link管理

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

Identity Providers API

The Okta Identity Providers API provides operations to manage federations with external Identity Providers (IdP). For example, your app can support signing in with credentials from Apple, Facebook, Google, LinkedIn, Microsoft, an enterprise IdP using SAML 2.0, or an IdP using the OpenID Connect ( OIDC ) protocol.

Note : Some of the curl code examples on this page include SSWS API token authentication. However, Okta recommends using scoped OAuth 2.0 and OIDC access tokens to authenticate with Okta management APIs. OAuth 2.0 and OIDC access tokens provide fine-grain control over the bearer's actions on specific endpoints. See Okta API authentication methods .

Get started

Explore the Identity Providers API: (opens new window)

See Add and external Identity Provider for detailed IdP set up guides using the Admin Console.

Add Identity Provider

/api/v1/idps

Adds an IdP to your organization. See Identity Provider type for the list of supported external IdPs.

Request parameters

Parameter	Description	Param Type	DataType	Required
idp	IdP settings	Body	Identity Provider	TRUE

Response parameters

The created Identity Provider

Request examples

Add Generic OIDC Identity Provider
Add SAML 2.0 Identity Provider
Add Apple Identity Provider
Add Facebook Identity Provider
Add Google Identity Provider
Add LinkedIn Identity Provider
Add Microsoft Identity Provider
Add Smart Card Identity Provider

See Identity Provider type for a list of all the supported external IdPs.

Add Generic OpenID Connect Identity Provider

Adds an OIDC type IdP to your organization

Request example

curl -v -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
-d '{
  "type": "OIDC",
  "name": "Example OpenID Connect IdP",
  "protocol": {
    "algorithms": {
      "request": {
        "signature": {
          "algorithm": "HS256",
          "scope": "REQUEST"
    "endpoints": {
      "acs": {
        "binding": "HTTP-POST",
        "type": "INSTANCE"
      "authorization": {
        "binding": "HTTP-REDIRECT",
        "url": "https://idp.example.com/authorize"
      "token": {
        "binding": "HTTP-POST",
        "url": "https://idp.example.com/token"
      "userInfo": {
        "binding": "HTTP-REDIRECT",
        "url": "https://idp.example.com/userinfo"
      "jwks": {
        "binding": "HTTP-REDIRECT",
        "url": "https://idp.example.com/keys"
    "scopes": [
      "openid",
      "profile",
      "email"
    "type": "OIDC",
    "credentials": {
      "client": {
        "client_id": "your-client-id",
        "client_secret": "your-client-secret"
    "issuer": {
      "url": "https://idp.example.com"
  "policy": {
    "accountLink": {
      "action": "AUTO",
      "filter": null
    "provisioning": {
      "action": "AUTO",
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
      "groups": {
        "action": "NONE"
    "mapAMRClaims": false,
    "maxClockSkew": 120000,
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.email"
      "matchType": "USERNAME"
}' "https://${yourOktaDomain}/api/v1/idps"

Response example

{
    "id": "0oaulob4BFVa4zQvt0g3",
    "type": "OIDC",
    "name": "Example OpenID Connect IdP",
    "status": "ACTIVE",
    "created": "2019-02-07T20:07:47.000Z",
    "lastUpdated": "2019-02-07T20:07:47.000Z",
    "protocol": {
        "type": "OIDC",
        "endpoints": {
            "authorization": {
                "url": "https://idp.example.com/authorize",
                "binding": "HTTP-REDIRECT"
            "token": {
                "url": "https://idp.example.com/token",
                "binding": "HTTP-POST"
            "userInfo": {
                "url": "https://idp.example.com/userinfo",
                "binding": "HTTP-REDIRECT"
            "jwks": {
                "url": "https://idp.example.com/keys",
                "binding": "HTTP-REDIRECT"
        "algorithms": {
          "request": {
            "signature": {
              "algorithm": "HS256",
              "scope": "REQUEST"
        "scopes": [
            "openid"
        "issuer": {
            "url": "https://idp.example.com"
        "credentials": {
            "client": {
                "client_id": "your-client-id",
                "client_secret": "your-client-secret"
    "policy": {
        "provisioning": {
            "action": "AUTO",
            "profileMaster": false,
            "groups": {
                "action": "NONE"
            "conditions": {
                "deprovisioned": {
                    "action": "NONE"
                "suspended": {
                    "action": "NONE"
        "accountLink": {
            "filter": null,
            "action": "AUTO"
        "subject": {
            "userNameTemplate": {
                "template": "idpuser.email"
            "filter": null,
            "matchType": "USERNAME",
            "matchAttribute": null
        "mapAMRClaims": false,
        "maxClockSkew": 0
    "_links": {
        "authorize": {
            "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oaulob4BFVa4zQvt0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}&nonce={nonce}",
            "templated": true,
            "hints": {
                "allow": [
                    "GET"
        "clientRedirectUri": {
            "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
            "hints": {
                "allow": [
                    "POST"

Add SAML 2.0 Identity Provider

Adds a SAML2 type IdP to your organization

Notes: You must first add the IdP's signature certificate to the IdP key store before you can add a SAML 2.0 IdP with a kid credential reference. Don't use fromURI to automatically redirect a user to a particular app after successfully authenticating with a third-party IdP. Instead, use SAML Deep Links . Using fromURI isn't tested and not supported. For more information about using deep links when signing users in using an SP-initiated flow, see Understanding SP-Initiated Login flow .

Request example

curl -v -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
-d '{
  "type": "SAML2",
  "name": "Example SAML IdP",
  "protocol": {
    "type": "SAML2",
    "endpoints": {
      "sso": {
        "url": "https://idp.example.com",
        "binding": "HTTP-POST",
        "destination": "https://idp.example.com"
      "acs": {
        "binding": "HTTP-POST",
        "type": "INSTANCE"
    "algorithms": {
      "request": {
        "signature": {
          "algorithm": "SHA-256",
          "scope": "REQUEST"
      "response": {
        "signature": {
          "algorithm": "SHA-256",
          "scope": "ANY"
    "credentials": {
      "trust": {
        "issuer": "https://idp.example.com",
        "audience": "http://www.okta.com/123",
        "kid": "your-key-id"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "saml.subjectNameId"
      "format": [
          "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
      "filter": "(\\S+@example\\.com)",
      "matchType": "USERNAME"
}' "https://${yourOktaDomain}/api/v1/idps"

Response example

{
  "id": "0oa62bc8wppPw0UGr0h7",
  "type": "SAML2",
  "name": "Example SAML IdP",
  "status": "ACTIVE",
  "created": "2016-03-24T23:14:54.000Z",
  "lastUpdated": "2016-03-24T23:14:54.000Z",
  "protocol": {
    "type": "SAML2",
    "endpoints": {
      "sso": {
        "url": "https://idp.example.com",
        "binding": "HTTP-POST",
        "destination": "https://idp.example.com"
      "acs": {
        "binding": "HTTP-POST",
        "type": "INSTANCE"
    "algorithms": {
      "request": {
        "signature": {
          "algorithm": "SHA-256",
          "scope": "REQUEST"
      "response": {
        "signature": {
          "algorithm": "SHA-256",
          "scope": "ANY"
    "settings": {
      "nameFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
    "credentials": {
      "trust": {
        "issuer": "https://idp.example.com",
        "audience": "http://www.okta.com/123",
        "kid": "your-key-id"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "saml.subjectNameId"
      "filter": "(\\S+@example\\.com)",
      "matchType": "USERNAME"
    "mapAMRClaims": false,
    "maxClockSkew": 0
  "_links": {
    "metadata": {
      "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml",
      "type": "application/xml",
      "hints": {
        "allow": [
          "GET"
    "acs": {
      "href": "https://{yourOktaDomain}/sso/saml2/0oa62bc8wppPw0UGr0h7",
      "type": "application/xml",
      "hints": {
        "allow": [
          "POST"
    "users": {
      "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/users",
      "hints": {
        "allow": [
          "GET"
    "deactivate": {
      "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/deactivate",
      "hints": {
        "allow": [
          "POST"

Redirect with SAML deep links

Use SAML deep links to automatically redirect the user to an app after successfully authenticating with a third-party IdP. To use deep links, assemble these three parts into a URL:

SP ACS URL
For example: https://${yourOktaDomain}/sso/saml2/:idpId
The app to which the user is automatically redirected after successfully authenticating with the IdP
For example: /app/:app-location/:appId/sso/saml
Optionally, if the app is an outbound SAML app, you can specify the relayState passed to it.
For example: ?RelayState=:anyUrlEncodedValue

The deep link for the above three parts is:
https://${yourOktaDomain}/sso/saml2/:idpId/app/:app-location/:appId/sso/saml?RelayState=:anyUrlEncodedValue

Add Apple Identity Provider

Adds an Apple type IdP to your organization

Request example

Note: The key is truncated for brevity.

curl -v -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
-d '{
  "type": "APPLE",
  "name": "Apple Identity Provider",
  "protocol": {
    "type": "OIDC",
    "scopes": ["openid", "email", "name"],
    "credentials": {
      "client": {
        "client_id": "your-client-id"
      "signing": {
        "privateKey": "MIGTAgEAMBM........Cb9PnybCnzDv+3cWSGWqpAIsQQZ",
        "kid": "test key id",
        "teamId": "test team id"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.email"
      "matchType": "USERNAME"
}' "https://${yourOktaDomain}/api/v1/idps"

Response example

Note: The key is truncated for brevity.

