---
id: config-read-idp
title: "Read identity provider"
description: "Reads the identity provider of the organisation, with its client secret in clear text. To show the login settings in a public client without the secret, use Read identity provider of the consent API for individuals (`GET /v4/service/platform/idp/open-id`)."
sidebar_label: "Read identity provider"
hide_title: true
hide_table_of_contents: true
api: eJztWtuOG7kR/ZUCXzIDtC5rT7yJ1jAy8TgL7W0WOzYcwB64qe7qbq4osk2ypdEO9JYvyaflS4Ii+yapNWs79kuwfhhL3bxUFatOnSrqnqVoEyNKJ7RiM/YL8tSCKxBEisoJt4XS6LVI0YDO/Attcq6E5TQjgo1wBQhnIZEClQOLiUEHQkEikRtweOfG8FKDLfTGz5c6FwosOidUbmkkh7JaSJE0a9CaunJ+dFgvgsoikHCn5Uq0sjT78uc5ZNqAUKlYi7Ti0sJZ/O2LlzBZX0wsmrVIcFJK7jJtVhORlhNdohqJND4fs4jpEo1Xbp6yGUu0ykROO8/TkkWs5Iav0KGxbPbm/sB68yPZ5ldwRsLFIo0bQY808NsKWqDkrmARU3yFbMZEWs5TFjGD7ythMGUzZyqMmE0KXHE2u2duW9JA64xQOdtFDO/4qpT07AnPpn95POWP0ifZ4uvFE548wSz565TtbmlFW5K5LC3yaDql//ZVeTkkKMmZaOVQOZrBy1KKxNtq8qulaffHsunFr5i4PS3ekGbsNmKlIWM7EeSghwPznHBeofnVzywakPK6RDW/gudaKUzch/ntbM8TvUfQsK2uDOiNIm8zdgzeCD03kjonf619Hs7IzWqL03NaszRizZMtpNwWC81Neh4BV2nty2EnniRYOuvDhj5bC04vUVk/cn7VfNNhSaMrhxSU3AFXPYEg4QoSLiWdy91IaTcSapRyxxfcIptlXFrcNzyvXKFNbYVXRpJ9abPwUepcVy58DrHo/S98vPGRyCL262Zpwxgy01xlOnxLMeOVdDeJLnHodI8dlmTj6bWS28a1P8B/D31gKOjC0TX2tuiNPaYAEdZWaEjgAWm63QvnSjubTLyLjOvn40SvJga5XNlJUlmnVwQDR/L4HeDVLz+cDPgGE6z1oEB+EI78fLbnKJlQD6ExD7NgsSXt4NpLwOUYXheoyJnBokpBuIi8dVVZBwskF+ILq2XlEOJGz9jL6x2bQ6FtMNaRt3wmm01Ko51OtPTIK9JREoJ3QhseGfSyLwWgSkstlBvD5Ycr0vr4l1bAb3QMU/6YPknyLiS/tOhhpyPZf/CPP034FkMelL2GzFELmUcyPA+8YH7VRFSLpG44OkL8B3yvLFofA4cwnBSYLGtc9fHIq5Ckm7g6Gb6Flj4uRUt7SDQDWvk0EgeAx/SySgWqBG3cM0eNow+a5GkYOgrs59kpg9Rk66OMwpXdoLE91pSJvMkxBl1lFKHFPoEj6RvY/9J+mKBxx6jag9Pvbq5/gte4gO9xCzed/gMKf4Sv9nPZl1aR9hIq08da1kJ8WrjtJeAHdQjykKEyIRFwxYU8Esav04VHiCZul5bodcgPh37e25Ubw7fEZSsp+YJ2DRleOFzZh7nrm9bGvBR9CxOr2Jexy3k/atOE8JrLCnuBfcS7lE+CPeZ10oUi6HM8GsJrXQNQGLS6MknYgzwuJn1j2DQZOBUpKO2aTDxmO/rXU7blvUSQHmI9PebycfTkOIt/xlTdZdbPmT57We+zprYuIQ1mnX2AHkDhFgM/J9DtIc9nh5c+JJyK+4E4JjeuXfVi+tVwfUiV9hK3lPkoMkIkCQsrYa1QOT0n119zKdKPKh37FQsao81znSIBGH2+6slxGx2Vi/tVRze7QxyhHOZo+oB4MZ3uBpZ/EEP/Ts0IVVYO2p4Aaxb5HrdDkw94rc+tkOgUG/wxmFWWywBdqUbrDZgUXOUYMMUb2k/zD+0YqHwCq1ftbAsFX6OnPH3wivsF8Dtb2RJVimkcQZwhd5XBd6mwBNXEggzEZWVKbfEd3gnrPIVpHeLx7zuEd4ZWBS6lb/8QY6KCldJaM3qv3eNzTlOxN50YyKmC848k8a+FTrcQ379ldLJvWQRv2Y9oLc/xLdvFfvH4n6MbrtKFvrs2+TyNoUBOU71lqb9CxbZ2BRqwYdxeg4DGBWPXnM711PPS0PatdwUZDv0nCOOLMQ5Nwwl4uhIKCm6BuBamoLOwfH0Kx9pndYDtd95cS+b8YnHjePHQeTbcd4WrBZp2RBwqUbJHs2395vyjApar7XXmG2KfHrq76HTv59ofu1/DH/5gI6h73ehSp3hP9NtnpQilgM7qqAnUt3sNiTY4PuhY1WrUbsZud7f7STxgzMX0cTdmxl6pOvf+hmktzDdE8XxcqD+5EKiodJUXUKLxwKmV/Yb5OAsuSzhG3/58qk2357fkCkoP1CyeLPoApJ5k/A8uJKbgNGTokuJ4wgye+v7js/g8ahA+kBzI/Nw/EP3/BdF3EbOYVEa4rY/hy1J4dalPG7xi1HiFnVHHjtw/Yo7n1ATvGnA/14PoEFfoCk08K/c9Q9/YnjHqwIeKc7ABP7n3LrdjJBC52lCT/QpXuvZEIk97pCnFlR5R0SByw5UbC+1h5aCucTwnenJiDRteHy5z2xnphtw6eGNjqq7sCQ/qfn6I4K6jX7eyfvMnduw+dX4h0CCThmgKZbuvaRqnivfWaXNb0+ErDWbiDtMQ83GQEWI4U9qFIsYZLqS3QckTPI8Ax/n4YNkZ1BOfUluczDFa4vZZvJe7BaVR0CV/XzUyek+3jhtnawH0xi7f0bwwRfUy+XevX4LPimfiYBJuv4vPCcqkVjnhlzZLO6PWREi/F9Ov4pAELWWvOhNyL0+llora+Evc+rsng6XkVADSkwgSg9zRN4WbvkhtKQCVIuEuk0RXysEzuMI1SkIhUtzCM3geliAzkIn8TQAP3IfKwiFKEYFFSTcUQeYBzpEJY915uOvyaTmI57VUkKLE+vi0TINufRZF9gFN0NFYuL92g+AnuI7zPR8LC10RU9ARWB1qVqVPcqn6HmTm6+D3FVpXtyQ6qSjR8t9hYyJg4knxaqfvmNfF9HE8fqveqtcFVTGD3KpFw/pSp7/gGZdWA88cGt9795alF94Bka5skCeFZ6pHGg3cJvU8snHejoudwGiKBs88gsOURqdV4loO2BiGuCH51oASMV30XOYGcYXKWUL9+gr0R6547p/Sw7rQvWqcO6SCDS4KrZc2Pu8Z9Vj6D2eSIRYHmCRlGYLDTBNMEmPgiWcMofqcMVuVpTbubx3Ydjeg33aP9lG6D/AHMNpOgrP//Ovf5x6j4GaDqbAFkNEA7+oETMqs0Yisxtq2VdS1EOcudJAtymxk9RoNily1fCmq55N1CFj8Yy5tBBxSkQvHJWy4lOj8ZlZLqr91Cg6TQmmq8tFGgIovPCAHUJKEN/5qSDn09IcvhKQc6wOqcnrF6focEr0qpeDUj/Jn59UzmFfS61Nfr2eVlFvfuXJezhVXKtzmSpGgsp5LNSmq5EmB8Gg8PbL5ZrMZc/96rE0+qefayQ/z5y9+unkxojm7jrR350Cxk+qkIpdsUh9l93Bej6aPLsaPx1/R3FJbt+KqJ8/wpf9h7rzvqOgfv2FoKTQJTqOE8h3u0NkOVOwNW18EAp8JIrLNWsRc/A8d6vVYxGbhdwi3EaNOM029v6cL5ldG7nb0+H2FhujibcTW3IjQ7SXeVoNGexN98sjOfqnrg3P4X35DMah2Q8wUsTJPUdiMsYgtibfVv7Hw1VxN1kjy8O7St8V6s45qnF2f6X774mXdbd3ng0vPB+sPtPqgRIfUMIhAf3uF8f6UpzX9eNYOD29OTmjpaK07KbDb7f4LQ426Lg==
sidebar_class_name: "get api-method"
info_path: docs/consent-management-admin-api/igrant-io-api-documentation
custom_edit_url: null
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


