MongoDB · Schema

FederationOidcIdentityProvider

Cloud DatabaseDatabaseDocument DatabaseNoSQLMongoDB

Properties

Name	Type	Description
associatedOrgs	array	List that contains the connected organization configurations associated with the identity provider.
audience	string	Identifier of the intended recipient of the token.
authorizationType	string	Indicates whether authorization is granted based on group membership or user ID.
createdAt	string	Date that the identity provider was created on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
description	string	The description of the identity provider.
displayName	string	Human-readable label that identifies the identity provider.
groupsClaim	string	Identifier of the claim which contains IdP Group IDs in the token.
id	string	Unique 24-hexadecimal digit string that identifies the identity provider.
idpType	string	String enum that indicates the type of the identity provider. Default is WORKFORCE.
issuerUri	string	Unique string that identifies the issuer of the SAML Assertion or OIDC metadata/discovery document URL.
oktaIdpId	string	Legacy 20-hexadecimal digit string that identifies the identity provider.
protocol	string	String enum that indicates the protocol of the identity provider. Either SAML or OIDC.
updatedAt	string	Date that the identity provider was last updated on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
userClaim	string	Identifier of the claim which contains the user ID in the token.

View JSON Schema on GitHub

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/mongodb/main/json-schema/mongodb-federation-oidc-identity-provider-schema.json",
  "title": "FederationOidcIdentityProvider",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/mongodb-federated-authentication-api-openapi.yml#/components/schemas/FederationOidcIdentityProvider",
  "oneOf": [
    {
      "$ref": "#/$defs/FederationOidcWorkforceIdentityProvider"
    },
    {
      "$ref": "#/$defs/FederationOidcWorkloadIdentityProvider"
    }
  ],
  "properties": {
    "associatedOrgs": {
      "description": "List that contains the connected organization configurations associated with the identity provider.",
      "items": {
        "$ref": "#/$defs/ConnectedOrgConfig"
      },
      "type": "array",
      "uniqueItems": true
    },
    "audience": {
      "description": "Identifier of the intended recipient of the token.",
      "type": "string"
    },
    "authorizationType": {
      "description": "Indicates whether authorization is granted based on group membership or user ID.",
      "enum": [
        "GROUP",
        "USER"
      ],
      "type": "string"
    },
    "createdAt": {
      "description": "Date that the identity provider was created on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.",
      "format": "date-time",
      "readOnly": true,
      "type": "string"
    },
    "description": {
      "description": "The description of the identity provider.",
      "type": "string"
    },
    "displayName": {
      "description": "Human-readable label that identifies the identity provider.",
      "type": "string"
    },
    "groupsClaim": {
      "description": "Identifier of the claim which contains IdP Group IDs in the token.",
      "type": "string"
    },
    "id": {
      "description": "Unique 24-hexadecimal digit string that identifies the identity provider.",
      "pattern": "^([a-f0-9]{24})$",
      "readOnly": true,
      "type": "string"
    },
    "idpType": {
      "description": "String enum that indicates the type of the identity provider. Default is WORKFORCE.",
      "enum": [
        "WORKFORCE",
        "WORKLOAD"
      ],
      "type": "string"
    },
    "issuerUri": {
      "description": "Unique string that identifies the issuer of the SAML Assertion or OIDC metadata/discovery document URL.",
      "type": "string"
    },
    "oktaIdpId": {
      "description": "Legacy 20-hexadecimal digit string that identifies the identity provider.",
      "pattern": "^([a-f0-9]{20})$",
      "type": "string"
    },
    "protocol": {
      "description": "String enum that indicates the protocol of the identity provider. Either SAML or OIDC.",
      "enum": [
        "SAML",
        "OIDC"
      ],
      "type": "string"
    },
    "updatedAt": {
      "description": "Date that the identity provider was last updated on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.",
      "format": "date-time",
      "readOnly": true,
      "type": "string"
    },
    "userClaim": {
      "description": "Identifier of the claim which contains the user ID in the token.",
      "type": "string"
    }
  },
  "required": [
    "id",
    "oktaIdpId"
  ],
  "type": "object",
  "$defs": {
    "AuthFederationRoleMapping": {
      "description": "Mapping settings that link one IdP and MongoDB Cloud.",
      "properties": {
        "externalGroupName": {
          "description": "Unique human-readable label that identifies the identity provider group to which this role mapping applies.",
          "maxLength": 200,
          "minLength": 1,
          "type": "string"
        },
        "id": {
          "description": "Unique 24-hexadecimal digit string that identifies this role mapping.",
          "pattern": "^([a-f0-9]{24})$",
          "readOnly": true,
          "type": "string"
        },
        "roleAssignments": {
          "description": "Atlas roles and the unique identifiers of the groups and organizations associated with each role. The array must include at least one element with an Organization role and its respective `orgId`. Each element in the array can have a value for `orgId` or `groupId`, but not both.",
          "items": {
            "$ref": "#/$defs/ConnectedOrgConfigRoleAssignment"
          },
          "type": "array",
          "uniqueItems": true
        }
      },
      "required": [
        "externalGroupName",
        "roleAssignments"
      ],
      "title": "Federated Authentication Role Mapping",
      "type": "object"
