# List identity providers configured for the tenant GET /v1/auth/providers ```sh curl --request GET \ --url https://example.com/v1/auth/providers \ --header 'Authorization: Bearer ' ``` Returns the tenant’s identity providers (OIDC, SAML), each with `signIn` when the deployment sets it. Secrets appear only as REFERENCES (`clientSecretRef`, `spSigningKeyRef`…); a plaintext secret is never on the wire. ## Authorizations - **[bearerAuth](https://docs.kindgi.com/v0.1.8/reference/api.md#bearerauth)** ## Responses ### 200 Page of provider configs. application/json object **data** required Array One of: discriminator: kind - **object** An OpenID Connect identity provider people sign in with. The endpoints come from the issuer’s discovery document when absent, and are returned once the deployment has them. object **providerId** required string \>= 1 characters **displayName** The name a sign-in page shows (“Sign in with …”). Default: `providerId`. string \>= 1 characters **domains** The email domains whose people sign in with this provider (lowercase, e.g. `acme.com`): how an email-first sign-in page finds it. Array\ **join** Who may sign in the first time: `invite` (default) only people a tenant admin added; `domain` also anyone from one of `domains`, once the deployment has verified them. string Allowed values: invite domain **signIn** One of: - **object** object **redirectUri** required string format: uri - **object** object **spEntityId** required string \>= 1 characters **acsUrl** required string format: uri **spMetadataUrl** required string format: uri **metadata** object **_key_** additional properties any **kind** required string Allowed value: oidc **issuer** required string format: uri **clientId** required string \>= 1 characters **clientSecretRef** required Opaque reference resolved server-side. Never a plaintext secret. string \>= 1 characters **scopes** Default `openid email profile`. Array\ **authorizationEndpoint** string format: uri **tokenEndpoint** string format: uri **userinfoEndpoint** string format: uri **jwksEndpoint** string format: uri **claimMapping** Per-provider claim mapping. All fields optional; closer to OIDC defaults (sub/email/name) → fewer overrides needed. object **userId** string \>= 1 characters **email** string \>= 1 characters **displayName** string \>= 1 characters **scopes** Claim path + optional delimiter for extracting Kindgi OAuth scopes from provider claims. When absent, scopes come from the token response `scope` field instead. object **claim** required string \>= 1 characters **delimiter** string **metadata** Array\ - **object** A SAML 2.0 identity provider people sign in with: its metadata XML, or its entity ID, single sign-on URL and signing certificates. Keys are given as references, never as keys. object **providerId** required string \>= 1 characters **displayName** The name a sign-in page shows (“Sign in with …”). Default: `providerId`. string \>= 1 characters **domains** The email domains whose people sign in with this provider (lowercase, e.g. `acme.com`): how an email-first sign-in page finds it. Array\ **join** Who may sign in the first time: `invite` (default) only people a tenant admin added; `domain` also anyone from one of `domains`, once the deployment has verified them. string Allowed values: invite domain **signIn** One of: - **object** object **redirectUri** required string format: uri - **object** object **spEntityId** required string \>= 1 characters **acsUrl** required string format: uri **spMetadataUrl** required string format: uri **metadata** object **_key_** additional properties any **kind** required string Allowed value: saml **idpMetadataXml** string \>= 1 characters **idpEntityId** string \>= 1 characters **idpSsoUrl** The IdP’s single sign-on URL (HTTP-Redirect binding). string format: uri **idpCertificates** The IdP’s signing certificates (PEM); several during a rollover. Array\ **spSigningKeyRef** Opaque reference to the service provider’s signing key, for IdPs that require signed AuthnRequests. Never a plaintext key. string \>= 1 characters **spDecryptionKeyRef** Opaque reference to the key that decrypts encrypted assertions. Never a plaintext key. string \>= 1 characters **wantAssertionsSigned** Require signed assertions. Default `true`. boolean **attributeMapping** Assertion attribute names. Defaults: `userId` = the NameID, `email` = `email`. object **userId** string \>= 1 characters **email** string \>= 1 characters **displayName** string \>= 1 characters **hasMore** Always `false`: the list comes whole. Absent from older servers. boolean **changes** Who may add, change and remove the providers here: `tenant`, its admins; `operator`, only the deployment’s own token, because the operator manages sign-in (`KINDGI_AUTH_TENANT_PROVIDERS=off`). The providers there sign people in either way. Absent from older servers: read it as `tenant`. string Allowed values: tenant operator ##### Example ```json { "data": [ { "join": "invite", "kind": "oidc" } ], "changes": "tenant" } ``` ### 401 Missing / malformed / expired / revoked bearer token. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ## See also - [`POST /v1/auth/providers`: Register an identity provider (OIDC or SAML)](https://docs.kindgi.com/v0.1.8/reference/api/operations/authprovidersregister.md) - [`GET /v1/auth/providers/{providerId}`: Get one identity provider](https://docs.kindgi.com/v0.1.8/reference/api/operations/authprovidersget.md) - [`PATCH /v1/auth/providers/{providerId}`: Change an identity provider, keeping its sign-in URLs](https://docs.kindgi.com/v0.1.8/reference/api/operations/authprovidersupdate.md) - [`GET /v1/auth/providers/{providerId}/sign-in`: What to give the identity provider, before or after registering](https://docs.kindgi.com/v0.1.8/reference/api/operations/authproviderssignin.md) - [Every error code](https://docs.kindgi.com/v0.1.8/reference/errors.md)