import ApiTabs from "@theme/ApiTabs";
import DiscriminatorTabs from "@theme/DiscriminatorTabs";
import MethodEndpoint from "@theme/ApiExplorer/MethodEndpoint";
import SecuritySchemes from "@theme/ApiExplorer/SecuritySchemes";
import MimeTabs from "@theme/MimeTabs";
import ParamsItem from "@theme/ParamsItem";
import ResponseSamples from "@theme/ResponseSamples";
import SchemaItem from "@theme/SchemaItem";
import SchemaTabs from "@theme/SchemaTabs";
import Markdown from "@theme/Markdown";
import OperationTabs from "@theme/OperationTabs";
import TabItem from "@theme/TabItem";

<h1 className={"openapi__heading"}>Read identity provider</h1>

<MethodEndpoint method={"get"} path={"/v4/config/platform/idp/open-id/{idpId}"}></MethodEndpoint>



Reads the identity provider of the organisation, with its client secret in clear text. To show the login settings in a public client without the secret, use Read identity provider of the consent API for individuals (`GET /v4/service/platform/idp/open-id`).

## Request

<details style={{"marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collapsed={false} open={true}><summary style={{}}><h3 className={"openapi-markdown__details-summary-header-params"}>Path Parameters</h3></summary><div><ul><ParamsItem className={"paramsItem"} param={{"description":"Identity provider ID (the `id` of the identity provider).","in":"path","name":"idpId","required":true,"schema":{"type":"string"},"example":"6af0830a2d6fb7b6ac6efc90"}}></ParamsItem></ul></div></details><div><div><ApiTabs label={undefined} id={undefined}><TabItem label={"200"} value={"200"}><div>

The identity provider.

</div><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}} className={"openapi-markdown__details"}><summary style={{}}><span className={"openapi-schema__container"}><strong className={"openapi-schema__property"}>idp</strong><span className={"openapi-schema__name"}> object</span><span className={"openapi-schema__divider"}></span><span className={"openapi-schema__required"}>required</span></span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

The OpenID Connect identity provider of the organisation: the login service of your own users. The individuals log in with it (for example in the privacy dashboard), and the service accepts its access tokens and ID tokens on the routes that an individual can call.

</div><SchemaItem collapsible={false} name={"id"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","readOnly":true,"example":"6af0830a2d6fb7b6ac6efc90","description":"Identity provider ID. The service sets it."}}></SchemaItem><SchemaItem collapsible={false} name={"issuerUrl"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"https://login.example.com/realms/customers","description":"Issuer URL of the identity provider (the `iss` of its tokens): the service finds the identity provider of a token by it. Optional. When you send it, it must be an absolute `https://` URL with a host."}}></SchemaItem><SchemaItem collapsible={false} name={"authorisationUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"https://login.example.com/realms/customers/protocol/openid-connect/auth","description":"Authorisation endpoint. An absolute `https://` URL with a host."}}></SchemaItem><SchemaItem collapsible={false} name={"tokenUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"https://login.example.com/realms/customers/protocol/openid-connect/token","description":"Token endpoint. An absolute `https://` URL with a host."}}></SchemaItem><SchemaItem collapsible={false} name={"logoutUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"https://login.example.com/realms/customers/protocol/openid-connect/logout","description":"Logout endpoint. An absolute `https://` URL with a host."}}></SchemaItem><SchemaItem collapsible={false} name={"clientId"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"privacy-dashboard","description":"Client ID of the service at the identity provider. The login uses it, and the service checks that the `aud` of a token of the identity provider holds this client ID or one of `acceptedAudiences`."}}></SchemaItem><SchemaItem collapsible={false} name={"clientSecret"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"<client-secret>","description":"Client secret of the service at the identity provider. The answers of the config routes return it in clear text."}}></SchemaItem><SchemaItem collapsible={false} name={"jwksUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"https://login.example.com/realms/customers/protocol/openid-connect/certs","description":"URL of the JSON Web Key Set of the identity provider. An absolute `https://` URL with a host."}}></SchemaItem><SchemaItem collapsible={false} name={"userInfoUrl"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"https://login.example.com/realms/customers/protocol/openid-connect/userinfo","description":"UserInfo endpoint. An absolute `https://` URL with a host."}}></SchemaItem><SchemaItem collapsible={false} name={"defaultScope"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"openid profile email","description":"Scope that the login asks for."}}></SchemaItem><SchemaItem collapsible={false} name={"acceptedAudiences"} required={false} schemaName={"string[]"} qualifierMessage={undefined} schema={{"type":"array","nullable":true,"items":{"type":"string"},"example":["https://api.example.com"],"description":"Optional. More `aud` values that the service accepts in an access token of the identity provider, for example the audience of a resource server. `null` when you did not send it."}}></SchemaItem></div></details></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"idp\": {\n    \"id\": \"6af0830a2d6fb7b6ac6efc90\",\n    \"issuerUrl\": \"https://login.example.com/realms/customers\",\n    \"authorisationUrl\": \"https://login.example.com/realms/customers/protocol/openid-connect/auth\",\n    \"tokenUrl\": \"https://login.example.com/realms/customers/protocol/openid-connect/token\",\n    \"logoutUrl\": \"https://login.example.com/realms/customers/protocol/openid-connect/logout\",\n    \"clientId\": \"privacy-dashboard\",\n    \"clientSecret\": \"<client-secret>\",\n    \"jwksUrl\": \"https://login.example.com/realms/customers/protocol/openid-connect/certs\",\n    \"userInfoUrl\": \"https://login.example.com/realms/customers/protocol/openid-connect/userinfo\",\n    \"defaultScope\": \"openid profile email\",\n    \"acceptedAudiences\": [\n      \"https://api.example.com\"\n    ]\n  }\n}"} language={"json"}></ResponseSamples></TabItem><TabItem label={"Example"} value={"Example"}><ResponseSamples responseExample={"{\n  \"idp\": {\n    \"id\": \"6af0830a2d6fb7b6ac6efc90\",\n    \"issuerUrl\": \"https://login.example.com/realms/customers\",\n    \"authorisationUrl\": \"https://login.example.com/realms/customers/protocol/openid-connect/auth\",\n    \"tokenUrl\": \"https://login.example.com/realms/customers/protocol/openid-connect/token\",\n    \"logoutUrl\": \"https://login.example.com/realms/customers/protocol/openid-connect/logout\",\n    \"clientId\": \"privacy-dashboard\",\n    \"clientSecret\": \"<client-secret>\",\n    \"jwksUrl\": \"https://login.example.com/realms/customers/protocol/openid-connect/certs\",\n    \"userInfoUrl\": \"https://login.example.com/realms/customers/protocol/openid-connect/userinfo\",\n    \"defaultScope\": \"openid profile email\",\n    \"acceptedAudiences\": null\n  }\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"401"} value={"401"}><div>

