Create OIDC Provider

Endpoint

POST /apiops/projects/{projectName}/oidc-providers/

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes
Content-Type	application/json	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name

Request Body

See the OIDC Provider Object field reference for every field. name is required; all other fields are optional and take their entity default when omitted (see the OIDC Provider admin guide for defaults). certificateName (instead of certificateId) is used to reference a stored Certificate by name. clientSecretSet is response-only and ignored on request bodies.

Full JSON Body Example - Generic OIDC Provider (offline, discovery-based)

{
  "name": "generic-idp",
  "description": "Generic OIDC provider, discovery-based",
  "vendorType": "GENERIC",
  "issuerUrl": "https://idp.example.com",
  "autoDiscover": true,
  "clientId": "apinizer-gateway",
  "clientSecret": "s3cr3t-value",
  "clientAuthMethod": "CLIENT_SECRET_BASIC",
  "validationMode": "OFFLINE",
  "jwksSourceMode": "DISCOVERY",
  "validateIssuer": true,
  "validateAudience": true,
  "usernameClaimPath": "preferred_username"
}

Full JSON Body Example - Keycloak Provider with Synchronization

{
  "name": "keycloak-main",
  "description": "Primary Keycloak realm for customer-facing APIs",
  "vendorType": "KEYCLOAK",
  "issuerUrl": "https://keycloak.example.com/realms/acme",
  "autoDiscover": true,
  "clientId": "apinizer-gateway",
  "clientSecret": "s3cr3t-value",
  "clientAuthMethod": "CLIENT_SECRET_BASIC",
  "validationMode": "OFFLINE",
  "jwksSourceMode": "DISCOVERY",
  "validateIssuer": true,
  "validateAudience": true,
  "usernameClaimPath": "preferred_username",
  "requireMatchingCredential": true,
  "roleSource": "SYNCED_CREDENTIAL",
  "syncEnabled": true,
  "realm": "acme",
  "adminBaseUrl": "https://keycloak.example.com",
  "syncClientId": "apinizer-sync",
  "syncPageSize": 250,
  "groupSyncEnabled": true,
  "roleSyncSource": "REALM_ROLES"
}

Full JSON Body Example - Static JWKS (air-gapped)

{
  "name": "airgapped-idp",
  "vendorType": "GENERIC",
  "clientId": "apinizer-gateway",
  "validationMode": "OFFLINE",
  "jwksSourceMode": "STATIC",
  "staticJwksJson": "{\"keys\":[{\"kty\":\"RSA\",\"kid\":\"key-1\",\"use\":\"sig\",\"alg\":\"RS256\",\"n\":\"...\",\"e\":\"AQAB\"}]}",
  "validateIssuer": true,
  "expectedIssuer": "https://idp.internal.example.com",
  "validateAudience": true,
  "expectedAudience": ["apinizer-gateway"]
}

Response

Success Response (201 Created)

The response body is the raw JSON object created — same shape as Get OIDC Provider, with clientSecretSet: true if a clientSecret was supplied.

Error Response (400 Bad Request)

Empty name:

{
  "type": "https://apinizer.com/problem-with-message",
  "title": "Bad Request",
  "status": 400,
  "detail": "name value can not be empty!",
  "path": "/apiops/projects/MyProject/oidc-providers/",
  "message": "error.nameRequired",
  "params": "authenticationOidcProvider"
}

Issuer validation enabled without an expected issuer (fail-closed save-time check — see Security Defaults):

{
  "type": "https://apinizer.com/problem-with-message",
  "title": "Bad Request",
  "status": 400,
  "detail": "Issuer validation is enabled but no expected issuer is set — fill Issuer URL or Expected Issuer, or turn issuer validation off.",
  "path": "/apiops/projects/MyProject/oidc-providers/",
  "message": "error.issuerValidationWithoutExpectedIssuer",
  "params": "authenticationOidcProvider"
}

Unresolvable certificateName:

{
  "type": "https://apinizer.com/problem-with-message",
  "title": "Bad Request",
  "status": 400,
  "detail": "Certificate (name: my-cert) is not found!",
  "path": "/apiops/projects/MyProject/oidc-providers/",
  "message": "error.certificateNotFound",
  "params": "authenticationOidcProvider"
}

Error Response (409 Conflict)

Returned with an empty body when a provider with the same name already exists in the project.

cURL Example

curl -X POST \
  "https://demo.apinizer.com/apiops/projects/MyProject/oidc-providers/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "keycloak-main",
    "vendorType": "KEYCLOAK",
    "issuerUrl": "https://keycloak.example.com/realms/acme",
    "autoDiscover": true,
    "clientId": "apinizer-gateway",
    "clientSecret": "s3cr3t-value"
  }'

Notes and Warnings

• Deployment: creating a provider deploys it to every currently running environment in the project, the same way other identity providers are deployed.
• Fail-closed validation: validateIssuer/validateAudience default to true. If enabled, the corresponding expected value must be resolvable (explicitly, or via the issuerUrl/clientId fallback) — otherwise the request is rejected at create time rather than silently accepting every token later.
• Provider mode is opt-in per policy: creating a provider here does not change any existing policy's behavior. A JWT/OAuth2/OIDC Authentication policy only resolves settings from this provider if it explicitly references it.

Permissions

• User must have IDENTITY + MANAGE permission in the project.

Related Documentation

• List OIDC Providers - Get all providers for a project
• Update OIDC Provider - Update a provider
• OIDC Provider - Admin guide field reference