Identity providers define how your users authenticate to your tenant when attempting to access content.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/identity-providers-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
{
"info": {
"title": "identity-providers",
"version": ""
},
"paths": {
"/api/v1/identity-providers": {
"get": {
"tags": [
"idp"
],
"summary": "List IdPs",
"responses": {
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/IDPArray"
}
}
},
"description": "Success"
},
"404": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Not Found"
}
},
"parameters": [
{
"in": "query",
"name": "active",
"schema": {
"type": "boolean"
},
"required": false,
"description": "If provided, filters the results by the active field."
},
{
"in": "query",
"name": "limit",
"schema": {
"type": "number",
"default": 20,
"maximum": 100,
"minimum": 1
},
"required": false,
"description": "The number of IdP entries to retrieve."
},
{
"in": "query",
"name": "next",
"schema": {
"type": "string"
},
"required": false,
"description": "The next page cursor."
},
{
"in": "query",
"name": "prev",
"schema": {
"type": "string"
},
"required": false,
"description": "The previous page cursor."
}
],
"description": "This endpoint retrieves any IdPs registered on the tenant.",
"operationId": "getIdps",
"x-qlik-visibility": "public",
"x-qlik-stability": "stable",
"x-qlik-deprecated": false,
"x-qlik-tier": {
"tier": "1",
"limit": 1000
}
},
"post": {
"tags": [
"idp"
],
"summary": "Create a new IdP",
"responses": {
"201": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/IDP"
}
}
},
"headers": {
"QLIK-IDP-POPTS": {
"$ref": "#/components/headers/qlikIdpPopts"
}
},
"description": "Created"
},
"400": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Bad Request"
},
"403": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Forbidden. User missing `TenantAdmin` role, or the tenantID in the JWT does not match any of the tenantIDs in the payload."
}
},
"description": "Creates a new IdP on a tenant. Requesting user must be assigned the `TenantAdmin` role. For non-interactive IdPs (e.g. JWT), IdP must be created by sending `options` payload. For interactive IdPs (e.g. SAML or OIDC), send `pendingOptions` payload to require the interactive verification step; or send `options` payload with `skipVerify` set to `true` to skip validation step and make IdP immediately available.",
"operationId": "createIdp",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/IDPPostSchema"
}
}
},
"description": "Attributes that the user wants to set for a new identity provider resource."
},
"x-qlik-visibility": "public",
"x-qlik-stability": "stable",
"x-qlik-deprecated": false,
"x-qlik-tier": {
"tier": "2",
"limit": 100
}
}
},
"/api/v1/identity-providers/.well-known/metadata.json": {
"get": {
"tags": [
"idp"
],
"summary": "Return IdP configuration metadata",
"responses": {
"200": {
"content": {
"application/json": {
"schema": {
"type": "object"
}
}
},
"description": "Success"
}
},
"description": "Returns IdP configuration metadata supported on the tenant. Clients can use this information to programmatically configure their interactions with Qlik Cloud.",
"operationId": "getWellKnownMetaData",
"x-qlik-visibility": "public",
"x-qlik-stability": "stable",
"x-qlik-deprecated": false,
"x-qlik-tier": {
"tier": "1",
"limit": 1000
}
}
},
"/api/v1/identity-providers/{id}": {
"get": {
"tags": [
"idp"
],
"summary": "Get an IdP",
"responses": {
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/IDP"
}
}
},
"headers": {
"QLIK-IDP-POPTS": {
"$ref": "#/components/headers/qlikIdpPopts"
}
},
"description": "Success"
},
"401": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Unauthorized"
},
"404": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Not Found"
}
},
"parameters": [
{
"in": "path",
"name": "id",
"schema": {
"type": "string"
},
"required": true,
"description": "The identity provider ID."
}
],
"description": "Retrieves a specific IdP. Requesting user must be assigned the `TenantAdmin` role.",
"operationId": "getIdp",
"x-qlik-visibility": "public",
"x-qlik-stability": "stable",
"x-qlik-deprecated": false,
"x-qlik-tier": {
"tier": "1",
"limit": 1000
}
},
"patch": {
"tags": [
"idp"
],
"summary": "Update an IdP",
"responses": {
"204": {
"description": "Success"
},
"400": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Bad request. Invalid request body, URL, or state transition."
},
"401": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Unauthorized"
},
"403": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Access Denied. Only the edge-auth service or TenantAdmin user request can patch an IdP."