{
  "id": "0oa18hsHsG3boVejU0g4",
  "type": "APPLE",
  "issuerMode": "ORG_URL",
  "name": "Apple Identity Provider",
  "status": "ACTIVE",
  "created": "2020-06-05T20:57:51.000Z",
  "lastUpdated": "2020-06-05T20:57:51.000Z",
  "protocol": {
    "type": "OIDC",
    "endpoints": {
      "authorization": {
        "url": "https://appleid.apple.com/auth/authorize",
        "binding": "HTTP-REDIRECT"
      "token": {
        "url": "https://appleid.apple.com/auth/token",
        "binding": "HTTP-POST"
    "scopes": [
      "openid",
      "email",
      "name"
    "credentials": {
      "client": {
        "client_id": "your-client-id"
      "signing": {
        "teamId": "test team id",
        "privateKey": "MIGTAgEAMBM........Cb9PnybCnzDv+3cWSGWqpAIsQQZ",
        "kid": "test key id"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.email"
      "filter": null,
      "matchType": "USERNAME",
      "matchAttribute": null
    "mapAMRClaims": false,
    "maxClockSkew": 0
  "_links": {
    "authorize": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa18hsHsG3boVejU0g4&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri=${redirectUri}&state={state}&nonce={nonce}",
      "templated": true,
      "hints": {
        "allow": [
          "GET"
    "clientRedirectUri": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
      "hints": {
        "allow": [
          "POST"

Add Facebook Identity Provider

Adds a FACEBOOK type IdP to your organization

Request example

curl -v -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
-d '{
  "type": "FACEBOOK",
  "name": "Facebook",
  "protocol": {
    "type": "OAUTH2",
    "scopes": [
      "public_profile",
      "email"
    "credentials": {
      "client": {
        "client_id": "your-client-id",
        "client_secret": "your-client-secret"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.userPrincipalName"
      "filter": null,
      "matchType": "USERNAME"
    "mapAMRClaims": false,
    "maxClockSkew": 0
}' "https://${yourOktaDomain}/api/v1/idps"

Response example

{
  "id": "0oa62b57p7c8PaGpU0h7",
  "type": "FACEBOOK",
  "name": "Facebook",
  "status": "ACTIVE",
  "created": "2016-03-24T23:18:27.000Z",
  "lastUpdated": "2016-03-24T23:18:27.000Z",
  "protocol": {
    "type": "OAUTH2",
    "endpoints": {
      "authorization": {
        "url": "https://www.facebook.com/dialog/oauth",
        "binding": "HTTP-REDIRECT"
      "token": {
        "url": "https://graph.facebook.com/v2.5/oauth/access_token",
        "binding": "HTTP-POST"
    "scopes": [
      "public_profile",
      "email"
    "credentials": {
      "client": {
        "client_id": "your-client-id",
        "client_secret": "your-client-secret"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.userPrincipalName"
      "filter": null,
      "matchType": "USERNAME"
    "mapAMRClaims": false,
    "maxClockSkew": 0
  "_links": {
    "authorize": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62b57p7c8PaGpU0h7&
          client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
          scope={scopes}&redirect_uri={redirectUri}&state={state}",
      "templated": true,
      "hints": {
        "allow": [
          "GET"
    "clientRedirectUri": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
      "hints": {
        "allow": [
          "POST"

Add Google Identity Provider

Adds a Google type IdP to your organization

Request example

curl -v -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
-d '{
  "type": "GOOGLE",
  "name": "Google",
  "protocol": {
    "type": "OAUTH2",
    "scopes": [
      "profile",
      "email",
      "openid"
    "credentials": {
      "client": {
        "client_id": "your-client-id",
        "client_secret": "your-client-secret"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.userPrincipalName"
      "filter": null,
      "matchType": "USERNAME"
    "mapAMRClaims": false,
    "maxClockSkew": 0
}' "https://${yourOktaDomain}/api/v1/idps"

Response example

{
  "id": "0oa62bfdiumsUndnZ0h7",
  "type": "GOOGLE",
  "name": "Google",
  "status": "ACTIVE",
  "created": "2016-03-24T23:21:49.000Z",
  "lastUpdated": "2016-03-24T23:21:49.000Z",
  "protocol": {
    "type": "OIDC",
    "endpoints": {
      "authorization": {
        "url": "https://accounts.google.com/o/oauth2/auth",
        "binding": "HTTP-REDIRECT"
      "token": {
        "url": "https://www.googleapis.com/oauth2/v3/token",
        "binding": "HTTP-POST"
    "scopes": [
      "profile",
      "email",
      "openid"
    "credentials": {
      "client": {
        "client_id": "your-client-id",
        "client_secret": "your-client-secret"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.userPrincipalName"
      "filter": null,
      "matchType": "USERNAME"
    "mapAMRClaims": false,
    "maxClockSkew": 0
  "_links": {
    "authorize": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7&
          client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
          scope={scopes}&redirect_uri={redirectUri}&state={state}",
      "templated": true,
      "hints": {
        "allow": [
          "GET"
    "clientRedirectUri": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
      "hints": {
        "allow": [
          "POST"

Add LinkedIn Identity Provider

Adds a LINKEDIN type IdP to your organization

Request example

curl -v -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
-d '{
  "type": "LINKEDIN",
  "name": "LinkedIn",
  "protocol": {
    "type": "OAUTH2",
    "scopes": [
      "r_basicprofile",
      "r_emailaddress"
    "credentials": {
      "client": {
        "client_id": "your-client-id",
        "client_secret": "your-client-secret"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.userPrincipalName"
      "filter": null,
      "matchType": "USERNAME"
    "mapAMRClaims": false,
    "maxClockSkew": 0
}' "https://${yourOktaDomain}/api/v1/idps"

Response example

{
  "id": "0oa62bfdjnK55Z5x80h7",
  "type": "LINKEDIN",
  "name": "LinkedIn",
  "status": "ACTIVE",
  "created": "2016-03-24T23:23:59.000Z",
  "lastUpdated": "2016-03-24T23:23:59.000Z",
  "protocol": {
    "type": "OAUTH2",
    "endpoints": {
      "authorization": {
        "url": "https://www.linkedin.com/uas/oauth2/authorization",
        "binding": "HTTP-REDIRECT"
      "token": {
        "url": "https://www.linkedin.com/uas/oauth2/accessToken",
        "binding": "HTTP-POST"
    "scopes": [
      "r_basicprofile",
      "r_emailaddress"
    "credentials": {
      "client": {
        "client_id": "your-client-id",
        "client_secret": "your-client-secret"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.userPrincipalName"
      "filter": null,
      "matchType": "USERNAME"
    "mapAMRClaims": false,
    "maxClockSkew": 0
  "_links": {
    "authorize": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdjnK55Z5x80h7&
          client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
          scope={scopes}&redirect_uri={redirectUri}&state={state}",
      "templated": true,
      "hints": {
        "allow": [
          "GET"
    "clientRedirectUri": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
      "hints": {
        "allow": [
          "POST"

Add Microsoft Identity Provider

Adds a Microsoft type IdP to your organization

Request example

curl -v -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
-d '{
  "type": "MICROSOFT",
  "name": "Microsoft",
  "protocol": {
    "type": "OIDC",
    "scopes": ["openid", "email", "profile", "https://graph.microsoft.com/User.Read"],
    "credentials": {
      "client": {
        "client_id": "your-client-id",
        "client_secret": "your-client-secret"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.userPrincipalName"
      "filter": null,
      "matchType": "USERNAME"
    "mapAMRClaims": false,
    "maxClockSkew": 0
}' "https://${yourOktaDomain}/api/v1/idps"

