Skip to main content
External OpenID providers

Update external OpenID provider

PUT/v4/config/ows/issuer/openid-providers/{providerId}

Replaces the settings of an external OpenID provider of the organisation. Send name, issuer and clientId each time. The other members change as follows:

  • clientSecret left out or empty: the stored secret stays.
  • scopes left out or empty: the scopes become openid profile email.
  • claimsGatheringCallbackUri left out or empty: the stored URL is removed.

You cannot change the built-in OpenID Conformance login provider.

Authorizations

  • Authorizationstringheaderrequired

    Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.

    Scope:authorization-servers:update

Path parameters

  • providerIdstring<uuid>required

    The id of an external OpenID provider of the organisation, from List external OpenID providers. A value that is not a UUID gives HTTP 400 (providerId: invalid type).

    Example:"3f6c2a9e-7b1d-4c58-9e2f-1a4b6d8c0e57"

Body

application/json
  • namestringrequired

    The name of the provider. Required.

    At most 255 characters.

    Example:"Example Bank login"

  • issuerstringrequired

    The issuer identifier of the provider: an http(s) URL. A trailing / is removed. Required.

    At most 2048 characters.

    Example:"https://login.example-bank.com"

  • clientIdstringrequired

    The client ID of the issuer at the provider. Required.

    At most 255 characters.

    Example:"igrant-issuer"

  • clientSecretstring

    The client secret of the issuer at the provider, for its token endpoint. Required to create a provider. In an update, leave it out (or send an empty text) to keep the stored secret.

    At most 4096 characters.

    Example:"<client-secret>"

  • scopesstring

    The scopes to ask for at the provider, separated by spaces. The API adds openid when it is missing. Empty or left out: openid profile email.

    At most 255 characters.

    Default:openid profile email

    Example:"openid profile email"

  • claimsGatheringCallbackUristring

    An http(s) URL where the API gets the claims of a deferred issuance. The API calls it with the access token of the holder from the provider as bearer token, and the URL answers {"claims": {...}}, {"interval": <seconds>} (not ready yet) or {"issuanceDenied": true, "issuanceDeniedReason": "..."}. In an update, leave it out (or send an empty text) to remove the stored URL.

    At most 2048 characters.

    Example:"https://issuer.example-bank.com/claims"

Response

application/json

The changed provider.

  • oidcProviderobject

    An external OpenID provider of the organisation: the OpenID Connect provider where the holder logs in during an authorisation code issuance of a credential definition that names it (externalOpenidProviderId). The client secret is write-only: the response only says whether one is stored (clientSecretConfigured).