},
"404": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Not Found"
},
"412": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Precondition Failed. Missing QLIK-IDP-OPTS-MATCH header, or value doesn't match against IdP test configuration value."
},
"500": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Internal server error, the operation failed unexpectedly"
}
},
"parameters": [
{
"in": "path",
"name": "id",
"schema": {
"type": "string"
},
"required": true,
"description": "The identity provider ID."
},
{
"$ref": "#/components/parameters/qlikIdpPoptsMatch"
}
],
"description": "Updates the configuration of an IdP. Requesting user must be assigned the `TenantAdmin` role. Partial failure is treated as complete failure and returns an error.",
"operationId": "updateIdp",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/IDPPatchSchema"
}
}
},
"description": "Attributes that the user wants to patially update for an identity provider resource."
},
"x-qlik-visibility": "public",
"x-qlik-stability": "stable",
"x-qlik-deprecated": false,
"x-qlik-tier": {
"tier": "2",
"limit": 100
}
},
"delete": {
"tags": [
"idp"
],
"summary": "Delete an IdP",
"responses": {
"204": {
"description": "Success"
},
"400": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Bad request. The interactive IdP for the tenant can't be deleted."
},
"404": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Not Found"
}
},
"parameters": [
{
"in": "path",
"name": "id",
"schema": {
"type": "string"
},
"required": true,
"description": "The identity provider ID."
}
],
"description": "Deletes an identity provider. Requesting user must be assigned the `TenantAdmin` role.",
"operationId": "deleteIdp",
"x-qlik-visibility": "public",
"x-qlik-stability": "stable",
"x-qlik-deprecated": false,
"x-qlik-tier": {
"tier": "2",
"limit": 100
}
}
},
"/api/v1/identity-providers/me/meta": {
"get": {
"tags": [
"idp"
],
"summary": "Return active interactive IdP metadata",
"responses": {
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/IDPMeta"
}
}
},
"description": "Success"
},
"403": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Forbidden"
},
"404": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Not Found"
},
"500": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Internal server error"
}
},
"description": "Retrieves default IdP metadata when no interactive IdP is enabled.",
"operationId": "getMeMeta",
"x-qlik-visibility": "public",
"x-qlik-stability": "stable",
"x-qlik-deprecated": false,
"x-qlik-tier": {
"tier": "1",
"limit": 1000
}
}
},
"/api/v1/identity-providers/status": {
"get": {
"tags": [
"idp"
],
"summary": "List IdP statuses",
"responses": {
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/IDPsStatus"
}
}
},
"description": "Success"
},
"403": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Forbidden"
},
"404": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Not Found"
},
"500": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Errors"
}
}
},
"description": "Internal Server Error"
}
},
"description": "Retrieves the status of all IdP configurations. Requires `TenantAdmin` role.",
"operationId": "getStatus",
"x-qlik-visibility": "public",
"x-qlik-stability": "stable",
"x-qlik-deprecated": false,
"x-qlik-tier": {
"tier": "1",
"limit": 1000
}
}
}
},
"openapi": "3.0.0",
"components": {
"headers": {
"qlikIdpPopts": {
"schema": {
"type": "string",
"format": "uuid"
},
"description": "A unique string representing a hash of the current configuration being tested."
}
},
"parameters": {
"qlikIdpPoptsMatch": {
"in": "header",
"name": "QLIK-IDP-POPTS-MATCH",
"schema": {
"type": "string",
"format": "uuid"
},
"description": "A unique string representing a hash that should map to an IdP's hash representation of the current configuration being tested."
}
},
"schemas": {
"BaseIDP": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The unique identifier for the IdP."
},
"meta": {
"type": "object"
},
"active": {
"type": "boolean",
"description": "Indicates whether the IdP is available for use."
},
"created": {
"type": "string",
"format": "date-time",
"description": "The timestamp for when the IdP was created."
},
"protocol": {
"$ref": "#/components/schemas/IDPProtocol"
},
"provider": {
"$ref": "#/components/schemas/IDPProvider"
},
"tenantIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tenant identifiers associated with the given IdP."
},
"description": {
"type": "string"
},
"interactive": {
"type": "boolean",
"description": "Indicates the type of connection with the IdP, either interactive login or a machine to machine connection."
},
"lastUpdated": {
"type": "string",
"format": "date-time",
"description": "The timestamp for when the IdP was last updated."
},
"clockToleranceSec": {
"type": "integer"
},
"createNewUsersOnLogin": {
"type": "boolean",
"description": "When the flag is true, new users should be created when logging in for the first time."
