Skip to content
Kindgi

Get one identity provider

GET
/v1/auth/providers/{providerId}
curl --request GET \
  --url https://example.com/v1/auth/providers/example \
  --header 'Authorization: Bearer <token>'

The provider as stored, with signIn when the deployment sets it. Secrets appear only as references.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
providerId
required
string
>= 1 characters

Responses

Section titled “Responses”

200

Section titled “200”

The provider.

Media typeapplication/json
One of: discriminator: kind

An OpenID Connect identity provider people sign in with. The endpoints come from the issuer’s discovery document when absent, and are returned once the deployment has them.

object
providerId
required
string
>= 1 characters
displayName

The name a sign-in page shows (“Sign in with …”). Default: providerId.

string
>= 1 characters
domains

The email domains whose people sign in with this provider (lowercase, e.g. acme.com): how an email-first sign-in page finds it.

Array<string>
join

Who may sign in the first time: invite (default) only people a tenant admin added; domain also anyone from one of domains, once the deployment has verified them.

string
Allowed values: invite domain
signIn
One of:
object
redirectUri
required
string format: uri
metadata
object
key
additional properties
any
kind
required
string
Allowed value: oidc
issuer
required
string format: uri
clientId
required
string
>= 1 characters
clientSecretRef
required

Opaque reference resolved server-side. Never a plaintext secret.

string
>= 1 characters
scopes

Default openid email profile.

Array<string>
authorizationEndpoint
string format: uri
tokenEndpoint
string format: uri
userinfoEndpoint
string format: uri
jwksEndpoint
string format: uri
claimMapping

Per-provider claim mapping. All fields optional; closer to OIDC defaults (sub/email/name) → fewer overrides needed.

object
userId
string
>= 1 characters
email
string
>= 1 characters
displayName
string
>= 1 characters
scopes

Claim path + optional delimiter for extracting Kindgi OAuth scopes from provider claims. When absent, scopes come from the token response scope field instead.

object
claim
required
string
>= 1 characters
delimiter
string
metadata
Array<string>
Example
{
  "join": "invite",
  "kind": "oidc"
}

401

Section titled “401”

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

404

Section titled “404”

No identity provider registered with that id under this tenant.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}