Update OIDC Provider

Endpoint

PUT /apiops/projects/{projectName}/oidc-providers/{name}/

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes
Content-Type	application/json	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
name	string	Yes	OIDC provider name to update

Request Body

Same shape as Create OIDC Provider — see the OIDC Provider Object field reference. name in the body, if present, is ignored for identification (the path name is authoritative) but may be used to rename the provider.

Full JSON Body Example - Rotate Client Secret

{
  "vendorType": "KEYCLOAK",
  "issuerUrl": "https://keycloak.example.com/realms/acme",
  "autoDiscover": true,
  "clientId": "apinizer-gateway",
  "clientSecret": "new-rotated-secret",
  "validationMode": "OFFLINE",
  "validateIssuer": true,
  "validateAudience": true
}

Full JSON Body Example - Update Without Touching the Secret

Omitting clientSecret (or sending it blank) leaves the currently stored secret untouched:

{
  "vendorType": "KEYCLOAK",
  "issuerUrl": "https://keycloak.example.com/realms/acme",
  "autoDiscover": true,
  "clientId": "apinizer-gateway",
  "maxClockSkewSeconds": 60,
  "validationMode": "OFFLINE",
  "validateIssuer": true,
  "validateAudience": true
}

Response

Success Response (200 OK)

The response body is the raw JSON object after the update — same shape as Get OIDC Provider.

Error Response (404 Not Found)

Returned with an empty body when no provider with the given name exists in the project.

Error Response (400 Bad Request)

Same validation errors as Create OIDC Provider (fail-closed issuer/audience validation, unresolvable certificateName, incomplete Keycloak admin configuration while syncEnabled is true).

Note

syncEnabled follows full-replace PUT semantics like every other field: a request that omits it turns synchronization off for the provider (the same as sending false), which also removes its scheduled sync job. Send syncEnabled: true explicitly to keep synchronization enabled.

cURL Example

curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/oidc-providers/keycloak-main/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "vendorType": "KEYCLOAK",
    "issuerUrl": "https://keycloak.example.com/realms/acme",
    "autoDiscover": true,
    "clientId": "apinizer-gateway",
    "maxClockSkewSeconds": 60,
    "validateIssuer": true,
    "validateAudience": true
  }'

Notes and Warnings

• Deployment: updating a provider redeploys it to every currently running environment in the project. Every policy referencing this provider picks up the change on that redeploy.
• Client secret preservation: a blank/omitted clientSecret is not treated as "clear the secret" — it preserves the currently stored value. To actually remove a configured secret, this surface has no explicit "clear" operation; use the Manager UI.
• Certificate reference: a blank/omitted certificateName clears the certificate reference; a non-blank name that cannot be resolved (in the project, or the admin scope) is rejected rather than silently dropped.

Permissions

• User must have IDENTITY + MANAGE permission in the project.

Related Documentation

• Get OIDC Provider - Get a provider by name
• Delete OIDC Provider - Delete a provider
• OIDC Provider - Admin guide field reference