_verified claim gate during SSO login. Only safe for IdPs where an admin controls user provisioning — see oidc_providers::Model::trust_idp_email.

Changes

No recorded changes to this operation across all 53 revisions of this API.