},
"postLogoutRedirectUri": {
"type": "string",
"description": "Direct the user on logout to a specific URI."
}
}
},
"CertificateInfo": {
"type": "object",
"required": [
"certificate"
],
"properties": {
"name": {
"type": "string",
"description": "Given name for this certificate."
},
"signature": {
"type": "boolean",
"default": true,
"description": "Indicates whether the certificate is used for the signature."
},
"encryption": {
"type": "boolean",
"default": false,
"description": "Indicates whether the certificate is used for encryption."
},
"certificate": {
"type": "string",
"description": "The X.509 certificate for validating signed SAML responses."
}
}
},
"claimsMappingInteractive": {
"type": "object",
"properties": {
"sub": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of JSON pointers used to map the user's subject."
},
"name": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of JSON pointers used to map the user's name."
},
"email": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of JSON pointers used to map the user's email."
},
"groups": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of JSON pointers used to map the user's groups."
},
"locale": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of JSON pointers used to map the user's locale."
},
"picture": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of JSON pointers used to map the user's picture."
},
"zoneinfo": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of JSON pointers used to map the user's zoneinfo."
},
"client_id": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of JSON pointers used to map the user's client ID."
},
"email_verified": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of JSON pointers used to map the user's email_verified claim."
}
},
"description": "Mappings from claim name to an array of JSON pointers that point to locations in the claims from the IdP to retrieve the value from."
},
"claimsMappingNonInteractive": {
"type": "object",
"properties": {
"sub": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of JSON pointers used to map the user's subject."
},
"client_id": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of JSON pointers used to map the user's client ID."
}
},
"description": "Mappings from claim name to an array of JSON pointers that point to locations in the claims from the IdP to retrieve the value from."
},
"claimsMappingSAML": {
"type": "object",
"required": [
"sub",
"name",
"email",
"picture",
"groups"
],
"properties": {
"sub": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of SAML attributes used to map the user's subject."
},
"name": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of SAML attributes used to map the user's name."
},
"email": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of SAML attributes used to map the user's email."
},
"groups": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of SAML attributes used to map the user's groups."
},
"picture": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of SAML attributes used to map the user's picture."
}
},
"description": "Mappings from claim name to an array of SAML attribute names that point to locations in the claims from the IdP to retrieve the value from."
},
"CreateJWTAuthPayload": {
"type": "object",
"required": [
"provider",
"protocol",
"options"
],
"properties": {
"options": {
"type": "object",
"required": [
"issuer",
"staticKeys"
],
"properties": {
"issuer": {
"type": "string",
"description": "The JWT issuer."
},
"staticKeys": {
"type": "array",
"items": {
"type": "object",
"required": [
"kid",
"pem"
],
"properties": {
"kid": {
"type": "string",
"description": "Key ID used to sign the JWTs."
},
"pem": {
"type": "string",
"description": "Pem-encoded public key for verifying the JWTs."
}
}
},
"description": "Keys for verifying JWTs. Limited to 1 key per identity provider."
}
},
"description": "Required IdP configurations."
},
"protocol": {
"enum": [
"jwtAuth"
],
"type": "string",
"description": "The protocol to be used for communicating with the identity provider."
},
"provider": {
"enum": [
"external"
],
"type": "string",
"description": "The identity provider to be used."
},
"tenantIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tenant identifiers that map to the given IdP."
},
"description": {
"type": "string",
"maxLength": 128
},
"clockToleranceSec": {
"type": "integer",
"default": 5,
"maximum": 7200,
"minimum": 0,
"description": "There can be clock skew between the IdP and Qlik's login server. In these cases, a tolerance can be set."
}
},
"description": "Payload for creating an identity provider using JWT authentication."
},
"CreateOIDCPayload": {
"type": "object",
"required": [
"provider",
"protocol",
"interactive"
],
"properties": {
"options": {
"type": "object",
"required": [
"claimsMapping"
],
"properties": {
"realm": {
"type": "string",
"pattern": "^[A-Za-z0-9][A-Za-z0-9.\\-_]+$",
"maxLength": 254,
"description": "The realm identifier for the IdP."
},
"audience": {
"type": "string",
"maxLength": 256,
"description": "Allows for setting audience in access tokens."
},
"discoveryUrl": {
"type": "string",
"description": "The OpenID configuration endpoint. (Ex: https://<domain>/.well-known/openid-configuration). Required if openid_configuration is not given."
