Providers

API Reference

Zones

Providers

List providers

client.zones.providers.list(, ?, ?): ProviderListResponse { items, page_info, pagination }

GET/zones/{zoneId}/providers

Create provider

client.zones.providers.create(, , ?): Provider { id, created_at, identifier, 12 more }

POST/zones/{zoneId}/providers

Get provider

client.zones.providers.retrieve(, , ?): Provider { id, created_at, identifier, 12 more }

GET/zones/{zoneId}/providers/{id}

Update provider

client.zones.providers.update(, , ?): Provider { id, created_at, identifier, 12 more }

PATCH/zones/{zoneId}/providers/{id}

Delete provider

client.zones.providers.delete(, , ?): void

DELETE/zones/{zoneId}/providers/{id}

Validate provider connection

client.zones.providers.validate(, , ?): ValidationResult { checks, provider_id, status, validated_at }

POST/zones/{zoneId}/providers/{id}/validate

ModelsExpand Collapse

Provider { id, created_at, identifier, 12 more }

A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.

id: string

Unique identifier of the provider

created_at: string

Entity creation timestamp

formatdate-time

identifier: string

User specified identifier, unique within the zone

minLength1

maxLength2048

name: string

Human-readable name

minLength1

maxLength255

organization_id: string

Organization that owns this provider

owner_type: "platform" | "customer"

Who owns this provider. Platform-owned providers cannot be modified via API.

Accepts one of the following:

"platform"

"customer"

slug: string

URL-safe identifier, unique within the zone

minLength1

maxLength63

updated_at: string

Entity update timestamp

formatdate-time

zone_id: string

Zone this provider belongs to

client_id?: string | null

OAuth 2.0 client identifier

client_secret_set?: boolean

Indicates whether a client secret is configured

description?: string | null

Human-readable description

maxLength2048

metadata?: Metadata | null

Provider metadata

icon_url?: string

Icon URL

formaturi

maxLength2048

protocols?: Protocols | null

Protocol-specific configuration

oauth2?: Oauth2 | null

OAuth 2.0 protocol configuration

issuer: string

OIDC issuer URL used for discovery and token validation.

formaturi

authorization_endpoint?: string | null

formaturi

authorization_parameters?: Record<string, string> | null

Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).

authorization_resource_enabled?: boolean | null

Whether to include the resource parameter in authorization requests.

authorization_resource_parameter?: string | null

The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.

code_challenge_methods_supported?: Array<string> | null

jwks_uri?: string | null

formaturi

registration_endpoint?: string | null

formaturi

scope_parameter?: string | null

The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".

scope_separator?: string | null

The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".

scopes_supported?: Array<string> | null

token_endpoint?: string | null

formaturi

token_response_access_token_pointer?: string | null

Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".

openid?: Openid | null

OpenID Connect protocol configuration

external_id_claim?: string | null

Name of the OIDC claim carrying the stable external id used to correlate logins with externally provisioned (SCIM) users. Defaults to "sub". Set to "oid" for Entra, whose pairwise "sub" differs from the SCIM externalId.

scopes?: Array<string> | null

Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).

single_logout_enabled?: boolean | null

When true, logging out of the zone propagates the logout to this provider's end_session_endpoint (RP-initiated logout). Defaults to false.

user_identifier_claim?: string | null

Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.

userinfo_endpoint?: string | null

formaturi

type?: "external" | "keycard-vault" | "keycard-sts"

Accepts one of the following:

"external"

"keycard-vault"

"keycard-sts"

ValidationResult { checks, provider_id, status, validated_at }

Result of running the provider OIDC connection checks on demand. Not persisted.

checks: Array<Check>

Per-check results, in execution order

check: "issuer_reachability" | "metadata_retrieval" | "endpoint_consistency" | 2 more

Identifier of an individual provider validation check

Accepts one of the following:

"issuer_reachability"

"metadata_retrieval"

"endpoint_consistency"

"authorization_endpoint_reachability"

"credential_exchange"

status: "pass" | "fail" | "skipped_with_reason" | "not_applicable"

Outcome of a single check. pass/fail mean the check ran. skipped_with_reason means it could not run because a prerequisite is missing on our side (e.g. no credential stored). not_applicable means the check does not apply to this provider class (e.g. a login-flow-only provider that does not advertise the client_credentials grant) — render as a neutral state, distinct from a failure. Neither skipped_with_reason nor not_applicable fails the overall run.

Accepts one of the following:

"pass"

"fail"

"skipped_with_reason"

"not_applicable"

detail?: string

Human-readable explanation, present on fail, skipped_with_reason, and not_applicable.

provider_id: string

Provider that was validated

status: "pass" | "fail"

Overall outcome. fail when any individual check failed; skipped checks do not fail the run.

Accepts one of the following:

"pass"

"fail"

validated_at: string

When the validation run completed

formatdate-time