Identity Providers

Domains

Create or update an identity provider

Changed on Sep 29, 2026

Idempotent create-or-update. Uses the key field in the body to identify the identity provider within the domain. On first apply the identity provider is created; subsequent applies update it. The system flag is immutable; changing it requires deleting and recreating the identity provider. When dryRun is true, the endpoint validates the payload without persisting; the returned identity provider carries a dryRunErrors list (empty on success, populated with validation errors otherwise).

put/organizations/{orgId}/environments/{envId}/domains/{domainKey}/identities

Request

Base URL
http://localhost:8093/automation
URL
http://localhost:8093/automation/organizations/{orgId}/environments/{envId}/domains/{domainKey}/identities
Auth
HTTP bearer

Path parameters

orgIdstring required

Identifier of the organization that owns the environment.

envIdstring required

Identifier of the environment the resource belongs to.

domainKeystring required

Key of the domain: its stable, immutable Automation identifier within the environment.

Query parameters

dryRunboolean

When true, validates the payload without persisting. The returned identity provider includes a dryRunErrors field.

Request body

configurationstring

Plugin-specific configuration as a JSON-encoded string. Its shape is defined by the selected identity provider type. Sensitive values, as flagged by the plugin, are returned as ******** in every response; an unset sensitive value is omitted. Sending ******** back on update keeps the stored value; sending it on create is rejected.

createdAtstring date-time

Creation timestamp (ISO-8601 / RFC 3339, UTC). Read-only.

domainWhiteliststring[]

Email domains allowed to authenticate through this identity provider. When set, users whose email domain is not listed are rejected.

groupMapperobject

Group mapper: assigns AM groups based on provider attribute values. Each entry maps a group to the user attribute expressions that grant it.

keystring required

Stable, immutable identifier for the identity provider within its domain. Lowercase alphanumeric and hyphens, starting and ending with an alphanumeric character. Used to identify the identity provider on create-or-update.

mappersobject

Attribute mappers: maps provider claims to AM user profile attributes.

namestring

Human-readable name of the identity provider.

roleMapperobject

Role mapper: assigns AM roles based on provider attribute values. Each entry maps a role to the user attribute expressions that grant it.

systemboolean

Whether this is the domain's system identity provider. Immutable after creation. When true, only key is required; the identity provider is built from the domains.identities.default.* system settings and the name, type, and configuration fields are ignored.

typestring

Identity provider plugin type identifier. Immutable after creation.

updatedAtstring date-time

Last-update timestamp (ISO-8601 / RFC 3339, UTC). Read-only.

Example request

{
  "configuration": "{\"users\":[{\"username\":\"admin\",\"password\":\"...\"}]}",
  "domainWhitelist": [
    "example.com"
  ],
  "key": "corporate-ldap",
  "mappers": {
    "email": "email",
    "sub": "username"
  },
  "name": "Corporate LDAP",
  "type": "inline-am-idp"
}

Response

The created or updated identity provider. When dryRun is true the identity provider includes a dryRunErrors field with any validation errors.