Response example

{
  "id": "0oajmvdFawBih4gey0g3",
  "type": "MICROSOFT",
  "name": "Microsoft",
  "status": "ACTIVE",
  "created": "2016-03-29T16:47:36.000Z",
  "lastUpdated": "2016-03-29T16:47:36.000Z",
  "protocol": {
    "type": "OIDC",
    "endpoints": {
      "authorization": {
        "url": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
        "binding": "HTTP-REDIRECT"
      "token": {
        "url": "https://login.microsoftonline.com/common/oauth2/v2.0/token",
        "binding": "HTTP-POST"
    "scopes": [
      "openid",
      "email",
      "profile",
      "https://graph.microsoft.com/User.Read"
    "credentials": {
      "client": {
        "client_id": "your-client-id",
        "client_secret": "your-client-secret"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.userPrincipalName"
      "filter": null,
      "matchType": "USERNAME"
    "mapAMRClaims": false,
    "maxClockSkew": 0
  "_links": {
    "authorize": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oajmvdFawBih4gey0g3&
          client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
          scope={scopes}&redirect_uri={redirectUri}&state={state}",
      "templated": true,
      "hints": {
        "allow": [
          "GET"
    "clientRedirectUri": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
      "hints": {
        "allow": [
          "POST"

Add Smart Card Identity Provider

Adds a Smart Card X509 type IdP to your organization

Request example

Notes: You must first add the IdP's server certificate to the IdP key store before you can add a Smart Card X509 IdP with a kid credential reference. You need to upload the whole trust chain as a single key using the Key Store API . Depending on the information stored in the smart card, select the proper template idpuser.subjectAltNameEmail or idpuser.subjectAltNameUpn .

curl -v -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
-d '{
  "type": "X509",
  "status": "ACTIVE",
  "name": "Smart Card IDP Name",
  "properties": {
    "additionalAmr": [
      "sc",
      "hwk",
      "pin",
      "mfa",
  "protocol": {
    "type": "MTLS",
    "credentials": {
      "trust": {
        "revocation": "CRL",
        "revocationCacheLifetime": 2880,
        "issuer": "your-issuer",
        "kid": "your-kid"
  "policy": {
    "provisioning": {
      "action":"DISABLED"
    "mapAMRClaims": false,
    "maxClockSkew":120000,
    "subject": {
      "matchType": "EMAIL",
      "matchAttribute": "",
      "userNameTemplate": {
        "template": "idpuser.subjectAltNameEmail"
}' "https://${yourOktaDomain}/api/v1/idps"

Response example

{
  "id": "0oa6jxasyhwM2ZHJh0g4",
  "type": "X509",
  "name": "Smart Card IDP Name",
  "status": "ACTIVE",
  "created": "2020-01-07T00:19:27.000Z",
  "lastUpdated": "2020-01-07T00:19:27.000Z",
  "properties": {
    "additionalAmr": [
      "sc",
      "hwk",
      "pin",
      "mfa",
  "protocol": {
    "type": "MTLS",
    "endpoints": {
      "sso": {
        "url": "https://{yourOktaDomain}.okta.com/login/cert"
    "credentials": {
      "trust": {
        "issuer": "CN=Test Smart Card, OU=Test OU, O=Test O, C=US",
        "audience": null,
        "kid":"45dec5ff-8cdc-48c0-85fe-a4869f1753dc",
        "revocation":"CRL",
        "revocationCacheLifetime":2880
  "policy": {
    "provisioning": {
      "action": "DISABLED",
      "profileMaster": false,
      "groups": null
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.subjectAltNameEmail"
      "filter": null,
      "matchType": "EMAIL",
      "matchAttribute": null
    "mapAMRClaims": false,
    "maxClockSkew":120000
  "_links": {
    "deactivate": {
      "href": "https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/lifecycle/deactivate",
      "hints": {
        "allow": [
          "POST"
    "users": {
      "href": "https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/users",
      "hints": {
        "allow": [
          "GET"
    "keys": {
      "href":"https://{yourOktaDomain}.okta.com/api/v1/idps/credentials/keys/45dec5ff-8cdc-48c0-85fe-a4869f1753dc",
      "hints": {
        "allow": [
          "GET"

Get Identity Provider

/api/v1/idps/ ${idpId}

Fetches an IdP by id

Request parameters

Parameter	Description	Param Type	DataType	Required
idpId	`id` of an IdP	URL	String	TRUE

Response parameters

Identity Provider

Request example

curl -v -X GET \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
"https://${yourOktaDomain}/api/v1/idps/0oa62bfdjnK55Z5x80h7"

Response example

{
  "id": "0oa62bfdjnK55Z5x80h7",
  "type": "LINKEDIN",
  "name": "LinkedIn",
  "status": "ACTIVE",
  "created": "2016-03-24T23:23:59.000Z",
  "lastUpdated": "2016-03-24T23:23:59.000Z",
  "protocol": {
    "type": "OAUTH2",
    "endpoints": {
      "authorization": {
        "url": "https://www.linkedin.com/uas/oauth2/authorization",
        "binding": "HTTP-REDIRECT"
      "token": {
        "url": "https://www.linkedin.com/uas/oauth2/accessToken",
        "binding": "HTTP-POST"
    "scopes": [
      "r_basicprofile",
      "r_emailaddress"
    "credentials": {
      "client": {
        "client_id": "your-client-id",
        "client_secret": "your-client-secret"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.userPrincipalName"
      "filter": null,
      "matchType": "USERNAME"
    "mapAMRClaims": false,
    "maxClockSkew": 0
  "_links": {
    "authorize": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdjnK55Z5x80h7&
          client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
          scope={scopes}&redirect_uri={redirectUri}&state={state}",
      "templated": true,
      "hints": {
        "allow": [
          "GET"
    "clientRedirectUri": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
      "hints": {
        "allow": [
          "POST"

List Identity Providers

/api/v1/idps

Enumerates IdPs in your organization with pagination. A subset of IdPs can be returned that match a supported filter expression or query.

List Identity Providers with defaults
List Identity Providers with name
List Identity Providers with type

Request parameters

Parameter	Description	Param Type	DataType	Required	Default
after	Specifies the pagination cursor for the next page of IdPs	Query	String	FALSE
limit	Specifies the number of IdP results in a page	Query	Number	FALSE	20
q	Searches the `name` property of IdPs for matching value	Query	String	FALSE
type	Filters IdPs by `type`	Query	String	FALSE

Parameter details

Treat the after cursor as an opaque value. You can obtain it through the next link relationship. See Pagination .
Search currently performs a startsWith match, but it should be considered an implementation detail and may change without notice in the future.

Response parameters

Array of Identity Provider

List Identity Providers with defaults

Enumerates all IdPs in your organization

Request example

curl -v -X GET \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
"https://${yourOktaDomain}/api/v1/idps?limit=20"

