Skip to content
Kindgi

List identity providers configured for the tenant

View as Markdown
GET
/v1/auth/providers
curl --request GET \
  --url https://example.com/v1/auth/providers \
  --header 'Authorization: Bearer <token>'

Returns the tenant’s identity providers (OIDC, SAML), each with signIn when the deployment sets it. Secrets appear only as REFERENCES (clientSecretRef, spSigningKeyRef…); a plaintext secret is never on the wire.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

Page of provider configs.

Media typeapplication/json
object
data
required
Array
One of: discriminator: kind

An OpenID Connect identity provider people sign in with. The endpoints come from the issuer’s discovery document when absent, and are returned once the deployment has them.

object
providerId
required
string
>= 1 characters
displayName

The name a sign-in page shows (“Sign in with …”). Default: providerId.

string
>= 1 characters
domains

The email domains whose people sign in with this provider (lowercase, e.g. acme.com): how an email-first sign-in page finds it.

Array<string>
join

Who may sign in the first time: invite (default) only people a tenant admin added; domain also anyone from one of domains, once the deployment has verified them.

string
Allowed values: invite domain
signIn
One of:
object
redirectUri
required
string format: uri
metadata
object
key
additional properties
any
kind
required
string
Allowed value: oidc
issuer
required
string format: uri
clientId
required
string
>= 1 characters
clientSecretRef
required

Opaque reference resolved server-side. Never a plaintext secret.

string
>= 1 characters
scopes

Default openid email profile.

Array<string>
authorizationEndpoint
string format: uri
tokenEndpoint
string format: uri
userinfoEndpoint
string format: uri
jwksEndpoint
string format: uri
claimMapping

Per-provider claim mapping. All fields optional; closer to OIDC defaults (sub/email/name) → fewer overrides needed.

object
userId
string
>= 1 characters
email
string
>= 1 characters
displayName
string
>= 1 characters
scopes

Claim path + optional delimiter for extracting Kindgi OAuth scopes from provider claims. When absent, scopes come from the token response scope field instead.

object
claim
required
string
>= 1 characters
delimiter
string
metadata
Array<string>
hasMore

Always false: the list comes whole. Absent from older servers.

boolean
changes

Who may add, change and remove the providers here: tenant, its admins; operator, only the deployment’s own token, because the operator manages sign-in (KINDGI_AUTH_TENANT_PROVIDERS=off). The providers there sign people in either way. Absent from older servers: read it as tenant.

string
Allowed values: tenant operator
Example
{
  "data": [
    {
      "join": "invite",
      "kind": "oidc"
    }
  ],
  "changes": "tenant"
}

401

Section titled “401”

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

See also