    },
    "ConnectedOrgConfig": {
      "properties": {
        "dataAccessIdentityProviderIds": {
          "description": "The collection of unique ids representing the identity providers that can be used for data access in this organization.",
          "items": {
            "description": "Unique 24-hexadecimal digit string that represents the id of the identity providers that can be used for data access in this organization.",
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "domainAllowList": {
          "description": "Approved domains that restrict users who can join the organization based on their email address.",
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "domainRestrictionEnabled": {
          "description": "Value that indicates whether domain restriction is enabled for this connected organization.",
          "type": "boolean"
        },
        "identityProviderId": {
          "description": "Legacy 20-hexadecimal digit string that identifies the UI access identity provider that this connected organization configuration is associated with. This id can be found within the Federation Management Console > Identity Providers tab by clicking the info icon in the IdP ID row of a configured identity provider.",
          "pattern": "^([a-f0-9]{20})$",
          "type": "string"
        },
        "orgId": {
          "description": "Unique 24-hexadecimal digit string that identifies the connected organization configuration.",
          "pattern": "^([a-f0-9]{24})$",
          "readOnly": true,
          "type": "string"
        },
        "postAuthRoleGrants": {
          "description": "Atlas roles that are granted to a user in this organization after authenticating. Roles are a human-readable label that identifies the collection of privileges that MongoDB Cloud grants a specific MongoDB Cloud user. These roles can only be organization specific roles.",
          "items": {
            "enum": [
              "ORG_OWNER",
              "ORG_MEMBER",
              "ORG_GROUP_CREATOR",
              "ORG_BILLING_ADMIN",
              "ORG_BILLING_READ_ONLY",
              "ORG_STREAM_PROCESSING_ADMIN",
              "ORG_READ_ONLY"
            ],
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "roleMappings": {
          "description": "Role mappings that are configured in this organization.",
          "items": {
            "$ref": "#/$defs/AuthFederationRoleMapping"
          },
          "type": "array",
          "uniqueItems": true
        },
        "userConflicts": {
          "description": "List that contains the users who have an email address that doesn't match any domain on the allowed list.",
          "items": {
            "$ref": "#/$defs/FederatedUser"
          },
          "type": "array"
        }
      },
      "required": [
        "domainRestrictionEnabled",
        "orgId"
      ],
      "type": "object"
    },
    "ConnectedOrgConfigRoleAssignment": {
      "properties": {
        "groupId": {
          "description": "Unique 24-hexadecimal digit string that identifies the project to which this role belongs. Each element within `roleAssignments` can have a value for `groupId` or `orgId`, but not both.",
          "pattern": "^([a-f0-9]{24})$",
          "type": "string"
        },
        "orgId": {
          "description": "Unique 24-hexadecimal digit string that identifies the organization to which this role belongs. Each element within `roleAssignments` can have a value for `orgId` or `groupId`, but not both.",
          "pattern": "^([a-f0-9]{24})$",
          "type": "string"
        },
        "role": {
          "description": "Human-readable label that identifies the collection of privileges that MongoDB Cloud grants a specific API key, MongoDB Cloud user, or MongoDB Cloud team. These roles include organization- and project-level roles.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "FederatedUser": {
      "description": "MongoDB Cloud user linked to this federated authentication.",
      "properties": {
        "emailAddress": {
          "description": "Email address of the MongoDB Cloud user linked to the federated organization.",
          "format": "email",
          "type": "string"
        },
        "federationSettingsId": {
          "description": "Unique 24-hexadecimal digit string that identifies the federation to which this MongoDB Cloud user belongs.",
          "pattern": "^([a-f0-9]{24})$",
          "type": "string"
        },
        "firstName": {
          "description": "First or given name that belongs to the MongoDB Cloud user.",
          "type": "string"
        },
        "lastName": {
          "description": "Last name, family name, or surname that belongs to the MongoDB Cloud user.",
          "type": "string"
        },
        "userId": {
          "description": "Unique 24-hexadecimal digit string that identifies this user.",
          "pattern": "^([a-f0-9]{24})$",
          "readOnly": true,
          "type": "string"
        }
      },
      "required": [
        "emailAddress",
        "federationSettingsId",
        "firstName",
        "lastName"
      ],
      "title": "Federated User",
      "type": "object"
    },
    "FederationOidcWorkforceIdentityProvider": {
      "properties": {
        "associatedDomains": {
          "description": "List that contains the domains associated with the identity provider.",
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "associatedOrgs": {
          "description": "List that contains the connected organization configurations associated with the identity provider.",
          "items": {
            "$ref": "#/$defs/ConnectedOrgConfig"
          },
          "type": "array",
          "uniqueItems": true
        },
        "audience": {
          "description": "Identifier of the intended recipient of the token.",
          "type": "string"
        },
        "authorizationType": {
