List OIDC Providers

Endpoint

GET /apiops/projects/{projectName}/oidc-providers/

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name

Query Parameters

None.

Response

Success Response (200 OK)

The response body is a raw JSON array (not wrapped in a status/resultList envelope).

[
  {
    "name": "keycloak-main",
    "description": "Primary Keycloak realm for customer-facing APIs",
    "vendorType": "KEYCLOAK",
    "issuerUrl": "https://keycloak.example.com/realms/acme",
    "discoveryUrl": null,
    "autoDiscover": true,
    "tokenEndpoint": "https://keycloak.example.com/realms/acme/protocol/openid-connect/token",
    "introspectionEndpoint": "https://keycloak.example.com/realms/acme/protocol/openid-connect/token/introspect",
    "userInfoEndpoint": "https://keycloak.example.com/realms/acme/protocol/openid-connect/userinfo",
    "jwksEndpoint": "https://keycloak.example.com/realms/acme/protocol/openid-connect/certs",
    "endSessionEndpoint": "https://keycloak.example.com/realms/acme/protocol/openid-connect/logout",
    "clientId": "apinizer-gateway",
    "clientSecretSet": true,
    "clientAuthMethod": "CLIENT_SECRET_BASIC",
    "validationMode": "OFFLINE",
    "jwksSourceMode": "DISCOVERY",
    "staticJwksJson": null,
    "certificateName": null,
    "jwksCacheTimeoutSeconds": 3600,
    "allowedSignatureAlgorithms": ["RS256", "RS384", "RS512", "ES256"],
    "validateIssuer": true,
    "expectedIssuer": null,
    "validateAudience": true,
    "expectedAudience": [],
    "maxClockSkewSeconds": 30,
    "connectionTimeoutSeconds": 10,
    "readTimeoutSeconds": 10,
    "usernameClaimPath": "preferred_username",
    "emailClaimPath": "email",
    "fullNameClaimPath": "name",
    "rolesClaimPath": null,
    "groupsClaimPath": null,
    "requireMatchingCredential": true,
    "roleSource": "SYNCED_CREDENTIAL",
    "syncEnabled": true,
    "realm": "acme",
    "adminBaseUrl": "https://keycloak.example.com",
    "syncPageSize": 250,
    "groupSyncEnabled": true,
    "roleSyncSource": "REALM_ROLES",
    "syncClientId": "apinizer-sync"
  }
]

OIDC Provider Object

Field	Type	Description
name	string	Provider name (unique within the project)
description	string	Description
vendorType	string	GENERIC or KEYCLOAK
issuerUrl	string	OIDC issuer (iss) URL
discoveryUrl	string|null	Overrides the default {issuerUrl}/.well-known/openid-configuration address
autoDiscover	boolean	Whether endpoints are kept in sync with the discovery document
tokenEndpoint	string|null	Token endpoint URL
introspectionEndpoint	string|null	Introspection endpoint URL (RFC 7662)
userInfoEndpoint	string|null	UserInfo endpoint URL
jwksEndpoint	string|null	JWKS endpoint URL
endSessionEndpoint	string|null	Logout/end-session endpoint URL
clientId	string	OAuth/OIDC client identifier
clientSecretSet	boolean	true if a client secret is currently configured. The secret itself is never returned.
clientAuthMethod	string	CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, or PRIVATE_KEY_JWT
validationMode	string	OFFLINE, ONLINE, or HYBRID
jwksSourceMode	string	DISCOVERY or STATIC
staticJwksJson	string|null	Pasted JWKS document, when jwksSourceMode=STATIC
certificateName	string|null	Name of a Certificate used for signature verification, when jwksSourceMode=STATIC
jwksCacheTimeoutSeconds	integer	JWKS cache TTL, in seconds
allowedSignatureAlgorithms	array[string]	Accepted JWT signature algorithms
validateIssuer	boolean	Whether the iss claim is validated
expectedIssuer	string|null	Expected issuer; falls back to issuerUrl when empty
validateAudience	boolean	Whether the aud claim is validated
expectedAudience	array[string]	Expected audience values; falls back to [clientId] when empty
maxClockSkewSeconds	integer	Clock skew tolerance, in seconds
connectionTimeoutSeconds	integer	Connect timeout, in seconds
readTimeoutSeconds	integer	Read timeout, in seconds
usernameClaimPath	string	Claim resolved as the username. Default: preferred_username
emailClaimPath	string	Claim resolved as the email. Default: email
fullNameClaimPath	string	Claim resolved as the full name. Default: name
rolesClaimPath	string|null	Claim resolved as roles, when roleSource reads from the token
groupsClaimPath	string|null	Claim resolved as group memberships, when roleSource reads from the token
requireMatchingCredential	boolean	When true, a validated token without a matching Credential is rejected
roleSource	string	TOKEN_CLAIM, SYNCED_CREDENTIAL, or BOTH
syncEnabled	boolean	Whether Keycloak identity synchronization is enabled
realm	string|null	Keycloak realm (Keycloak vendor only)
adminBaseUrl	string|null	Keycloak Admin REST API base URL (Keycloak vendor only)
syncPageSize	integer	Page size used when paging Keycloak's user list. Default: 250
groupSyncEnabled	boolean	Whether the Keycloak group tree is synchronized
roleSyncSource	string	REALM_ROLES, CLIENT_ROLES, or GROUPS
syncClientId	string|null	Keycloak service-account client used for Admin API calls

Notes

• clientSecret and staticJwksJson content are handled write-only for secrets — clientSecret is never present in the response body; only clientSecretSet indicates its presence.
• identitySyncProfile (cron schedule, deactivation mode, last-run counters) is not yet surfaced on this endpoint. See Credential Sync for that data in the Manager UI.
• An empty array ([]) is returned when the project has no OIDC providers.

Error Response (400 Bad Request)

{
  "type": "https://apinizer.com/problem-with-message",
  "title": "Bad Request",
  "status": 400,
  "detail": "Project (MyProject) is not found!",
  "path": "/apiops/projects/MyProject/oidc-providers/",
  "message": "error.http.400"
}

cURL Example

curl -X GET \
  "https://demo.apinizer.com/apiops/projects/MyProject/oidc-providers/" \
  -H "Authorization: Bearer YOUR_TOKEN"

Permissions

• User must have IDENTITY + VIEW permission in the project.

Related Documentation

• Get OIDC Provider - Get a single provider by name
• Create OIDC Provider - Create a new provider
• OIDC Provider - Admin guide field reference