Response example

[
    "id": "0oa62b57p7c8PaGpU0h7",
    "type": "FACEBOOK",
    "name": "Facebook",
    "status": "ACTIVE",
    "created": "2016-03-24T23:18:27.000Z",
    "lastUpdated": "2016-03-24T23:18:27.000Z",
    "protocol": {
      "type": "OAUTH2",
      "endpoints": {
        "authorization": {
          "url": "https://www.facebook.com/dialog/oauth",
          "binding": "HTTP-REDIRECT"
        "token": {
          "url": "https://graph.facebook.com/v2.5/oauth/access_token",
          "binding": "HTTP-POST"
      "scopes": [
        "public_profile",
        "email"
      "credentials": {
        "client": {
          "client_id": "your-client-id",
          "client_secret": "your-client-secret"
    "policy": {
      "provisioning": {
        "action": "AUTO",
        "profileMaster": true,
        "groups": {
          "action": "NONE"
        "conditions": {
          "deprovisioned": {
            "action": "NONE"
          "suspended": {
            "action": "NONE"
      "accountLink": {
        "filter": null,
        "action": "AUTO"
      "subject": {
        "userNameTemplate": {
          "template": "idpuser.userPrincipalName"
        "filter": null,
        "matchType": "USERNAME"
      "mapAMRClaims": false,
      "maxClockSkew": 0
    "_links": {
      "authorize": {
        "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62b57p7c8PaGpU0h7&
            client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
            scope={scopes}&redirect_uri={redirectUri}&state={state}",
        "templated": true,
        "hints": {
          "allow": [
            "GET"
      "clientRedirectUri": {
        "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
        "hints": {
          "allow": [
            "POST"
    "id": "0oa62bc8wppPw0UGr0h7",
    "type": "SAML2",
    "name": "Example SAML IdP",
    "status": "ACTIVE",
    "created": "2016-03-24T23:14:54.000Z",
    "lastUpdated": "2016-03-24T23:14:54.000Z",
    "protocol": {
      "type": "SAML2",
      "endpoints": {
        "sso": {
          "url": "https://idp.example.com",
          "binding": "HTTP-POST",
          "destination": "https://idp.example.com"
        "acs": {
          "binding": "HTTP-POST",
          "type": "INSTANCE"
      "algorithms": {
        "request": {
          "signature": {
            "algorithm": "SHA-256",
            "scope": "REQUEST"
        "response": {
          "signature": {
            "algorithm": "SHA-256",
            "scope": "ANY"
      "settings": {
        "nameFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
      "credentials": {
        "trust": {
          "issuer": "https://idp.example.com",
          "audience": "http://www.okta.com/123",
          "kid": "your-key-id"
    "policy": {
      "provisioning": {
        "action": "AUTO",
        "profileMaster": true,
        "groups": {
          "action": "NONE"
        "conditions": {
          "deprovisioned": {
            "action": "NONE"
          "suspended": {
            "action": "NONE"
      "accountLink": {
        "filter": null,
        "action": "AUTO"
      "subject": {
        "userNameTemplate": {
          "template": "saml.subjectNameId"
        "filter": "(\\S+@example\\.com)",
        "matchType": "USERNAME"
      "mapAMRClaims": false,
      "maxClockSkew": 0
    "_links": {
      "metadata": {
        "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml",
        "type": "application/xml",
        "hints": {
          "allow": [
            "GET"
      "acs": {
        "href": "https://{yourOktaDomain}/sso/saml2/0oa62bc8wppPw0UGr0h7",
        "type": "application/xml",
        "hints": {
          "allow": [
            "POST"
      "users": {
        "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/users",
        "hints": {
          "allow": [
            "GET"
      "deactivate": {
        "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/deactivate",
        "hints": {
          "allow": [
            "POST"
    "id": "0oa62bfdiumsUndnZ0h7",
    "type": "GOOGLE",
    "name": "Google",
    "status": "ACTIVE",
    "created": "2016-03-24T23:21:49.000Z",
    "lastUpdated": "2016-03-24T23:21:49.000Z",
    "protocol": {
      "type": "OIDC",
      "endpoints": {
        "authorization": {
          "url": "https://accounts.google.com/o/oauth2/auth",
          "binding": "HTTP-REDIRECT"
        "token": {
          "url": "https://www.googleapis.com/oauth2/v3/token",
          "binding": "HTTP-POST"
      "scopes": [
        "profile",
        "email",
        "openid"
      "credentials": {
        "client": {
          "client_id": "your-client-id",
          "client_secret": "your-client-secret"
    "policy": {
      "provisioning": {
        "action": "AUTO",
        "profileMaster": true,
        "groups": {
          "action": "NONE"
        "conditions": {
          "deprovisioned": {
            "action": "NONE"
          "suspended": {
            "action": "NONE"
      "accountLink": {
        "filter": null,
        "action": "AUTO"
      "subject": {
        "userNameTemplate": {
          "template": "idpuser.userPrincipalName"
        "filter": null,
        "matchType": "USERNAME"
      "mapAMRClaims": false,
      "maxClockSkew": 0
    "_links": {
      "authorize": {
        "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7&
            client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
            scope={scopes}&redirect_uri={redirectUri}&state={state}",
        "templated": true,
        "hints": {
          "allow": [
            "GET"
      "clientRedirectUri": {
        "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
        "hints": {
          "allow": [
            "POST"
    "id": "0oa62bfdjnK55Z5x80h7",
    "type": "LINKEDIN",
    "name": "LinkedIn",
    "status": "ACTIVE",
    "created": "2016-03-24T23:23:59.000Z",
    "lastUpdated": "2016-03-24T23:23:59.000Z",
    "protocol": {
      "type": "OAUTH2",
      "endpoints": {
        "authorization": {
          "url": "https://www.linkedin.com/uas/oauth2/authorization",
          "binding": "HTTP-REDIRECT"
        "token": {
          "url": "https://www.linkedin.com/uas/oauth2/accessToken",
          "binding": "HTTP-POST"
      "scopes": [
        "r_basicprofile",
        "r_emailaddress"
      "credentials": {
        "client": {
          "client_id": "your-client-id",
          "client_secret": "your-client-secret"
    "policy": {
      "provisioning": {
        "action": "AUTO",
        "profileMaster": true,
        "groups": {
          "action": "NONE"
        "conditions": {
          "deprovisioned": {
            "action": "NONE"
          "suspended": {
            "action": "NONE"
      "accountLink": {
        "filter": null,
        "action": "AUTO"
      "subject": {
        "userNameTemplate": {
          "template": "idpuser.userPrincipalName"
        "filter": null,
        "matchType": "USERNAME"
      "mapAMRClaims": false,
      "maxClockSkew": 0
    "_links": {
      "authorize": {
        "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdjnK55Z5x80h7&
            client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
            scope={scopes}&redirect_uri={redirectUri}&state={state}",
        "templated": true,
        "hints": {
          "allow": [
            "GET"
      "clientRedirectUri": {
        "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
        "hints": {
          "allow": [
            "POST"
    "id": "0oajmvdFawBih4gey0g3",
    "type": "MICROSOFT",
    "name": "Microsoft",
    "status": "ACTIVE",
    "created": "2016-03-29T16:47:36.000Z",
    "lastUpdated": "2016-03-29T16:47:36.000Z",
    "protocol": {
      "type": "OIDC",
      "endpoints": {
        "authorization": {
          "url": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
          "binding": "HTTP-REDIRECT"
        "token": {
          "url": "https://login.microsoftonline.com/common/oauth2/v2.0/token",
          "binding": "HTTP-POST"
      "scopes": [
        "openid",
        "email",
        "profile",
        "https://graph.microsoft.com/User.Read"
      "credentials": {
        "client": {
          "client_id": "your-client-id",
          "client_secret": "your-client-secret"
    "policy": {
      "provisioning": {
        "action": "AUTO",
        "profileMaster": true,
        "groups": {
          "action": "NONE"
        "conditions": {
          "deprovisioned": {
            "action": "NONE"
          "suspended": {
            "action": "NONE"
      "accountLink": {
        "filter": null,
        "action": "AUTO"
      "subject": {
        "userNameTemplate": {
          "template": "idpuser.userPrincipalName"
        "filter": null,
        "matchType": "USERNAME"
      "mapAMRClaims": false,
      "maxClockSkew": 0
    "_links": {
      "authorize": {
        "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oajmvdFawBih4gey0g3&
            client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
            scope={scopes}&redirect_uri={redirectUri}&state={state}",
        "templated": true,
        "hints": {
          "allow": [
            "GET"
      "clientRedirectUri": {
        "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
        "hints": {
          "allow": [
            "POST"
      "id": "0oaulob4BFVa4zQvt0g3",
      "type": "OIDC",
      "name": "Example OpenID Connect IdP",
      "status": "ACTIVE",
      "created": "2019-02-07T20:07:47.000Z",
      "lastUpdated": "2019-02-07T20:07:47.000Z",
      "protocol": {
          "type": "OIDC",
          "endpoints": {
              "authorization": {
                  "url": "https://idp.example.com/authorize",
                  "binding": "HTTP-REDIRECT"
              "token": {
                  "url": "https://idp.example.com/token",
                  "binding": "HTTP-POST"
              "userInfo": {
                  "url": "https://idp.example.com/userinfo",
                  "binding": "HTTP-REDIRECT"
              "jwks": {
                  "url": "https://idp.example.com/keys",
                  "binding": "HTTP-REDIRECT"
          "scopes": [
              "openid"
          "issuer": {
              "url": "https://idp.example.com"
          "credentials": {
              "client": {
                  "client_id": "your-client-id",
                  "client_secret": "your-client-secret"
      "policy": {
          "provisioning": {
              "action": "AUTO",
              "profileMaster": false,
              "groups": {
                  "action": "NONE"
              "conditions": {
                  "deprovisioned": {
                      "action": "NONE"
                  "suspended": {
                      "action": "NONE"
          "accountLink": {
              "filter": null,
              "action": "AUTO"
          "subject": {
              "userNameTemplate": {
                  "template": "idpuser.email"
              "filter": null,
              "matchType": "USERNAME",
              "matchAttribute": null
          "mapAMRClaims": false,
          "maxClockSkew": 0
      "_links": {
          "authorize": {
              "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oaulob4BFVa4zQvt0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}&nonce={nonce}",
              "templated": true,
              "hints": {
                  "allow": [
                      "GET"
          "clientRedirectUri": {
              "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
              "hints": {
                  "allow": [
                      "POST"
  "id": "0oa6jxasyhwM2ZHJh0g4",
  "type": "X509",
  "name": "Smart Card IDP Name",
  "status": "ACTIVE",
  "created": "2020-01-07T00:19:27.000Z",
  "lastUpdated": "2020-01-07T00:19:27.000Z",
  "properties": {
    "additionalAmr": [
      "sc",
      "hwk",
      "pin",
      "mfa",
  "protocol": {
    "type": "MTLS",
    "endpoints": {
      "sso": {
        "url": "https://{yourOktaDomain}.okta.com/login/cert"
    "credentials": {
      "trust": {
        "issuer": "CN=Test Smart Card, OU=Test OU, O=Test O, C=US",
        "audience": null,
        "kid":"45dec5ff-8cdc-48c0-85fe-a4869f1753dc",
        "revocation":"CRL",
        "revocationCacheLifetime":2880
  "policy": {
    "provisioning": {
      "action": "DISABLED",
      "profileMaster": false,
      "groups": null
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.subjectAltNameEmail"
      "filter": null,
      "matchType": "EMAIL",
      "matchAttribute": null
    "mapAMRClaims": false,
    "maxClockSkew":0
  "_links": {
    "deactivate": {
      "href": "https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/lifecycle/deactivate",
      "hints": {
        "allow": [
          "POST"
    "users": {
      "href": "https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/users",
      "hints": {
        "allow": [
          "GET"
    "keys": {
      "href":"https://{yourOktaDomain}.okta.com/api/v1/idps/credentials/keys/45dec5ff-8cdc-48c0-85fe-a4869f1753dc",
      "hints": {
        "allow": [
          "GET"

