Infisical OIDC SSO API
The OIDC SSO API from Infisical — 1 operation(s) for oidc sso.
OpenAPI Specification
openapi: 3.0.3
info:
title: Infisical Admin OIDC SSO API
description: List of all available APIs that can be consumed
version: 0.0.1
servers:
- url: https://us.infisical.com
description: Production server (US)
- url: https://eu.infisical.com
description: Production server (EU)
- url: http://localhost:8080
description: Local server
tags:
- name: OIDC SSO
paths:
/api/v1/sso/oidc/config:
get:
tags:
- OIDC SSO
description: Get OIDC config
parameters:
- schema:
type: string
in: query
name: organizationId
required: true
description: The ID of the organization to get the OIDC config for.
security:
- bearerAuth: []
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
id:
type: string
format: uuid
issuer:
type: string
nullable: true
authorizationEndpoint:
type: string
nullable: true
jwksUri:
type: string
nullable: true
tokenEndpoint:
type: string
nullable: true
userinfoEndpoint:
type: string
nullable: true
configurationType:
type: string
discoveryURL:
type: string
nullable: true
isActive:
type: boolean
orgId:
type: string
format: uuid
allowedEmailDomains:
type: string
nullable: true
manageGroupMemberships:
type: boolean
default: false
jwtSignatureAlgorithm:
type: string
default: RS256
clientId:
type: string
clientSecret:
type: string
required:
- id
- configurationType
- isActive
- orgId
- clientId
- clientSecret
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
patch:
tags:
- OIDC SSO
description: Update OIDC config
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
allowedEmailDomains:
type: string
default: ''
description: 'A list of allowed email domains that users can use to authenticate with. This field is comma separated. Supports wildcards (e.g. *.example.com). Example: ''example.com, *.acme.com'''
discoveryURL:
type: string
description: The URL of the OIDC discovery endpoint.
configurationType:
type: string
enum:
- custom
- discoveryURL
description: The configuration type to use for the OIDC configuration.
issuer:
type: string
description: The issuer for the OIDC configuration. This is only supported when the OIDC configuration type is set to 'custom'.
authorizationEndpoint:
type: string
description: The endpoint to use for OIDC authorization. This is only supported when the OIDC configuration type is set to 'custom'.
jwksUri:
type: string
description: The URL of the OIDC JWKS endpoint.
tokenEndpoint:
type: string
description: The token endpoint to use for OIDC token exchange.
userinfoEndpoint:
type: string
description: The userinfo endpoint to get user information from the OIDC provider.
clientId:
type: string
description: The client ID to use for OIDC authentication.
clientSecret:
type: string
description: The client secret to use for OIDC authentication.
isActive:
type: boolean
description: Whether to enable or disable this OIDC configuration.
manageGroupMemberships:
type: boolean
description: Whether to manage group memberships for the OIDC configuration. If enabled, users will automatically be assigned groups when they sign in, based on which groups they are a member of in the OIDC provider.
jwtSignatureAlgorithm:
type: string
enum:
- RS256
- HS256
- RS512
- EdDSA
description: The algorithm to use for JWT signature verification.
organizationId:
type: string
description: The ID of the organization to update the OIDC config for.
required:
- organizationId
additionalProperties: false
security:
- bearerAuth: []
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
id:
type: string
format: uuid
issuer:
type: string
nullable: true
authorizationEndpoint:
type: string
nullable: true
configurationType:
type: string
discoveryURL:
type: string
nullable: true
jwksUri:
type: string
nullable: true
tokenEndpoint:
type: string
nullable: true
userinfoEndpoint:
type: string
nullable: true
orgId:
type: string
format: uuid
allowedEmailDomains:
type: string
nullable: true
isActive:
type: boolean
manageGroupMemberships:
type: boolean
default: false
required:
- id
- configurationType
- orgId
- isActive
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
post:
tags:
- OIDC SSO
description: Create OIDC config
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
allowedEmailDomains:
type: string
default: ''
description: A list of allowed email domains that users can use to authenticate with. This field is comma separated. Supports wildcards (e.g. *.example.com).
configurationType:
type: string
enum:
- custom
- discoveryURL
description: The configuration type to use for the OIDC configuration.
issuer:
type: string
default: ''
description: The issuer for the OIDC configuration. This is only supported when the OIDC configuration type is set to 'custom'.
discoveryURL:
type: string
default: ''
description: The URL of the OIDC discovery endpoint.
authorizationEndpoint:
type: string
default: ''
description: The authorization endpoint to use for OIDC authorization. This is only supported when the OIDC configuration type is set to 'custom'.
jwksUri:
type: string
default: ''
description: The URL of the OIDC JWKS endpoint.
tokenEndpoint:
type: string
default: ''
description: The token endpoint to use for OIDC token exchange.
userinfoEndpoint:
type: string
default: ''
description: The userinfo endpoint to get user information from the OIDC provider.
clientId:
type: string
description: The client ID to use for OIDC authentication.
clientSecret:
type: string
description: The client secret to use for OIDC authentication.
isActive:
type: boolean
description: Whether to enable or disable this OIDC configuration.
organizationId:
type: string
description: The ID of the organization to create the OIDC config for.
manageGroupMemberships:
type: boolean
default: false
description: Whether to manage group memberships for the OIDC configuration. If enabled, users will automatically be assigned groups when they sign in, based on which groups they are a member of in the OIDC provider.
jwtSignatureAlgorithm:
type: string
enum:
- RS256
- HS256
- RS512
- EdDSA
default: RS256
description: The algorithm to use for JWT signature verification.
required:
- configurationType
- clientId
- clientSecret
- isActive
- organizationId
additionalProperties: false
security:
- bearerAuth: []
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
id:
type: string
format: uuid
issuer:
type: string
nullable: true
authorizationEndpoint:
type: string
nullable: true
configurationType:
type: string
discoveryURL:
type: string
nullable: true
jwksUri:
type: string
nullable: true
tokenEndpoint:
type: string
nullable: true
userinfoEndpoint:
type: string
nullable: true
orgId:
type: string
format: uuid
isActive:
type: boolean
allowedEmailDomains:
type: string
nullable: true
manageGroupMemberships:
type: boolean
default: false
jwtSignatureAlgorithm:
type: string
default: RS256
required:
- id
- configurationType
- orgId
- isActive
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: An access token in Infisical