Get one identity provider

GET

/v1/auth/providers/{providerId}

curl --request GET \
  --url https://example.com/v1/auth/providers/example \
  --header 'Authorization: Bearer <token>'

• Same-origin — path relative to the deployment root.

The provider as stored, with signIn when the deployment sets it. Secrets appear only as references.

Authorizations

• bearerAuth

Parameters

Path Parameters

providerId

required

string

>= 1 characters

Responses

200

The provider.

Media typeapplication/json

One of: discriminator: kind

object

An OpenID Connect identity provider people sign in with. The endpoints come from the issuer’s discovery document when absent, and are returned once the deployment has them.

object

providerId

required

string

>= 1 characters

displayName

The name a sign-in page shows (“Sign in with …”). Default: providerId.

string

>= 1 characters

domains

The email domains whose people sign in with this provider (lowercase, e.g. acme.com): how an email-first sign-in page finds it.

Array<string>

join

Who may sign in the first time: invite (default) only people a tenant admin added; domain also anyone from one of domains, once the deployment has verified them.

string

Allowed values: invite domain

signIn

One of:

object

object

redirectUri

required

string format: uri

object

object

spEntityId

required

string

>= 1 characters

acsUrl

required

string format: uri

spMetadataUrl

required

string format: uri

metadata

object

key

additional properties

any

kind

required

string

Allowed value: oidc

issuer

required

string format: uri

clientId

required

string

>= 1 characters

clientSecretRef

required

Opaque reference resolved server-side. Never a plaintext secret.

string

>= 1 characters

scopes

Default openid email profile.

Array<string>

authorizationEndpoint

string format: uri

tokenEndpoint

string format: uri

userinfoEndpoint

string format: uri

jwksEndpoint

string format: uri

claimMapping

Per-provider claim mapping. All fields optional; closer to OIDC defaults (sub/email/name) → fewer overrides needed.

object

userId

string

>= 1 characters

email

string

>= 1 characters

displayName

string

>= 1 characters

scopes

Claim path + optional delimiter for extracting Kindgi OAuth scopes from provider claims. When absent, scopes come from the token response scope field instead.

object

claim

required

string

>= 1 characters

delimiter

string

metadata

Array<string>

object

A SAML 2.0 identity provider people sign in with: its metadata XML, or its entity ID, single sign-on URL and signing certificates. Keys are given as references, never as keys.

object

providerId

required

string

>= 1 characters

displayName

The name a sign-in page shows (“Sign in with …”). Default: providerId.

string

>= 1 characters

domains

The email domains whose people sign in with this provider (lowercase, e.g. acme.com): how an email-first sign-in page finds it.

Array<string>

join

Who may sign in the first time: invite (default) only people a tenant admin added; domain also anyone from one of domains, once the deployment has verified them.

string

Allowed values: invite domain

signIn

One of:

object

object

redirectUri

required

string format: uri

object

object

spEntityId

required

string

>= 1 characters

acsUrl

required

string format: uri

spMetadataUrl

required

string format: uri

metadata

object

key

additional properties

any

kind

required

string

Allowed value: saml

idpMetadataXml

string

>= 1 characters

idpEntityId

string

>= 1 characters

idpSsoUrl

The IdP’s single sign-on URL (HTTP-Redirect binding).

string format: uri

idpCertificates

The IdP’s signing certificates (PEM); several during a rollover.

Array<string>

spSigningKeyRef

Opaque reference to the service provider’s signing key, for IdPs that require signed AuthnRequests. Never a plaintext key.

string

>= 1 characters

spDecryptionKeyRef

Opaque reference to the key that decrypts encrypted assertions. Never a plaintext key.

string

>= 1 characters

wantAssertionsSigned

Require signed assertions. Default true.

boolean

attributeMapping

Assertion attribute names. Defaults: userId = the NameID, email = email.

object

userId

string

>= 1 characters

email

string

>= 1 characters

displayName

string

>= 1 characters

Example

{
  "join": "invite",
  "kind": "oidc"
}

401

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

403

Not a member of the workspace (permission-denied). Without an authorization store, anyone reads it.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

404

No identity provider registered with that id under this workspace.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

503

The database was too busy to answer in time (database-busy); Retry-After (whole seconds) says when to try again.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

See also

• PATCH /v1/auth/providers/{providerId}: Change an identity provider, keeping its sign-in URLs
• GET /v1/auth/providers: List identity providers configured for the workspace
• POST /v1/auth/providers: Register an identity provider (OIDC or SAML)
• GET /v1/auth/providers/{providerId}/sign-in: What to give the identity provider, before or after registering
• Error code database-busy
• Error code permission-denied
• Every error code