Find Identity Providers by name

Searches for IdPs by name in your organization

Search currently performs a startsWith match, but it should be considered an implementation detail and may change without notice in the future. Exact matches are returned before partial matches.

Request example

curl -v -X GET \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
"https://${yourOktaDomain}/api/v1/idps?q=Example SAML&limit=10"

Response example

[
    "id": "0oa62bc8wppPw0UGr0h7",
    "type": "SAML2",
    "name": "Example SAML IdP",
    "status": "ACTIVE",
    "created": "2016-03-24T23:14:54.000Z",
    "lastUpdated": "2016-03-24T23:14:54.000Z",
    "protocol": {
      "type": "SAML2",
      "endpoints": {
        "sso": {
          "url": "https://idp.example.com",
          "binding": "HTTP-POST",
          "destination": "https://idp.example.com"
        "acs": {
          "binding": "HTTP-POST",
          "type": "INSTANCE"
      "algorithms": {
        "request": {
          "signature": {
            "algorithm": "SHA-256",
            "scope": "REQUEST"
        "response": {
          "signature": {
            "algorithm": "SHA-256",
            "scope": "ANY"
      "settings": {
        "nameFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
      "credentials": {
        "trust": {
          "issuer": "https://idp.example.com",
          "audience": "http://www.okta.com/123",
          "kid": "your-key-id"
    "policy": {
      "provisioning": {
        "action": "AUTO",
        "profileMaster": true,
        "groups": {
          "action": "NONE"
        "conditions": {
          "deprovisioned": {
            "action": "NONE"
          "suspended": {
            "action": "NONE"
      "accountLink": {
        "filter": null,
        "action": "AUTO"
      "subject": {
        "userNameTemplate": {
          "template": "saml.subjectNameId"
        "filter": "(\\S+@example\\.com)",
        "matchType": "USERNAME"
      "mapAMRClaims": false,
      "maxClockSkew": 0
    "_links": {
      "metadata": {
        "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml",
        "type": "application/xml",
        "hints": {
          "allow": [
            "GET"
      "acs": {
        "href": "https://{yourOktaDomain}/sso/saml2/0oa62bc8wppPw0UGr0h7",
        "type": "application/xml",
        "hints": {
          "allow": [
            "POST"
      "users": {
        "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/users",
        "hints": {
          "allow": [
            "GET"
      "deactivate": {
        "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/deactivate",
        "hints": {
          "allow": [
            "POST"

Find Identity Providers by type

Finds all IdPs with a specific type

Request example

curl -v -X GET \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
"https://${yourOktaDomain}/api/v1/idps?type=SAML2"

Response example

[
    "id": "0oa62bc8wppPw0UGr0h7",
    "type": "SAML2",
    "name": "Example SAML IdP",
    "status": "ACTIVE",
    "created": "2016-03-24T23:14:54.000Z",
    "lastUpdated": "2016-03-24T23:14:54.000Z",
    "protocol": {
      "type": "SAML2",
      "endpoints": {
        "sso": {
          "url": "https://idp.example.com",
          "binding": "HTTP-POST",
          "destination": "https://idp.example.com"
        "acs": {
          "binding": "HTTP-POST",
          "type": "INSTANCE"
      "algorithms": {
        "request": {
          "signature": {
            "algorithm": "SHA-256",
            "scope": "REQUEST"
        "response": {
          "signature": {
            "algorithm": "SHA-256",
            "scope": "ANY"
      "settings": {
        "nameFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
      "credentials": {
        "trust": {
          "issuer": "https://idp.example.com",
          "audience": "http://www.okta.com/123",
          "kid": "your-key-id"
    "policy": {
      "provisioning": {
        "action": "AUTO",
        "profileMaster": true,
        "groups": {
          "action": "NONE"
        "conditions": {
          "deprovisioned": {
            "action": "NONE"
          "suspended": {
            "action": "NONE"
      "accountLink": {
        "filter": null,
        "action": "AUTO"
      "subject": {
        "userNameTemplate": {
          "template": "saml.subjectNameId"
        "filter": "(\\S+@example\\.com)",
        "matchType": "USERNAME"
      "mapAMRClaims": false,
      "maxClockSkew": 0
    "_links": {
      "metadata": {
        "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml",
        "type": "application/xml",
        "hints": {
          "allow": [
            "GET"
      "acs": {
        "href": "https://{yourOktaDomain}/sso/saml2/0oa62bc8wppPw0UGr0h7",
        "type": "application/xml",
        "hints": {
          "allow": [
            "POST"
      "users": {
        "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/users",
        "hints": {
          "allow": [
            "GET"
      "deactivate": {
        "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/deactivate",
        "hints": {
          "allow": [
            "POST"

Update Identity Provider

/api/v1/idps/ ${idpId}

Updates the configuration for an IdP

Request parameters

Parameter	Description	Param Type	DataType	Required
id	`id` of the IdP to update	URL	String	TRUE
idp	Updated configuration for the IdP	Body	Identity Provider	TRUE

All properties must be specified when updating the IdP configuration. Partial updates aren't supported.

