Identity Providers

Update an identity provider

Partially updates an identity provider. Only provided fields are modified. Returns 403 Forbidden when the provider is externally_managed.

Required scope: identity-providers:write

patch/clusters/{cluster_id}/realms/{realm_name}/identity-providers/{provider_id}

Request

  • Base URL: http://localhost:8000
  • URL: http://localhost:8000/clusters/{cluster_id}/realms/{realm_name}/identity-providers/{provider_id}
  • Auth: API key in header API-Key

Path parameters

cluster_idstring uuid required
realm_namestring required

Keycloak realm name (not ID). Must start with a letter; allows letters, digits, and hyphens.

Example:customer-portal
provider_idstring required

Keycloak identity provider alias. Used as the stable resource identifier in this API and in Keycloak login flows.

Example:google-workspace

Headers

API-Version'2026-06-01.beta' required

Request body

display_namestring
enabledboolean
client_idstring

Updated client identifier.

client_secretstring password

Updated client secret or LDAP bind password. Write-only; never returned by the API.

Example request

{
  "config": {
    "oidc": {
      "issuer": "https://accounts.google.com",
      "authorization_url": "https://accounts.google.com/o/oauth2/v2/auth",
      "token_url": "https://oauth2.googleapis.com/token",
      "userinfo_url": "https://openidconnect.googleapis.com/v1/userinfo"
    },
    "saml": {
      "entity_id": "https://idp.example.com/entity",
      "sso_url": "https://idp.example.com/sso/saml"
    },
    "ldap": {
      "server_url": "ldaps://ldap.example.com:636",
      "base_dn": "dc=example,dc=com",
      "bind_dn": "cn=skycloak-svc,ou=service-accounts,dc=example,dc=com"
    },
    "button_text": "Continue with Okta",
    "attribute_mappings": {
      "email": "email",
      "firstName": "given_name",
      "lastName": "family_name"
    }
  }
}

Response

The request has succeeded.

provider_idstring required

Keycloak identity provider alias. Used as the stable resource identifier in this API and in Keycloak login flows.

type'oidc' | 'saml' | 'ldap' required

Protocol of the identity provider.

display_namestring required
enabledboolean required
client_idstring

Client identifier used to authenticate with the external provider. Not a secret.

externally_managedboolean required

When true, this provider was created or last modified directly in the Keycloak Admin Console. Skycloak reflects its configuration but PATCH and DELETE will return 403 Forbidden.

created_atstring date-time required
updated_atstring date-time required

Example response

{
  "provider_id": "google-workspace",
  "config": {
    "oidc": {
      "issuer": "https://accounts.google.com",
      "authorization_url": "https://accounts.google.com/o/oauth2/v2/auth",
      "token_url": "https://oauth2.googleapis.com/token",
      "userinfo_url": "https://openidconnect.googleapis.com/v1/userinfo"
    },
    "saml": {
      "entity_id": "https://idp.example.com/entity",
      "sso_url": "https://idp.example.com/sso/saml"
    },
    "ldap": {
      "server_url": "ldaps://ldap.example.com:636",
      "base_dn": "dc=example,dc=com",
      "bind_dn": "cn=skycloak-svc,ou=service-accounts,dc=example,dc=com"
    },
    "button_text": "Continue with Okta",
    "attribute_mappings": {
      "email": "email",
      "firstName": "given_name",
      "lastName": "family_name"
    }
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.