          "description": "Indicates whether authorization is granted based on group membership or user ID.",
          "enum": [
            "GROUP",
            "USER"
          ],
          "type": "string"
        },
        "clientId": {
          "description": "Client identifier that is assigned to an application by the Identity Provider.",
          "type": "string"
        },
        "createdAt": {
          "description": "Date that the identity provider was created on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "description": {
          "description": "The description of the identity provider.",
          "type": "string"
        },
        "displayName": {
          "description": "Human-readable label that identifies the identity provider.",
          "type": "string"
        },
        "groupsClaim": {
          "description": "Identifier of the claim which contains IdP Group IDs in the token.",
          "type": "string"
        },
        "id": {
          "description": "Unique 24-hexadecimal digit string that identifies the identity provider.",
          "pattern": "^([a-f0-9]{24})$",
          "readOnly": true,
          "type": "string"
        },
        "idpType": {
          "description": "String enum that indicates the type of the identity provider. Default is WORKFORCE.",
          "enum": [
            "WORKFORCE",
            "WORKLOAD"
          ],
          "type": "string"
        },
        "issuerUri": {
          "description": "Unique string that identifies the issuer of the SAML Assertion or OIDC metadata/discovery document URL.",
          "type": "string"
        },
        "oktaIdpId": {
          "description": "Legacy 20-hexadecimal digit string that identifies the identity provider.",
          "pattern": "^([a-f0-9]{20})$",
          "type": "string"
        },
        "protocol": {
          "description": "String enum that indicates the protocol of the identity provider. Either SAML or OIDC.",
          "enum": [
            "SAML",
            "OIDC"
          ],
          "type": "string"
        },
        "requestedScopes": {
          "description": "Scopes that MongoDB applications will request from the authorization endpoint.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "updatedAt": {
          "description": "Date that the identity provider was last updated on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "userClaim": {
          "description": "Identifier of the claim which contains the user ID in the token.",
          "type": "string"
        }
      },
      "required": [
        "id",
        "oktaIdpId"
      ],
      "title": "OIDC WORKFORCE",
      "type": "object"
    },
    "FederationOidcWorkloadIdentityProvider": {
      "properties": {
        "associatedOrgs": {
          "description": "List that contains the connected organization configurations associated with the identity provider.",
          "items": {
            "$ref": "#/$defs/ConnectedOrgConfig"
          },
          "type": "array",
          "uniqueItems": true
        },
        "audience": {
          "description": "Identifier of the intended recipient of the token.",
          "type": "string"
        },
        "authorizationType": {
          "description": "Indicates whether authorization is granted based on group membership or user ID.",
          "enum": [
            "GROUP",
            "USER"
          ],
          "type": "string"
        },
        "createdAt": {
          "description": "Date that the identity provider was created on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "description": {
          "description": "The description of the identity provider.",
          "type": "string"
        },
        "displayName": {
          "description": "Human-readable label that identifies the identity provider.",
          "type": "string"
        },
        "groupsClaim": {
          "description": "Identifier of the claim which contains IdP Group IDs in the token.",
          "type": "string"
        },
        "id": {
          "description": "Unique 24-hexadecimal digit string that identifies the identity provider.",
          "pattern": "^([a-f0-9]{24})$",
          "readOnly": true,
          "type": "string"
        },
        "idpType": {
          "description": "String enum that indicates the type of the identity provider. Default is WORKFORCE.",
          "enum": [
            "WORKFORCE",
            "WORKLOAD"
          ],
          "type": "string"
        },
        "issuerUri": {
          "description": "Unique string that identifies the issuer of the SAML Assertion or OIDC metadata/discovery document URL.",
          "type": "string"
        },
        "oktaIdpId": {
          "description": "Legacy 20-hexadecimal digit string that identifies the identity provider.",
          "pattern": "^([a-f0-9]{20})$",
          "type": "string"
        },
        "protocol": {
          "description": "String enum that indicates the protocol of the identity provider. Either SAML or OIDC.",
          "enum": [
            "SAML",
            "OIDC"
          ],
          "type": "string"
        },
        "updatedAt": {
          "description": "Date that the identity provider was last updated on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "userClaim": {
          "description": "Identifier of the claim which contains the user ID in the token.",
          "type": "string"
        }
      },
      "required": [
        "id",
        "oktaIdpId"
      ],
      "title": "OIDC WORKLOAD",
      "type": "object"
    }
  }
}

Work with this as data

Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for schemas

4 MCP tools reach this

find_json_schemasBrowse and filter every JSON Schema in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This JSON Schema

curl "https://apis.io/api/v1/json-schemas/mongodb-federation-oidc-identity-provider"

All schemas

curl "https://apis.io/api/v1/json-schemas?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.