Response parameters

Updated Identity Provider

Request example

curl -v -X PUT \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
-d '{
}' "https://${yourOktaDomain}/api/v1/idps/${yourIdpId}"

Response example

{
  "id": "0oa62bc8wppPw0UGr0h7",
  "type": "SAML2",
  "name": "Example SAML IdP",
  "status": "INACTIVE",
  "created": null,
  "lastUpdated": "2016-03-29T21:23:45.000Z",
  "protocol": {
    "type": "SAML2",
    "endpoints": {
      "sso": {
        "url": "https://idp.example.com/saml2/sso",
        "binding": "HTTP-REDIRECT",
        "destination": "https://idp.example.com/saml2/sso"
      "acs": {
        "binding": "HTTP-POST",
        "type": "INSTANCE"
    "algorithms": {
      "request": {
        "signature": {
          "algorithm": "SHA-256",
          "scope": "REQUEST"
      "response": {
        "signature": {
          "algorithm": "SHA-256",
          "scope": "ANY"
    "settings": {
      "nameFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
    "credentials": {
      "trust": {
        "issuer": "https://idp.example.com",
        "audience": "https://www.okta.com/saml2/service-provider/spCQJRNaaxs7ANqKBO7M",
        "kid": "your-key-id"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.subjectNameId"
      "filter": null,
      "matchType": "USERNAME"
    "mapAMRClaims": false,
    "maxClockSkew": 120000
  "_links": {
    "metadata": {
      "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml",
      "type": "application/xml",
      "hints": {
        "allow": [
          "GET"
    "acs": {
      "href": "https://{yourOktaDomain}/sso/saml2/0oa62bc8wppPw0UGr0h7",
      "type": "application/xml",
      "hints": {
        "allow": [
          "POST"
    "users": {
      "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/users",
      "hints": {
        "allow": [
          "GET"
    "activate": {
      "href": "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/activate",
      "hints": {
        "allow": [
          "POST"

Delete Identity Provider

DELETE /api/v1/idps/ ${idpId}

Removes an IdP from your organization

All existing IdP users are unlinked with the highest order profile source taking precedence for each IdP user.
Unlinked users keep their existing authentication provider such as FEDERATION or SOCIAL .

Request parameters

Parameter	Description	Param Type	Data Type	Required
idpId	`id` of the IdP to delete	URL	String	TRUE

Response parameters

There are no response parameters.

Request example

curl -v -X DELETE \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
-d '{
}' "https://${yourOktaDomain}/api/v1/idps/${yourIdpId}"

Response example

HTTP/1.1 204 No Content

Identity Provider lifecycle operations

Activate Identity Provider

/api/v1/idps/ ${idpId} /lifecycle/activate

Activates an inactive IdP

Request parameters

Parameter	Description	Param Type	DataType	Required
idpId	`id` of IdP to activate	URL	String	TRUE

Response parameters

Activated Identity Provider

Request example

curl -v -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
-d '{
}' "https://${yourOktaDomain}/api/v1/idps/${yourIdpId}/lifecycle/activate"

Response example

{
  "id": "0oa62bfdiumsUndnZ0h7",
  "type": "GOOGLE",
  "name": "Google",
  "status": "ACTIVE",
  "created": "2016-03-24T23:21:49.000Z",
  "lastUpdated": "2016-03-25T19:14:23.000Z",
  "protocol": {
    "type": "OIDC",
    "endpoints": {
      "authorization": {
        "url": "https://accounts.google.com/o/oauth2/auth",
        "binding": "HTTP-REDIRECT"
      "token": {
        "url": "https://www.googleapis.com/oauth2/v3/token",
        "binding": "HTTP-POST"
    "scopes": [
      "profile",
      "email",
      "openid"
    "credentials": {
      "client": {
        "client_id": "your-client-id",
        "client_secret": "your-client-secret"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.email"
      "filter": null,
      "matchType": "USERNAME"
    "mapAMRClaims": false,
    "maxClockSkew": 0
  "_links": {
    "authorize": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7&
          client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
          scope={scopes}&redirect_uri={redirectUri}&state={state}",
      "templated": true,
      "hints": {
        "allow": [
          "GET"
    "clientRedirectUri": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
      "hints": {
        "allow": [
          "POST"

Deactivate Identity Provider

/api/v1/idps/ ${idpId} /lifecycle/deactivate

Deactivates an active IdP

Request parameters

Parameter	Description	Param Type	DataType	Required
idpId	`id` of IdP to deactivate	URL	String	TRUE

Response parameters

Deactivated Identity Provider

Request example

curl -v -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "User-Agent: Mozilla/5.0 (${systemInformation}) ${platform} (${platformDetails}) ${extensions}" \
-H "Authorization: SSWS ${api_token}" \
-d '{
}' "https://${yourOktaDomain}/api/v1/idps/${yourIdpId}/lifecycle/deactivate"

Response example

{
  "id": "0oa62bfdiumsUndnZ0h7",
  "type": "GOOGLE",
  "name": "Google",
  "status": "INACTIVE",
  "created": "2016-03-24T23:21:49.000Z",
  "lastUpdated": "2016-03-25T19:16:53.000Z",
  "protocol": {
    "type": "OIDC",
    "endpoints": {
      "authorization": {
        "url": "https://accounts.google.com/o/oauth2/auth",
        "binding": "HTTP-REDIRECT"
      "token": {
        "url": "https://www.googleapis.com/oauth2/v3/token",
        "binding": "HTTP-POST"
    "scopes": [
      "profile",
      "email",
      "openid"
    "credentials": {
      "client": {
        "client_id": "your-client-id",
        "client_secret": "your-client-secret"
  "policy": {
    "provisioning": {
      "action": "AUTO",
      "profileMaster": true,
      "groups": {
        "action": "NONE"
      "conditions": {
        "deprovisioned": {
          "action": "NONE"
        "suspended": {
          "action": "NONE"
    "accountLink": {
      "filter": null,
      "action": "AUTO"
    "subject": {
      "userNameTemplate": {
        "template": "idpuser.userPrincipalName"
      "filter": null,
      "matchType": "USERNAME"
    "mapAMRClaims": false,
    "maxClockSkew": 0
  "_links": {
    "authorize": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7&
      client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
      scope={scopes}&redirect_uri={redirectUri}&state={state}",
      "templated": true,
      "hints": {
        "allow": [
          "GET"
    "clientRedirectUri": {
      "href": "https://{yourOktaDomain}/oauth2/v1/authorize/callback",
      "hints": {
        "allow": [
          "POST"

Identity Provider Transaction operations

Note: This is a

Type	Description	Corresponding protocol	Corresponding protocol scopes
`AMAZON`	Amazon (opens new window) as the Identity Provider	OpenID Connect	`profile` , `profile:user_id`
`APPLE`	Apple (opens new window) as the Identity Provider	OpenID Connect	`names` , `email` , `openid`
`DISCORD`	Discord (opens new window) as the Identity Provider	OAuth 2.0	`identify` , `email`
`FACEBOOK`	Facebook (opens new window) as the Identity Provider	OAuth 2.0	`public_profile` , `email`
`GITHUB`	GitHub (opens new window) as the Identity Provider	OAuth 2.0	`user`
`GITLAB`	GitLab (opens new window) as the Identity Provider	OpenID Connect	`openid` , `read_user` , `profile` , `email`
`GOOGLE`	Google (opens new window) as the Identity Provider	OpenID Connect	`openid` , `email` , `profile`
`LINKEDIN`	LinkedIn (opens new window) as the Identity Provider	OAuth 2.0	`r_emailaddress` , `r_liteprofile`
`LOGINGOV`	Login.gov (opens new window) as the Identity Provider	OpenID Connect	`email` , `profile` , `profile:name`
`LOGINGOV_SANDBOX`	Login.gov's identity sandbox (opens new window) as the Identity Provider	OpenID Connect	`email` , `profile` , `profile:name`
`MICROSOFT`	Microsoft Enterprise SSO (opens new window) as the Identity Provider	OpenID Connect	`openid` , `email` , `profile` , `https://graph.microsoft.com/User.Read`
`OIDC`	IdP provider that supports OpenID Connect (opens new window)	OpenID Connect	`openid` , `email` , `profile`
`PAYPAL`	Paypal (opens new window) as the Identity Provider	OpenID Connect	`openid` , `email` , `profile`
`PAYPAL_SANDBOX`	Paypal Sandbox (opens new window) as the Identity Provider	OpenID Connect	`openid` , `email` , `profile`
`SALESFORCE`	SalesForce (opens new window) as the Identity Provider	OAuth 2.0	`id` , `email` , `profile`
`SAML2`	Enterprise IdP provider that supports the SAML 2.0 Web Browser SSO Profile (opens new window)	SAML 2.0
`SPOTIFY`	Spotify (opens new window) as the Identity Provider	OpenID Connect	`user-read-email` , `user-read-private`
`X509`	Smart Card IdP (opens new window)	Mutual TLS
`XERO`	Xero (opens new window) as the Identity Provider	OpenID Connect	`openid` , `profile` , `email`
`YAHOO`	Yahoo (opens new window) as the Identity Provider	OpenID Connect	`openid` , `profile` , `email`
`YAHOOJP`	Yahoo Japan (opens new window) as the Identity Provider	OpenID Connect	`openid` , `profile` , `email`