The API key or the token is missing or not valid.

</div><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem><SchemaItem collapsible={false} name={"errorKey"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"A text code of the refusal that does not change when the text changes. Only some refusals have it, for example `organisation_suspended`, `feature_disabled` or `purpose_exists`."}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\",\n  \"errorKey\": \"string\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"403"} value={"403"}><div>

The API key or token does not allow this call. An API key without the scope of the operation gets the older body `{"Code", "Message"}`. An `X-SandboxOrgId` header that names another sandbox organisation than the one of the API key gets `{"errorCode", "errorDescription"}`. When a platform admin has turned off the feature of the operation for the organisation, the answer has `errorKey` `feature_disabled` and the member `feature` (the name of the feature).

</div><details style={{"textAlign":"left","marginBottom":"1rem"}} className={"openapi-markdown__details"} data-collaposed={true} open={false}><summary style={{}}><strong>Response Headers</strong></summary><ul style={{"marginLeft":"1rem"}}></ul></details><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><div><span className={"badge badge--info"}>anyOf</span><SchemaTabs><TabItem label={"MOD1"} value={"0-item-properties"}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem><SchemaItem collapsible={false} name={"errorKey"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"A text code of the refusal that does not change when the text changes. Only some refusals have it, for example `organisation_suspended`, `feature_disabled` or `purpose_exists`."}}></SchemaItem></TabItem><TabItem label={"Older error body"} value={"1-item-properties"}><SchemaItem collapsible={false} name={"Code"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","description":"The HTTP status.","example":403}}></SchemaItem><SchemaItem collapsible={false} name={"Message"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"What went wrong.","example":"Unauthorized access;User doesn't have enough permissions;"}}></SchemaItem></TabItem></SchemaTabs></div></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{}"} language={"json"}></ResponseSamples></TabItem><TabItem label={"Example"} value={"Example"}><ResponseSamples responseExample={"{\n  \"Code\": 403,\n  \"Message\": \"Unauthorized access;User doesn't have enough permissions;\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem><TabItem label={"500"} value={"500"}><div>

The organisation has no identity provider with this ID (`Failed to fetch identity provider: <idpId>`), or the server failed.

</div><div><MimeTabs className={"openapi-tabs__mime"} schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs className={"openapi-tabs__schema"}><TabItem label={"Schema"} value={"Schema"}><details style={{}} className={"openapi-markdown__details response"} data-collapsed={false} open={true}><summary style={{}} className={"openapi-markdown__details-summary-response"}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"errorCode"} required={true} schemaName={"integer"} qualifierMessage={undefined} schema={{"type":"integer","example":400}}></SchemaItem><SchemaItem collapsible={false} name={"errorDescription"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","example":"Bad input parameter"}}></SchemaItem><SchemaItem collapsible={false} name={"errorKey"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"A text code of the refusal that does not change when the text changes. Only some refusals have it, for example `organisation_suspended`, `feature_disabled` or `purpose_exists`."}}></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"errorCode\": 400,\n  \"errorDescription\": \"Bad input parameter\",\n  \"errorKey\": \"string\"\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem></ApiTabs></div></div>