# Get one identity provider GET /v1/auth/providers/{providerId} ```sh curl --request GET \ --url https://example.com/v1/auth/providers/example \ --header 'Authorization: Bearer ' ``` The provider as stored, with `signIn` when the deployment sets it. Secrets appear only as references. ## Authorizations - **[bearerAuth](https://docs.kindgi.com/v0.1.10/reference/api.md#bearerauth)** ## Parameters ### Path Parameters **providerId** required string \>= 1 characters ## Responses ### 200 The provider. application/json One of: discriminator: kind - **object** An OpenID Connect identity provider people sign in with. The endpoints come from the issuer’s discovery document when absent, and are returned once the deployment has them. object **providerId** required string \>= 1 characters **displayName** The name a sign-in page shows (“Sign in with …”). Default: `providerId`. string \>= 1 characters **domains** The email domains whose people sign in with this provider (lowercase, e.g. `acme.com`): how an email-first sign-in page finds it. Array\ **join** Who may sign in the first time: `invite` (default) only people a tenant admin added; `domain` also anyone from one of `domains`, once the deployment has verified them. string Allowed values: invite domain **signIn** One of: - **object** object **redirectUri** required string format: uri - **object** object **spEntityId** required string \>= 1 characters **acsUrl** required string format: uri **spMetadataUrl** required string format: uri **metadata** object **_key_** additional properties any **kind** required string Allowed value: oidc **issuer** required string format: uri **clientId** required string \>= 1 characters **clientSecretRef** required Opaque reference resolved server-side. Never a plaintext secret. string \>= 1 characters **scopes** Default `openid email profile`. Array\ **authorizationEndpoint** string format: uri **tokenEndpoint** string format: uri **userinfoEndpoint** string format: uri **jwksEndpoint** string format: uri **claimMapping** Per-provider claim mapping. All fields optional; closer to OIDC defaults (sub/email/name) → fewer overrides needed. object **userId** string \>= 1 characters **email** string \>= 1 characters **displayName** string \>= 1 characters **scopes** Claim path + optional delimiter for extracting Kindgi OAuth scopes from provider claims. When absent, scopes come from the token response `scope` field instead. object **claim** required string \>= 1 characters **delimiter** string **metadata** Array\ - **object** A SAML 2.0 identity provider people sign in with: its metadata XML, or its entity ID, single sign-on URL and signing certificates. Keys are given as references, never as keys. object **providerId** required string \>= 1 characters **displayName** The name a sign-in page shows (“Sign in with …”). Default: `providerId`. string \>= 1 characters **domains** The email domains whose people sign in with this provider (lowercase, e.g. `acme.com`): how an email-first sign-in page finds it. Array\ **join** Who may sign in the first time: `invite` (default) only people a tenant admin added; `domain` also anyone from one of `domains`, once the deployment has verified them. string Allowed values: invite domain **signIn** One of: - **object** object **redirectUri** required string format: uri - **object** object **spEntityId** required string \>= 1 characters **acsUrl** required string format: uri **spMetadataUrl** required string format: uri **metadata** object **_key_** additional properties any **kind** required string Allowed value: saml **idpMetadataXml** string \>= 1 characters **idpEntityId** string \>= 1 characters **idpSsoUrl** The IdP’s single sign-on URL (HTTP-Redirect binding). string format: uri **idpCertificates** The IdP’s signing certificates (PEM); several during a rollover. Array\ **spSigningKeyRef** Opaque reference to the service provider’s signing key, for IdPs that require signed AuthnRequests. Never a plaintext key. string \>= 1 characters **spDecryptionKeyRef** Opaque reference to the key that decrypts encrypted assertions. Never a plaintext key. string \>= 1 characters **wantAssertionsSigned** Require signed assertions. Default `true`. boolean **attributeMapping** Assertion attribute names. Defaults: `userId` = the NameID, `email` = `email`. object **userId** string \>= 1 characters **email** string \>= 1 characters **displayName** string \>= 1 characters ##### Example ```json { "join": "invite", "kind": "oidc" } ``` ### 401 Missing / malformed / expired / revoked bearer token. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 404 No identity provider registered with that id under this tenant. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ## See also - [`PATCH /v1/auth/providers/{providerId}`: Change an identity provider, keeping its sign-in URLs](https://docs.kindgi.com/v0.1.10/reference/api/operations/authprovidersupdate.md) - [`GET /v1/auth/providers`: List identity providers configured for the tenant](https://docs.kindgi.com/v0.1.10/reference/api/operations/authproviderslist.md) - [`POST /v1/auth/providers`: Register an identity provider (OIDC or SAML)](https://docs.kindgi.com/v0.1.10/reference/api/operations/authprovidersregister.md) - [`GET /v1/auth/providers/{providerId}/sign-in`: What to give the identity provider, before or after registering](https://docs.kindgi.com/v0.1.10/reference/api/operations/authproviderssignin.md) - [Every error code](https://docs.kindgi.com/v0.1.10/reference/errors.md)