Property	Description	DataType	Applies to IdP type
additionalAmr	The additional Assurance Methods References (AMR) values for Smart Card IdPs. Supported values: `sc` (smart card), `hwk` (hardware-secured key), `pin` (personal identification number), and `mfa` (multifactor authentication)	Array of strings	`X509`
ialValue	The type of identity verification (opens new window) (IAL) value for the Login.gov IdP. See Add a Login.gov IdP .	String	`LOGINGOV` , `LOGINGOV_SANDBOX`
aalValue	The authentication assurance level (opens new window) (AAL) value for the Login.gov IdP. See Add a Login.gov IdP .	String	`LOGINGOV` , `LOGINGOV_SANDBOX`

Property	Description	DataType	Nullable	Readonly	MinLength	MaxLength	Validation
binding	HTTP binding used to send an `<AuthnRequest>` message to the IdP	`HTTP-POST` or `HTTP-Redirect`	FALSE	FALSE
destination	URI reference that indicates the address to which the `<AuthnRequest>` message is sent	String	TRUE	FALSE	1	512
url	URL of the binding-specific endpoint to send an `<AuthnRequest>` message to the IdP	String	FALSE	FALSE	11	1014	RFC 3986 (opens new window)

Property	Description	DataType	Nullable	Readonly	MinLength	MaxLength
client_id	Unique identifier (opens new window) issued by the AS for the Okta IdP instance	String	FALSE	FALSE	1	1024
client_secret	Client secret issued (opens new window) by the AS for the Okta IdP instance	String	TRUE (Only Nullable for Apple IdP)	FALSE	1	1024
token_endpoint_auth_method	Client authentication methods supported by the token endpoint. Methods supported: `private_key_jwt`	String	TRUE	FALSE	1	1024

IdP Type	User Provisioning Actions	Group Provisioning Actions	Account Link Actions	Account Link Filters
`SAML2`	`AUTO` or `DISABLED`	`NONE` , `ASSIGN` , `APPEND` , or `SYNC`	`AUTO` , `DISABLED`	`groups`
`X509`	`DISABLED`	No support for JIT provisioning
[all social IdP types *]	`AUTO` , `DISABLED`	`NONE` or `ASSIGN`	`AUTO` , `DISABLED`	`groups`

Parameter	Description	Param Type	DataType	Required	Default
profile	profile for the Okta User	Body	Okta User Profile object	FALSE	UD transformed Okta user profile
transactionId	`id` of an IdP Transaction	URL	String	TRUE

Parameter	Description	Param Type	DataType	Required	Default
limit	Specifies the number of key results on a page	Query	Number	FALSE	20
after	Specifies the pagination cursor for the next page of keys	Query	String	FALSE

Parameter	Description	Param Type	DataType	Required
idpId	`id` of the IdP	URL	String	TRUE
validityYears	expiry of the IdP Key Credential	Query	Number	TRUE

Parameter	Description	Param Type	DataType	Required
idpId	`id` of the source IdP	URL	String	TRUE
kid	Unique key of IdP Key Credential	URL	String	TRUE
targetIdPId	`id` of the target IdP	Query	String	TRUE

Parameter	Description	Param Type	DataType	Required
certificate	The signed X.509 certificate	Body	X.509 certificate in `DER` , `PEM` or `CER` format	TRUE
csrModelId	`id` of the CSR object	URL	String	TRUE
idpId	`id` of the IdP	URL	String	TRUE

Parameter	Description	Param Type	DataType	Required
csrModelId	`id` of CSR object	URL	String	TRUE
idpId	`id` of the IdP	URL	String	TRUE

Parameter	Description	Param Type	DataType	Required
idpId	`id` of IdP to search	URL	String	TRUE
q	`query` or search term for user	URL or body	String	FALSE
after	Cursor of the query	URL or body	String	FALSE
limit	Max number of users to show	URL or body	String	FALSE
expand	Expand user data	URL or body	String	FALSE

Parameter	Description	Param Type	DataType	Required
idpId	ID of the Identity Provider	URL	String	TRUE
userId	`id` of a User	URL	String	TRUE

Parameter	Description	Param Type	DataType	Required
externalId	unique IdP-specific identifier for a User	Body	String	TRUE
idpId	`id` of the IdP	URL	String	TRUE
userId	`id` of a User	URL	String	TRUE

Property	Description	DataType	Nullable	Unique	Readonly	MinLength	MaxLength
_embedded	Embedded resources related to the IdP	JSON HAL (opens new window)	TRUE	FALSE	TRUE
_links	Discoverable resources related to the IdP	JSON HAL (opens new window)	TRUE	FALSE	TRUE
created	Timestamp when the IdP was created	Date	FALSE	FALSE	TRUE
id	Unique key for the IdP	String	FALSE	TRUE	TRUE
issuerMode	Indicates whether Okta uses the original Okta org domain URL or a custom domain URL in the request to the social IdP	`ORG_URL` , `CUSTOM_URL` , or `DYNAMIC`	FALSE	FALSE	FALSE
lastUpdated	Timestamp when the IdP was last updated	Date	FALSE	FALSE	TRUE
name	Unique name for the IdP	String	FALSE	TRUE	FALSE	1	100
policy	Policy settings for IdP `type`	Policy object	FALSE	FALSE	FALSE
protocol	Protocol settings for IdP `type`	Protocol object	FALSE	FALSE	FALSE
status	Status of the IdP	`ACTIVE` or `INACTIVE`	FALSE	FALSE	TRUE
type	Type of IdP	Identity Provider Type	FALSE	FALSE	FALSE
properties	Properties specific to the type of IdP	Identity Provider Properties	TRUE	FALSE	FALSE

Property	Description	DataType	Nullable	Readonly
algorithms	Settings for signing and verifying SAML messages	SAML 2.0 Algorithms object	FALSE	FALSE
credentials	Federation trust credentials for verifying assertions from the IdP	SAML 2.0 Credentials object	FALSE	FALSE
endpoints	SAML 2.0 HTTP binding settings for IdP and SP (Okta)	SAML 2.0 Endpoints object	FALSE	FALSE
relayState	Relay state settings for IdP	SAML 2.0 Relay State object	TRUE	FALSE
settings	Advanced settings for the SAML 2.0 protocol	SAML 2.0 Settings object	TRUE	FALSE
type	SAML 2.0 protocol	`SAML2`	FALSE	TRUE

Property	Description	DataType	Nullable	Readonly
acs	Okta's `SPSSODescriptor` endpoint where the IdP sends a `<SAMLResponse>` message	Assertion Consumer Service (ACS) Endpoint object	FALSE	FALSE
sso	IdP's `SingleSignOnService` endpoint where Okta sends an `<AuthnRequest>` message	Single Sign-On (SSO) Endpoint object	FALSE	FALSE

Property	Description	DataType	Nullable	Readonly	Default
binding	HTTP binding used to receive a `<SAMLResponse>` message from the IdP	`HTTP-POST`	TRUE	FALSE	`HTTP-POST`
type	Determines whether to publish an instance-specific (trust) or organization (shared) ACS endpoint in the SAML metadata	`INSTANCE` or `ORG`	TRUE	FALSE	`INSTANCE`

Property	Description	DataType	Nullable	Readonly
request	Algorithm settings used to secure an `<AuthnRequest>` message	SAML 2.0 Request Algorithm object	FALSE	FALSE
response	Algorithm settings used to verify a `<SAMLResponse>` message	SAML 2.0 Response Algorithm object	FALSE	FALSE

Property	Description	DataType	Nullable	Readonly
algorithm	The XML digital Signature Algorithm used when signing an `<AuthnRequest>` message	`SHA-1` or `SHA-256`	FALSE	FALSE
scope	Specifies whether to digitally sign `<AuthnRequest>` messages to the IdP	`REQUEST` or `NONE`	FALSE	FALSE

Property	Description	DataType	Nullable	Readonly
algorithm	The minimum XML digital Signature Algorithm allowed when verifying a `<SAMLResponse>` message or `<Assertion>` element	`SHA-1` or `SHA-256`	FALSE	FALSE
scope	Specifies whether to verify a `<SAMLResponse>` message or `<Assertion>` element XML digital signature	`RESPONSE` , `ASSERTION` , `ANY`	FALSE	FALSE

