OIDC Providers API
Endpoints
CRUD Operations
- List OIDC Providers - Get all OIDC providers for a project
- Get OIDC Provider - Get an OIDC provider by name
- Create OIDC Provider - Create a new OIDC provider
- Update OIDC Provider - Update an existing OIDC provider
- Delete OIDC Provider - Delete an OIDC provider
Response Format
Unlike most other Management API resources, these endpoints return the resource representation directly, not wrapped in a status/resultList envelope: GET (list) returns a raw JSON array, GET/POST/PUT (single item) return a raw JSON object, and DELETE returns 204 No Content with an empty body. See each endpoint page for the exact shape.
Error responses use the same Problem (RFC 7807)-style shape common to Management API validation errors: a JSON object carrying type, title, status, detail, path, message, and params fields (see the individual endpoint pages for examples). A 409 Conflict (duplicate name on create) and 404 Not Found (unknown name) are returned with an empty body.
Client Secret Handling
clientSecret is write-only. It is never echoed back by any endpoint — GET/list responses instead carry a clientSecretSet boolean indicating whether a secret is currently configured. On POST, a blank/omitted clientSecret means "no secret configured." On PUT, a blank/omitted clientSecret preserves the currently stored value; only a non-blank value replaces it. This matches the write-only handling used by other secret-bearing Management API resources such as LLM Providers.
Authentication
All endpoints require authentication using a Personal API Access Token.
Permissions
| Operation | Required Permission |
|---|---|
| List, Get | IDENTITY + VIEW |
| Create, Update, Delete | IDENTITY + MANAGE |
Triggering Synchronization
This API manages the provider configuration only. Manually triggering a Keycloak synchronization run (including the scoped mode parameter and the staged-reconcile approval flow) and reading run history are done through the platform's own /api/authentication-oidc-providers/** and /api/identity-sync-run-histories/** endpoints, which use a Manager session rather than a Personal API Access Token and are therefore outside this token-based API. See Triggering Synchronization Externally for the full request/response contract.
Related Documentation
- OIDC Provider - Admin guide: field reference, validation modes, and Keycloak synchronization
- Credential Sync - Admin guide: synchronization behavior, manual triggering, run scopes, and staged-reconcile approval
- OIDC Authentication Policy - How a policy can reference a shared OIDC provider
- Authentication Guide - How to obtain and use API tokens
- Error Handling - Error response formats