OIDC Providers API
Endpoints
CRUD Operations
- List OIDC Providers - Get all OIDC providers for a project
- Get OIDC Provider - Get an OIDC provider by name
- Create OIDC Provider - Create a new OIDC provider
- Update OIDC Provider - Update an existing OIDC provider
- Delete OIDC Provider - Delete an OIDC provider
Response Format
Unlike most other Management API resources, these endpoints return the resource representation directly, not wrapped in a status/resultList envelope: GET (list) returns a raw JSON array, GET/POST/PUT (single item) return a raw JSON object, and DELETE returns 204 No Content with an empty body. See each endpoint page for the exact shape.
Error responses use the same Problem (RFC 7807)-style shape common to Management API validation errors: a JSON object carrying type, title, status, detail, path, message, and params fields (see the individual endpoint pages for examples). A 409 Conflict (duplicate name on create) and 404 Not Found (unknown name) are returned with an empty body.
Client Secret Handling
clientSecret is write-only. It is never echoed back by any endpoint — GET/list responses instead carry a clientSecretSet boolean indicating whether a secret is currently configured. On POST, a blank/omitted clientSecret means "no secret configured." On PUT, a blank/omitted clientSecret preserves the currently stored value; only a non-blank value replaces it. This matches the write-only handling used by other secret-bearing Management API resources such as LLM Providers.
Authentication
All endpoints require authentication using a Personal API Access Token.
Permissions
| Operation | Required Permission |
|---|---|
| List, Get | IDENTITY + VIEW |
| Create, Update, Delete | IDENTITY + MANAGE |
Triggering Synchronization
This API manages the provider configuration only. To queue a Keycloak synchronization run (including the scoped mode parameter), read run history, or approve a run's staged reconciliation, use the Identity Sync Runs Management API with sourceType set to oidc. It accepts the same Personal API Access Token. The Manager's own per-type synchronization endpoints, which use a Manager session instead, are described under Triggering Synchronization Externally.
Related Documentation
- OIDC Provider - Admin guide: field reference, validation modes, and Keycloak synchronization
- Identity Sync Runs Management API - Queue and monitor synchronization runs for an OIDC provider
- Provider Synchronization - Admin guide: synchronization behavior, manual triggering, run scopes, and staged-reconcile approval
- OIDC Authentication Policy - How a policy can reference a shared OIDC provider
- Authentication Guide - How to obtain and use API tokens
- Error Handling - Error response formats