Vertesia OIDC Federation API
The OIDC Federation API from Vertesia — 2 operation(s) for oidc federation.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/vertesiahq:vertesiahq-oidc-federation-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Vertesia OIDC Federation API
version: 1.6.0-dev.20261019.172735Z
x-api-version: '20260803'
description: The Vertesia API provides project-scoped access to interaction execution and content workflows. Use it to run interactions, inspect execution history, stream run progress, replay previous executions, and search content objects and collections. Authenticate requests with a bearer token, or use the official `@vertesia/client` package for typed access from Node.js applications.
contact:
name: Vertesia
url: https://vertesiahq.com/
license:
name: Apache-2.0
identifier: Apache-2.0
x-scalar-sdk-installation:
- lang: Node
description: 'Install the **Vertesia Client** from npm:'
source: npm install @vertesia/client
servers:
- url: https://api.{region}.vertesia.io/api/v1
description: Vertesia API
variables:
region:
default: us1
enum:
- us1
- eu1
- jp1
description: Regional API host label. `us1` is the global endpoint.
tags:
- name: OIDC Federation
paths:
/oidc-federation:
parameters:
- name: x-api-version
in: header
required: true
schema:
type: string
minLength: 1
pattern: \S
example: '20260803'
description: Required Vertesia API version header. Use `20260803` for the current stable API shape.
x-vertesia-global-header: true
get:
operationId: ListOidcFederationConnections
tags:
- OIDC Federation
summary: List OIDC federation connections
description: '**Required permissions:** `account:admin`'
security:
- bearerAuth: []
- OAuth2:
- account:admin
parameters: []
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/OidcFederationConnectionArray'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
error: Internal Server Error
status: 500
message: Internal server error.
4XX:
description: Client error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
error: Bad Request
status: 400
message: Request validation failed.
x-vertesia-permissions:
- account:admin
x-vertesia-source:
file: ../../apps/studio-server/src/api/oidc-federation.ts
className: OidcFederationResource
methodName: list
post:
operationId: CreateOidcFederationConnection
tags:
- OIDC Federation
summary: Create an OIDC federation connection
description: 'GitHub Actions, GitLab.com and Google issuers require a recognized immutable signed tenant or application binding in required_claims, such as repository_id, namespace_id or azp.
**Required permissions:** `account:admin`'
security:
- bearerAuth: []
- OAuth2:
- account:admin
parameters: []
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/OidcFederationConnection'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
error: Internal Server Error
status: 500
message: Internal server error.
4XX:
description: Client error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
error: Bad Request
status: 400
message: Request validation failed.
x-vertesia-permissions:
- account:admin
x-vertesia-source:
file: ../../apps/studio-server/src/api/oidc-federation.ts
className: OidcFederationResource
methodName: create
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/OidcFederationConnectionPayload'
/oidc-federation/{connection_id}:
parameters:
- name: x-api-version
in: header
required: true
schema:
type: string
minLength: 1
pattern: \S
example: '20260803'
description: Required Vertesia API version header. Use `20260803` for the current stable API shape.
x-vertesia-global-header: true
get:
operationId: GetOidcFederationConnection
tags:
- OIDC Federation
summary: Get an OIDC federation connection
description: '**Required permissions:** `account:admin`'
security:
- bearerAuth: []
- OAuth2:
- account:admin
parameters:
- name: connection_id
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/OidcFederationConnection'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
error: Internal Server Error
status: 500
message: Internal server error.
4XX:
description: Client error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
error: Bad Request
status: 400
message: Request validation failed.
x-vertesia-permissions:
- account:admin
x-vertesia-source:
file: ../../apps/studio-server/src/api/oidc-federation.ts
className: OidcFederationResource
methodName: retrieve
put:
operationId: UpdateOidcFederationConnection
tags:
- OIDC Federation
summary: Replace an OIDC federation trust policy
description: 'Shared GitHub Actions, GitLab.com and Google issuers require a recognized immutable signed tenant or application binding. Status-only disabling remains available for an unsafe or unavailable policy.
**Required permissions:** `account:admin`'
security:
- bearerAuth: []
- OAuth2:
- account:admin
parameters:
- name: connection_id
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/OidcFederationConnection'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
error: Internal Server Error
status: 500
message: Internal server error.
