# What to give the identity provider, before or after registering

GET

/v1/auth/providers/{providerId}/sign-in

```sh
curl --request GET \
  --url 'https://example.com/v1/auth/providers/example/sign-in?kind=oidc' \
  --header 'Authorization: Bearer <token>'
```

The redirect URI (OIDC) or the ACS URL, entity ID and metadata URL (SAML) a provider under this `providerId` gets: the same before it’s registered, after, and after an unregister and a new registration. So an admin sets up the identity provider’s side first, then registers with what it gives back. `kind` is required until the provider is registered. Not mounted when the deployment can’t say.

## Authorizations

- **[bearerAuth](https://docs.kindgi.com/v0.1.10/reference/api.md#bearerauth)**

## Parameters

### Path Parameters

**providerId**

required

string

\>= 1 characters

### Query Parameters

**kind**

`oidc`: an OpenID Connect identity provider people sign in with (Okta, Entra ID, Google, Keycloak…); its endpoints come from its discovery document. `saml`: a SAML 2.0 identity provider people sign in with.

string

Allowed values: oidc saml

The provider’s kind; default: the registered provider’s.

## Responses

### 200

What to give the identity provider.

application/json

What to give the identity provider so it can send people back, for a provider under this `providerId`: the same before it’s registered, after, and after an unregister and a new registration, so the identity provider’s side can be set up first. Not secrets: they’re in every sign-in’s browser redirects.

object

**providerId**

required

string

\>= 1 characters

**kind**

required

`oidc`: an OpenID Connect identity provider people sign in with (Okta, Entra ID, Google, Keycloak…); its endpoints come from its discovery document. `saml`: a SAML 2.0 identity provider people sign in with.

string

Allowed values: oidc saml

**signIn**

required

One of:

- **object**

  object

  **redirectUri**

  required

  string format: uri

- **object**

  object

  **spEntityId**

  required

  string

  \>= 1 characters

  **acsUrl**

  required

  string format: uri

  **spMetadataUrl**

  required

  string format: uri

**registered**

required

Whether a provider is registered under this `providerId` now.

boolean

##### Example

```json
{
  "kind": "oidc"
}
```

### 400

`kind` missing for a provider that isn’t registered, or a kind this deployment doesn’t sign in with (`bad-input`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 401

Missing / malformed / expired / revoked bearer token.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

## See also

- [`GET /v1/auth/providers`: List identity providers configured for the tenant](https://docs.kindgi.com/v0.1.10/reference/api/operations/authproviderslist.md)
- [`POST /v1/auth/providers`: Register an identity provider (OIDC or SAML)](https://docs.kindgi.com/v0.1.10/reference/api/operations/authprovidersregister.md)
- [`GET /v1/auth/providers/{providerId}`: Get one identity provider](https://docs.kindgi.com/v0.1.10/reference/api/operations/authprovidersget.md)
- [`PATCH /v1/auth/providers/{providerId}`: Change an identity provider, keeping its sign-in URLs](https://docs.kindgi.com/v0.1.10/reference/api/operations/authprovidersupdate.md)
- [Error code `bad-input`](https://docs.kindgi.com/v0.1.10/reference/errors.md#bad-input)
- [Every error code](https://docs.kindgi.com/v0.1.10/reference/errors.md)