Property	Description	DataType	Nullable	Readonly
signing	Key used for signing requests to the IdP	SAML 2.0 Signing Credentials object	TRUE	FALSE
trust	Object that contains information for verifying assertions from the IdP	SAML 2.0 Trust Credentials object	FALSE	FALSE

Property	Description	DataType	Nullable	Readonly	MinLength	MaxLength	Validation
audience	URI that identifies the target Okta IdP instance (SP) for an `<Assertion>`	String	FALSE	FALSE	1	1024	URI (opens new window)
issuer	URI that identifies the issuer (IdP) of a SAML `<SAMLResponse>` message `<Assertion>` element	String	FALSE	FALSE	1	1024	URI (opens new window)
kid	Key ID reference to the IdP's X.509 signature certificate	String	FALSE	FALSE	36	36	Valid IdP Key ID reference

Property	Description	DataType	Nullable	Readonly	MinLength
credentials	Client authentication credentials for an OAuth 2.0 Authorization Server (opens new window)	Credentials object	FALSE	FALSE
endpoints	Endpoint settings for the OAuth 2.0 Authorization Server	OAuth 2.0 Endpoints object	TRUE	TRUE
scopes	IdP-defined permission bundles to request delegated access from the User	Array of String	FALSE	FALSE	1
type	OAuth 2.0 Authorization Code flow (opens new window)	`OAUTH2`	FALSE	TRUE

Property	Description	DataType	Nullable	Readonly	MinLength
algorithms	Settings for signing authorization requests	OIDC Algorithms object	TRUE	FALSE
credentials	Client authentication credentials for an OAuth 2.0 Authorization Server (opens new window)	Credentials object	FALSE	FALSE
endpoints	Endpoint settings for the OAuth 2.0 Authorization Server	OAuth 2.0 Endpoints object	TRUE	TRUE
scopes	OpenID Connect and IdP-defined permission bundles to request delegated access from the User	Array of String	FALSE	FALSE	1
type	OpenID Connect Authorization Code flow (opens new window)	`OIDC`	FALSE	TRUE

Identity Providers API

Get started

Identity Provider operations

Add Identity Provider

Request parameters

Response parameters

Request examples

Add Generic OpenID Connect Identity Provider

Request example

Response example

Add SAML 2.0 Identity Provider

Request example

Response example

Redirect with SAML deep links

Add Apple Identity Provider

Request example

Response example

Add Facebook Identity Provider

Request example

Response example

Add Google Identity Provider

Request example

Response example

Add LinkedIn Identity Provider

Request example

Response example

Add Microsoft Identity Provider

Request example

Response example

Add Smart Card Identity Provider

Request example

Response example

Get Identity Provider

Request parameters

Response parameters

Request example

Response example

List Identity Providers

Request parameters

Response parameters

List Identity Providers with defaults

Request example

Response example

Find Identity Providers by name

Request example

Response example

Find Identity Providers by type

Request example

Response example

Update Identity Provider

Request parameters

Response parameters

Request example

Response example

Delete Identity Provider

Request parameters

Response parameters

Request example

Response example

Identity Provider lifecycle operations

Activate Identity Provider

Request parameters

Response parameters

Request example

Response example

Deactivate Identity Provider

Request parameters

Response parameters

Request example

Response example

Identity Provider Transaction operations

Get Identity Provider Transaction

Request parameters

Response parameters

Request example

Response example

Get source IdP User for IdP Transaction

Request parameters

Response parameters

Request example

Property	Description	DataType	Nullable	Readonly
algorithm	The Signature Algorithm used when signing an authorization request	`HS256` , `HS384` , `HS512` , `RS256` , `RS384` , or `RS512`	FALSE	FALSE
scope	Specifies whether to digitally sign an authorization request to the IdP	`REQUEST` or `NONE`	FALSE	FALSE

Property	Description	DataType	Nullable	Readonly
authorization	IdP Authorization Server (AS) endpoint to request consent from the User and obtain an authorization code grant	OAuth 2.0 Authorization Server Authorization Endpoint object	TRUE	TRUE
jwks	Endpoint where the signer of the keys publishes its keys in a JWK Set	OpenID Connect JWKs Endpoint object	TRUE	TRUE
token	IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token	OAuth 2.0 Authorization Server Token Endpoint object	TRUE	TRUE
userInfo	Protected resource endpoint that returns claims about the authenticated User	OpenID Connect Userinfo Endpoint object	TRUE	TRUE

Property	Description	DataType	Nullable	Readonly	Validation
kid	IdP Key Credential reference to the Okta X.509 signature certificate.	String	TRUE	FALSE	Valid Signing Key ID reference
alg	The algorithm used when generating the JWT from the private key for token endpoint authentication.	`RS256` , `RS384` , `RS512`	FALSE	FALSE	Valid date type

Property	Description	DataType	Nullable	Readonly	MinLength	MaxLength
privateKey	The PKCS #8 encoded private key that you created for the client and downloaded from Apple	String	TRUE	FALSE	1	1024
kid	The Key ID that you obtained from Apple when you created the private key for the client	String	FALSE	FALSE	1	1024
teamId	The Team ID associated with your Apple developer account	String	FALSE	FALSE	1	1024

Property	Description	DataType	Nullable	Readonly
credentials	Description of the issuing cert	MTLS Credentials Object	FALSE	FALSE
endpoints	Location of authentication endpoint	MTLS Endpoints Object	FALSE	FALSE
type	The only supported value is `MTLS`	String	FALSE	TRUE

Property	Description	DataType	Nullable	Readonly	MinLength	MaxLength	Validation
audience	not used	String	TRUE	FALSE	1	1024	URI (opens new window)
issuer	Description of the certificate issuer	String	FALSE	FALSE	1	1024
kid	Key ID reference to the IdP's X.509 signature certificate	String	FALSE	FALSE	36	36	Valid IdP Key ID reference
revocation	Mechanism to validate the certificate	String	FALSE	FALSE	36	36	CRL
revocationCacheLifetime	Time in minutes to cache the certificate revocation information	Number	FALSE	FALSE	1	4320	from 1 minute to 72 hours

Property	Description	DataType	Nullable	Readonly	Default
accountLink	Policy rules to link an IdP User to an existing Okta User	Account Link Policy object	FALSE	FALSE
mapAMRClaims	Determines whether the IdP should map AMR claims from the IdP to the Okta session	Boolean	TRUE	FALSE	FALSE
maxClockSkew	Maximum allowable clock skew when processing messages from the IdP	Number	FALSE	FALSE
provisioning	Policy rules to just-in-time (JIT) provision an IdP User as a new Okta User	Provisioning Policy object	FALSE	FALSE
subject	Policy rules to select the Okta sign-in identifier for the IdP User and determine matching rules	Subject Policy object	FALSE	FALSE

Property	Description	DataType	Nullable	Readonly
action	Provisioning action for an IdP User during authentication	User Provisioning Action Type	FALSE	FALSE
callout	Webhook settings for the `CALLOUT` action	Callout object	TRUE	FALSE
conditions	Conditional behaviors for an IdP User during authentication	Provisioning Conditions object	FALSE	FALSE
groups	Provisioning settings for a User's Group memberships	Group Provisioning Policy object	FALSE	FALSE
profileMaster	Determines if the IdP should act as a source of truth for User profile attributes	Boolean	FALSE	FALSE

Action Type	Description
`AUTO`	The IdP User profile is transformed through defined universal directory profile mappings to an Okta User profile and automatically provisioned as an Okta User.
`CALLOUT`	Okta calls out to an external web service during authentication to validate the IdP User profile, determine whether to provision a new Okta User, and define the resulting Okta User profile.
`DISABLED`	Okta rejects the authentication request and skips provisioning of a new Okta User if the IdP User isn't linked to an existing Okta User.

Property	Description	DataType	Nullable	Readonly	MinLength	MaxLength
action	Provisioning action for the IdP User's Group memberships	Group Provisioning Action Type	FALSE	FALSE
assignments	List of `OKTA_GROUP` Group identifiers to add an IdP User as a member with the `ASSIGN` action	Array of String ( `OKTA_GROUP` IDs)	TRUE	FALSE
filter	Allowlist of `OKTA_GROUP` Group identifiers for the `APPEND` or `SYNC` provisioning action	Array of String ( `OKTA_GROUP` IDs)	TRUE	FALSE
sourceAttributeName	IdP User profile attribute name (case-insensitive) for an array value that contains Group memberships	String	TRUE	FALSE	0	1024