SsoProvider
A sanitized SSO provider. Secrets (client secret, oidcConfig) are never returned.
- disableType: boolean
Implicit Signup requiredPer-provider implicit-sign-up gate, surfaced on read so the edit UI can reflect the stored value. A partial update that omits disableImplicitSignUp preserves this; only send it when the toggle actually changes.
- domainType: stringrequired
- domainType: boolean
Verified required - enabledType: booleanrequired
- entityType: stringFormat: uuid
Id required - idType: stringFormat: uuidrequired
- protocolType: "oidc" or "saml"enumrequired
- providerType: string
Id requiredCaller-supplied unique identifier used in the OIDC callback path
- clientType: stringnullable
Id Last Four Always null on read — client_id lives inside the encrypted config and is never surfaced
- createdType: stringFormat: date-time
At the date-time notation as defined by RFC 3339, section 5.6, for example, 2017-07-21T17:32:28Z
- createdType: string
By - issuerType: stringnullable
- labelType: stringnullable
- setupType:
Values Properties: 6Derived IdP-setup surface. Present only on the single-provider detail read (GET /v1/sso/{id}) for SAML providers; null for OIDC and absent on list responses. Computed per-request from providerId + baseURL and the public fields of the stored config — no secrets, nothing stored.
- updatedType: stringFormat: date-time
At the date-time notation as defined by RFC 3339, section 5.6, for example, 2017-07-21T17:32:28Z
- updatedType: stringnullable
By
.png)