---
title: "Create Identity Provider"
method: POST
path: "/v3/portals/{portalId}/identity-providers"
tags: ["Portal Auth Settings"]
---

# Create Identity Provider

`POST /v3/portals/{portalId}/identity-providers`

## Request

- Base URL: `https://global.api.konghq.com`
- URL: `https://global.api.konghq.com/v3/portals/{portalId}/identity-providers`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer
  - HTTP bearer
  - HTTP bearer

Creates a new identity provider. This operation allows the creation of a new identity provider for
authentication purposes.

## Request body

- PortalCreateIdentityProvider: The identity provider that contains configuration data for creating an authentication integration.
  - `enabled` boolean: Indicates whether the identity provider is enabled. Only one identity provider can be active at a time, such as SAML or OIDC.
  - `type` 'oidc' | 'saml': Specifies the type of identity provider.
  - `config` union
    - object: The identity provider that contains configuration data for the OIDC authentication integration.
      - `issuer_url` string, uri, required: The issuer URI of the identity provider. This is the URL where the provider's metadata can be obtained.
      - `client_id` string, required: The client ID assigned to your application by the identity provider.
      - `client_secret` string: The Client Secret assigned to your application by the identity provider.
      - `scopes` string[]: The scopes requested by your application when authenticating with the identity provider.
      - `claim_mappings` OIDCIdentityProviderClaimMappings: Defines the mappings between OpenID Connect (OIDC) claims and local claims used by your application for authentication.
        - `name` string: The claim mapping for the user's name.
        - `email` string: The claim mapping for the user's email address.
        - `groups` string: The claim mapping for the user's group membership information.
    - object: The identity provider that contains configuration data for the SAML authentication integration.
      - `idp_metadata_url` string, uri: The identity provider's metadata URL where the identity provider's metadata can be obtained.
      - `idp_metadata_xml` string: The identity provider's SAML metadata. If the identity provider supports a metadata URL, you can use the `idp_metadata_url` field instead.
      - `sp_metadata_url` string, path
      - `sp_entity_id` string: The entity ID of the service provider (SP).
      - `callback_url` string, path: The path URL where the SAML identity provider sends authentication responses after successful login attempts.

## Response `201`

An identity provider configuration. This response represents the configuration of a specific identity provider, which can be either OIDC or SAML.

- PortalIdentityProvider: The identity provider that contains configuration data for authentication integration.
  - `id` string, uuid: Contains a unique identifier used for this resource.
  - `type` 'oidc' | 'saml': Specifies the type of identity provider.
  - `enabled` boolean: Indicates whether the identity provider is enabled. Only one identity provider can be active at a time, such as SAML or OIDC.
  - `config` union
    - object: The identity provider that contains configuration data for the OIDC authentication integration.
      - `issuer_url` string, uri, required: The issuer URI of the identity provider. This is the URL where the provider's metadata can be obtained.
      - `client_id` string, required: The client ID assigned to your application by the identity provider.
      - `client_secret` string: The Client Secret assigned to your application by the identity provider.
      - `scopes` string[]: The scopes requested by your application when authenticating with the identity provider.
      - `claim_mappings` OIDCIdentityProviderClaimMappings: Defines the mappings between OpenID Connect (OIDC) claims and local claims used by your application for authentication.
        - `name` string: The claim mapping for the user's name.
        - `email` string: The claim mapping for the user's email address.
        - `groups` string: The claim mapping for the user's group membership information.
    - object: The identity provider that contains configuration data for the SAML authentication integration.
      - `idp_metadata_url` string, uri: The identity provider's metadata URL where the identity provider's metadata can be obtained.
      - `idp_metadata_xml` string: The identity provider's SAML metadata. If the identity provider supports a metadata URL, you can use the `idp_metadata_url` field instead.
      - `sp_metadata_url` string, path
      - `sp_entity_id` string: The entity ID of the service provider (SP).
      - `callback_url` string, path: The path URL where the SAML identity provider sends authentication responses after successful login attempts.
  - `created_at` string, date-time: An ISO-8601 timestamp representation of entity creation date.
  - `updated_at` string, date-time: An ISO-8601 timestamp representation of entity update date.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `409`: Conflict

## Changes

- **2026-09-01** `cef0f947e9c9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/kong/apis/konnect-api-beta/changes/v3/portals/:portalId/identity-providers/post.md)

---

[API](https://skmtc.dev/kong/apis/konnect-api-beta.md) - [All operations](https://skmtc.dev/kong/apis/konnect-api-beta/llms.txt) - [OpenAPI document](https://skmtc.dev/kong/apis/konnect-api-beta/revisions/cef0f947e9c9?raw)