Skip to content
Kindgi

What to give the identity provider, before or after registering

GET
/v1/auth/providers/{providerId}/sign-in
curl --request GET \
  --url 'https://example.com/v1/auth/providers/example/sign-in?kind=oidc' \
  --header 'Authorization: Bearer <token>'

The redirect URI (OIDC) or the ACS URL, entity ID and metadata URL (SAML) a provider under this providerId gets: the same before it’s registered, after, and after an unregister and a new registration. So an admin sets up the identity provider’s side first, then registers with what it gives back. kind is required until the provider is registered. Not mounted when the deployment can’t say.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
providerId
required
string
>= 1 characters

Query Parameters

Section titled “Query Parameters”
kind

oidc: an OpenID Connect identity provider people sign in with (Okta, Entra ID, Google, Keycloak…); its endpoints come from its discovery document. saml: a SAML 2.0 identity provider people sign in with.

string
Allowed values: oidc saml

The provider’s kind; default: the registered provider’s.

Responses

Section titled “Responses”

200

Section titled “200”

What to give the identity provider.

Media typeapplication/json

What to give the identity provider so it can send people back, for a provider under this providerId: the same before it’s registered, after, and after an unregister and a new registration, so the identity provider’s side can be set up first. Not secrets: they’re in every sign-in’s browser redirects.

object
providerId
required
string
>= 1 characters
kind
required

oidc: an OpenID Connect identity provider people sign in with (Okta, Entra ID, Google, Keycloak…); its endpoints come from its discovery document. saml: a SAML 2.0 identity provider people sign in with.

string
Allowed values: oidc saml
signIn
required
One of:
object
redirectUri
required
string format: uri
registered
required

Whether a provider is registered under this providerId now.

boolean
Example
{
  "kind": "oidc"
}

400

Section titled “400”

kind missing for a provider that isn’t registered, or a kind this deployment doesn’t sign in with (bad-input).

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

401

Section titled “401”

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}