XAxata
Organizations

Register an identity provider for a verified domain

Changed on

Registers an identity provider for one verified domain. google needs only the credentials and pins the login to that Google Workspace domain; microsoft pins it to the Entra tenant in the issuer; oidc is the fallback for any other provider and discovers its endpoints from the issuer's /.well-known/openid-configuration. The domain must already be verified, and registering does not redirect anyone on its own: that is enabled separately.

post/organizations/{organizationID}/sso/providers

Request

  • Base URL
    https://api.xata.tech
  • Auth
    OAuth 2
    Implicit: https://auth.xata.io/realms/xata/protocol/openid-connect/auth
    Scopes: org:write

Request body

type'google' | 'microsoft' | 'oidc' required

Which identity provider this is. google pins the login to a Google Workspace domain and microsoft to a single Entra tenant, taken from the issuer; oidc is the fallback for anything else that speaks OpenID Connect.

domainstring required

The verified email domain this provider will serve.

issuerstring uri

OIDC issuer URL. Required for oidc, and for microsoft where it names the Entra tenant; ignored for google. Must be https, and must serve a /.well-known/openid-configuration document naming itself as the issuer.

client_idstring required

OAuth client ID the organization registered with the provider

client_secretstring required

OAuth client secret. Write-only: it is stored in Keycloak and is never returned by this API.

Response

Identity provider registered

aliasstring required

Stable identifier for this provider, used in its own endpoints.

type'google' | 'microsoft' | 'oidc' required

Which identity provider this is. google pins the login to a Google Workspace domain and microsoft to a single Entra tenant, taken from the issuer; oidc is the fallback for anything else that speaks OpenID Connect.

display_namestring required

Name members see for this provider when signing in.

domainstring required

The verified email domain this provider serves. Empty while the domain is not verified.

enforcedboolean required

Whether members on this domain are sent to this provider automatically, leaving no other way in. Registering a provider does not set this; it is enabled separately.

issuerstring uri

OIDC issuer URL, without the /.well-known suffix.

client_idstring required

OAuth client ID the organization registered with the provider.

Changes