},
"claimsMapping": {
"$ref": "#/components/schemas/claimsMappingNonInteractive"
},
"allowedClientIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "Only clients with IDs in this list will be allowed API access. A blank list or empty value means any client IDs authenticated against the IdP will be allowed access."
},
"openid_configuration": {
"$ref": "#/components/schemas/OpenIDConfiguration"
}
},
"description": "Required OIDC configurations for non-interactive IdPs and interactive IdPs with `skipVerify` flag enabled."
},
"protocol": {
"enum": [
"OIDC"
],
"type": "string",
"description": "The protocol to be used for communicating with the identity provider."
},
"provider": {
"enum": [
"auth0",
"okta",
"generic",
"salesforce",
"keycloak",
"adfs",
"azureAD"
],
"type": "string",
"description": "The identity provider to be used."
},
"tenantIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "The tenant identifiers that map to the given IdP."
},
"skipVerify": {
"type": "boolean",
"default": false,
"description": "If set to `true`, skips IdP verification process and assumes the IdP is verified."
},
"description": {
"type": "string",
"maxLength": 128
},
"interactive": {
"type": "boolean",
"default": false,
"description": "Indicates whether the IdP is meant for interactive login."
},
"pendingOptions": {
"type": "object",
"required": [
"clientId",
"clientSecret",
"claimsMapping"
],
"properties": {
"realm": {
"type": "string",
"pattern": "^[A-Za-z0-9][A-Za-z0-9.\\-_]+$",
"maxLength": 254,
"description": "The realm identifier for the IdP."
},
"scope": {
"type": "string",
"maxLength": 254,
"description": "Scope which will be sent along with token requests to the IdP. Scopes should be space delimited. Will default to certain values depending on the IdP provider."
},
"clientId": {
"type": "string",
"description": "The client identifier used as part of authenticating an interactive identity provider."
},
"clientSecret": {
"type": "string",
"description": "The client secret used as part of authenticating an interactive identity provider."
},
"discoveryUrl": {
"type": "string",
"description": "The OpenID configuration endpoint. (Ex: https://<domain>/.well-known/openid-configuration). Required if openid_configuration is not given."
},
"claimsMapping": {
"$ref": "#/components/schemas/claimsMappingInteractive"
},
"decryptingKey": {
"$ref": "#/components/schemas/decryptingKey"
},
"idTokenSignatureAlg": {
"enum": [
"RS256",
"RS512"
],
"type": "string",
"default": "RS256",
"description": "The algorithm used to sign the ID token. The default algorithm is RS256."
},
"openid_configuration": {
"$ref": "#/components/schemas/OpenIDConfiguration"
},
"useClaimsFromIdToken": {
"type": "boolean",
"description": "If true, will use the claims from the ID token. By default it is set to true for ADFS and AzureAD."
},
"blockOfflineAccessScope": {
"type": "boolean",
"description": "When true, the `offline_access` scope will not be requested from the IdP where applicable."
},
"emailVerifiedAlwaysTrue": {
"type": "boolean",
"description": "Only ADFS and AzureAD IdPs can set this property. For ADFS and AzureAD, it defaults to false. For other IdPs, it defaults to undefined."
}
},
"description": "Required OIDC configurations for interactive IdPs that require verification."
},
"clockToleranceSec": {
"type": "integer",
"default": 5,
"maximum": 7200,
"minimum": 0,
"description": "There can be clock skew between the IdP and Qlik's login server. In these cases, a tolerance can be set."
},
"createNewUsersOnLogin": {
"type": "boolean",
"default": true,
"description": "Tells the consumer of the IdP that new users should be created on login if they don't exist."
},
"postLogoutRedirectUri": {
"type": "string",
"maxLength": 2083,
"description": "Direct the user on logout to a specific URI."
}
},
"description": "Payload for creating an OIDC-compatible identity provider."
},
"CreateSAMLPayload": {
"type": "object",
"required": [
"provider",
"protocol",
"interactive"
],
"properties": {
"options": {
"type": "object",
"required": [
"claimsMapping"
],
"properties": {
"entityId": {
"type": "string",
"description": "The entity ID for the SAML IdP. Required if metadata is not provided."
},
"metadata": {
"type": "object",
"required": [
"raw"
],
"properties": {
"raw": {
"type": "string",
"format": "byte",
"description": "The IDP metadata XML in base64-encoded format."
# --- truncated at 32 KB (60 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/qliksense/refs/heads/main/openapi/qliksense-identity-providers.json