4XX:
description: Client error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
error: Bad Request
status: 400
message: Request validation failed.
x-vertesia-permissions:
- account:admin
x-vertesia-source:
file: ../../apps/studio-server/src/api/oidc-federation.ts
className: OidcFederationResource
methodName: update
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/OidcFederationConnectionPayload'
delete:
operationId: DeleteOidcFederationConnection
tags:
- OIDC Federation
summary: Delete an OIDC federation connection
description: '**Required permissions:** `account:admin`'
security:
- bearerAuth: []
- OAuth2:
- account:admin
parameters:
- name: connection_id
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/SuccessResponse'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
error: Internal Server Error
status: 500
message: Internal server error.
4XX:
description: Client error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
error: Bad Request
status: 400
message: Request validation failed.
x-vertesia-permissions:
- account:admin
x-vertesia-source:
file: ../../apps/studio-server/src/api/oidc-federation.ts
className: OidcFederationResource
methodName: remove
components:
schemas:
OidcFederationConnectionPayload:
type: object
properties:
name:
type: string
minLength: 1
maxLength: 200
issuer:
type: string
format: uri
jwks_uri:
type: string
format: uri
external_id_claim:
type: string
minLength: 1
maxLength: 256
pattern: \S
description: Exact top-level verified token claim matched to SCIM externalId within the owning provisioning account.
allowed_audiences:
minItems: 1
maxItems: 20
type: array
items:
type: string
minLength: 1
allowed_algorithms:
minItems: 1
maxItems: 2
type: array
items:
type: string
enum:
- RS256
- ES256
subject_token_type:
type: string
enum:
- urn:ietf:params:oauth:token-type:jwt
- urn:ietf:params:oauth:token-type:id_token
- urn:ietf:params:oauth:token-type:access_token
required_claims:
type: object
additionalProperties:
type: string
description: Exact string matches against verified top-level IdP claims, such as tenant or azp.
all_projects:
type: boolean
description: Explicitly allow all current and future projects in the owning organization, subject to the user’s current access. Defaults to false for existing allowlists. When true, allowed_project_ids must be empty.
allowed_project_ids:
maxItems: 100
type: array
items:
type: string
pattern: ^[a-fA-F0-9]{24}$
description: Explicit project allowlist. Must contain 1–100 projects unless all_projects is true.
allowed_client_ids:
minItems: 1
maxItems: 20
type: array
items:
type: string
minLength: 1
maxLength: 256
description: When set, require authentication by one of these account-owned confidential OAuth clients. Omit to allow exchanges without separate client authentication.
allowed_scopes:
minItems: 1
maxItems: 100
type: array
items:
type: string
minLength: 1
description: Optional restriction on delegable Vertesia permissions, excluding account:admin. Omit to use the user’s current permissions. An explicit list further restricts the grant.
max_token_ttl_seconds:
type: integer
minimum: 30
maximum: 300
max_subject_token_age_seconds:
type: integer
minimum: 30
maximum: 86400
description: Maximum age since the signed iat claim. Defaults to 3600 seconds; 60 seconds of clock tolerance applies.
enabled:
type: boolean
required:
- name
- issuer
- external_id_claim
- allowed_audiences
- allowed_algorithms
- subject_token_type
- allowed_project_ids
- max_token_ttl_seconds
- enabled
additionalProperties: false
SuccessResponse:
type: object
properties:
success:
type: boolean
required:
- success
additionalProperties: false
OidcFederationConnection:
type: object
properties:
name:
type: string
minLength: 1
maxLength: 200
issuer:
type: string
format: uri
jwks_uri:
type: string
format: uri
external_id_claim:
type: string
minLength: 1
maxLength: 256
pattern: \S
description: Exact top-level verified token claim matched to SCIM externalId within the owning provisioning account.
allowed_audiences:
minItems: 1
maxItems: 20
type: array
items:
type: string
minLength: 1
allowed_algorithms:
minItems: 1
maxItems: 2
type: array
items:
type: string
enum:
- RS256
- ES256
subject_token_type:
type: string
enum:
- urn:ietf:params:oauth:token-type:jwt
- urn:ietf:params:oauth:token-type:id_token
- urn:ietf:params:oauth:token-type:access_token
required_claims:
type: object
additionalProperties:
type: string
description: Exact string matches against verified top-level IdP claims, such as tenant or azp.
