Configured providers — **metadata only**, never the client secret.

GET

/api/v1/settings/oidc

curl --request GET \
  --url https://example.com/api/v1/settings/oidc \
  --header 'Authorization: Bearer <token>'

Authorizations

• bearer

Responses

200

Every configured provider, without its client secret

Media typeapplication/json

Array<object>

Provider metadata for the admin API — never includes the client_secret.

object

client_id

required

string

default_role

string | null

enabled

required

boolean

groups_claim

required

string

has_secret

required

True once a client_secret has been stored (so the UI can show “set” without revealing it).

boolean

id

required

string format: uuid

issuer

required

string

kind

required

Which IdP product this provider was configured for.

string

Allowed values: entra okta google generic

name

required

string

redirect_uri

required

string

role_map

required

object

key

additional properties

string

scopes

required

string

Example

[
  {
    "kind": "entra"
  }
]

401

No valid bearer token

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Role lacks the ManageUsers permission

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

503

This deployment does not persist SSO configuration

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}