all_projects:
type: boolean
description: Explicitly allow all current and future projects in the owning organization, subject to the user’s current access. Defaults to false for existing allowlists. When true, allowed_project_ids must be empty.
allowed_project_ids:
maxItems: 100
type: array
items:
type: string
pattern: ^[a-fA-F0-9]{24}$
description: Explicit project allowlist. Must contain 1–100 projects unless all_projects is true.
allowed_client_ids:
minItems: 1
maxItems: 20
type: array
items:
type: string
minLength: 1
maxLength: 256
description: When set, require authentication by one of these account-owned confidential OAuth clients. Omit to allow exchanges without separate client authentication.
allowed_scopes:
minItems: 1
maxItems: 100
type: array
items:
type: string
minLength: 1
description: Optional restriction on delegable Vertesia permissions, excluding account:admin. Omit to use the user’s current permissions. An explicit list further restricts the grant.
max_token_ttl_seconds:
type: integer
minimum: 30
maximum: 300
max_subject_token_age_seconds:
type: integer
minimum: 30
maximum: 86400
enabled:
type: boolean
id:
type: string
pattern: ^[a-fA-F0-9]{24}$
account_id:
type: string
pattern: ^[a-fA-F0-9]{24}$
required:
- name
- issuer
- external_id_claim
- allowed_audiences
- allowed_algorithms
- subject_token_type
- allowed_project_ids
- max_token_ttl_seconds
- max_subject_token_age_seconds
- enabled
- id
- account_id
additionalProperties: false
ErrorResponse:
type: object
description: Standard JSON error response returned by the server error handler.
properties:
error:
type: string
description: HTTP status text or normalized error type.
status:
type: integer
format: int32
minimum: 400
maximum: 599
description: HTTP status code. Client errors use a 4xx status code; server errors use 500.
example: 400
message:
type: string
description: Human-readable error message.
details:
type: string
description: Optional additional error details.
errorCode:
type: string
description: Machine-readable code for the specific failure, present when the error carries one, so clients can branch on it without parsing `message`.
example: account_api_key_creation_disabled
required:
- error
- status
additionalProperties: false
OidcFederationConnectionArray:
type: array
items:
$ref: '#/components/schemas/OidcFederationConnection'
securitySchemes:
bearerAuth:
type: http
scheme: bearer
OAuth2:
type: oauth2
flows:
authorizationCode:
authorizationUrl: https://cloud.us1.vertesia.io/oauth/authorize
tokenUrl: https://sts.vertesia.io/oauth/token
x-scalar-security-query:
resource: https://api.us1.vertesia.io/api/v1
x-scalar-security-body:
resource: https://api.us1.vertesia.io/api/v1
scopes:
openid: ''
profile: ''
offline_access: ''
interaction:read: ''
interaction:write: ''
interaction:delete: ''
interaction:execute: ''
run:read: ''
run:write: ''
environment:admin: ''
app:manage: ''
project:admin: ''
project:integration_read: ''
project:settings_write: ''
api_key:read: ''
account:read: ''
account:write: ''
account:admin: ''
audit:read: ''
account:member: ''
content:read: ''
content:read_all: ''
content:write: ''
content:delete: ''
content:admin: ''
content:superadmin: ''
workflow:read: ''
workflow:run: ''
workflow:admin: ''
workflow:superadmin: ''
agent_run:read: ''
task:read: ''
task:manage: ''
x-tagGroups:
- name: Authentication
tags:
- Token Service
- name: GenAI
tags:
- Environments
- Prompt Templates
- Interactions
- Interaction Runs
- Agent Runs
- name: Content
tags:
- Content Object Types
- Objects
- Collections
- Files
- Rendering
- Bulk Operations
- Commands
- name: Data Store
tags:
- Data
- name: Workflow
tags:
- Processes
- Tasks
- Workflow Definitions
- Workflow Rules
- Workflow Runs
- name: Administration
tags:
- Accounts
- Projects
- Audit Trail
- Costs
- name: Access Control
tags:
- Users
- User Groups
- Roles
- Access Control Entries
- API Keys
- name: Apps & Integrations
tags:
- Apps
- OAuth Providers
- OAuth Clients
- OAuth Grants
- Remote MCP Connections