---
title: "POST /identities/GetOauth2CredentialProvider"
method: POST
path: "/identities/GetOauth2CredentialProvider"
---

# POST /identities/GetOauth2CredentialProvider

`POST /identities/GetOauth2CredentialProvider`

Retrieves information about an OAuth2 credential provider.

## Request body

- object
  - `name` string, required — The name of the OAuth2 credential provider to retrieve.

## Response `200`

Success

- GetOauth2CredentialProviderResponse
  - `clientSecretArn` object, required — The Amazon Resource Name (ARN) of the client secret in Amazon Web Services Secrets Manager.
    - `secretArn` string, required — The Amazon Resource Name (ARN) of the secret in Amazon Web Services Secrets Manager.
  - `clientSecretJsonKey` string — The JSON key used to extract the client secret value from the Amazon Web Services Secrets Manager secret.
  - `clientSecretSource` 'MANAGED' | 'EXTERNAL' — The source type of the client secret. Either <code>MANAGED</code> if the secret is managed by the service, or <code>EXTERNAL</code> if managed by the user in Amazon Web Services Secrets Manager.
  - `name` string, required — The name of the OAuth2 credential provider.
  - `credentialProviderArn` string, required — ARN of the credential provider requested.
  - `credentialProviderVendor` 'GoogleOauth2' | 'GithubOauth2' | 'SlackOauth2' | 'SalesforceOauth2' | 'MicrosoftOauth2' | 'CustomOauth2' | 'AtlassianOauth2' | 'LinkedinOauth2' | 'XOauth2' | 'OktaOauth2' | 'OneLoginOauth2' | 'PingOneOauth2' | 'FacebookOauth2' | 'YandexOauth2' | 'RedditOauth2' | 'ZoomOauth2' | 'TwitchOauth2' | 'SpotifyOauth2' | 'DropboxOauth2' | 'NotionOauth2' | 'HubspotOauth2' | 'CyberArkOauth2' | 'FusionAuthOauth2' | 'Auth0Oauth2' | 'CognitoOauth2', required — The vendor of the OAuth2 credential provider.
  - `callbackUrl` string — Callback URL to register on the OAuth2 credential provider as an allowed callback URL. This URL is where the OAuth2 authorization server redirects users after they complete the authorization flow.
  - `oauth2ProviderConfigOutput` object, required — The configuration output for the OAuth2 provider.
    - `customOauth2ProviderConfig` object — The output configuration for a custom OAuth2 provider.
      - `oauthDiscovery` object, required — The OAuth2 discovery information for the custom provider.
        - `discoveryUrl` string — The discovery URL for the OAuth2 provider.
        - `authorizationServerMetadata` object — The authorization server metadata for the OAuth2 provider.
          - `issuer` string, required — The issuer URL for the OAuth2 authorization server.
          - `authorizationEndpoint` string, required — The authorization endpoint URL for the OAuth2 authorization server.
          - `tokenEndpoint` string, required — The token endpoint URL for the OAuth2 authorization server.
          - `responseTypes` ResponseType[] — The supported response types for the OAuth2 authorization server.
          - `tokenEndpointAuthMethods` TokenAuthMethod[] — The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
      - `clientId` string — The client ID for the custom OAuth2 provider.
      - `privateEndpoint` object — The default private endpoint for the custom OAuth2 provider, enabling secure connectivity through a VPC Lattice resource configuration.
        - `selfManagedLatticeResource` object — Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
          - `resourceConfigurationIdentifier` string — The ARN or ID of the VPC Lattice resource configuration.
        - `managedVpcResource` object — Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
          - `vpcIdentifier` string, required — The ID of the VPC that contains your private resource.
          - `subnetIds` SubnetId[], required — The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
          - `endpointIpAddressType` 'IPV4' | 'IPV6', required — The IP address type for the resource configuration endpoint.
          - `securityGroupIds` SecurityGroupIdentifier[] — The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
          - `tags` object — Tags to apply to the managed VPC Lattice resource gateway.
          - `routingDomain` string — An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
      - `privateEndpointOverrides` PrivateEndpointOverride[] — The private endpoint overrides for the custom OAuth2 provider configuration.
        - `domain` string, required — The domain to override with a private endpoint.
        - `privateEndpoint` object, required — The private endpoint configuration for the specified domain.
          - `selfManagedLatticeResource` object — Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
            - `resourceConfigurationIdentifier` string — The ARN or ID of the VPC Lattice resource configuration.
          - `managedVpcResource` object — Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
            - `vpcIdentifier` string, required — The ID of the VPC that contains your private resource.
            - `subnetIds` SubnetId[], required — The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
            - `endpointIpAddressType` 'IPV4' | 'IPV6', required — The IP address type for the resource configuration endpoint.
            - `securityGroupIds` SecurityGroupIdentifier[] — The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
            - `tags` object — Tags to apply to the managed VPC Lattice resource gateway.
            - `routingDomain` string — An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
      - `onBehalfOfTokenExchangeConfig` object — The configuration for on-behalf-of token exchange.
        - `grantType` 'TOKEN_EXCHANGE' | 'JWT_AUTHORIZATION_GRANT', required — The grant type for the on-behalf-of token exchange.
        - `tokenExchangeGrantTypeConfig` object — Configuration specific to the TOKEN_EXCHANGE grant type (RFC 8693).
          - `actorTokenContent` 'NONE' | 'M2M' | 'AWS_IAM_ID_TOKEN_JWT', required — The content type for the actor token in the token exchange.
          - `actorTokenScopes` ScopeType[] — The scopes for the actor token. Only valid when actorTokenContent is M2M.
      - `clientAuthenticationMethod` 'CLIENT_SECRET_BASIC' | 'CLIENT_SECRET_POST' | 'AWS_IAM_ID_TOKEN_JWT' — The client authentication method used when authenticating with the token endpoint.
    - `googleOauth2ProviderConfig` object — The output configuration for a Google OAuth2 provider.
      - `oauthDiscovery` object, required — The OAuth2 discovery information for the Google provider.
        - `discoveryUrl` string — The discovery URL for the OAuth2 provider.
        - `authorizationServerMetadata` object — The authorization server metadata for the OAuth2 provider.
          - `issuer` string, required — The issuer URL for the OAuth2 authorization server.
          - `authorizationEndpoint` string, required — The authorization endpoint URL for the OAuth2 authorization server.
          - `tokenEndpoint` string, required — The token endpoint URL for the OAuth2 authorization server.
          - `responseTypes` ResponseType[] — The supported response types for the OAuth2 authorization server.
          - `tokenEndpointAuthMethods` TokenAuthMethod[] — The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
      - `clientId` string — The client ID for the Google OAuth2 provider.
    - `githubOauth2ProviderConfig` object — The output configuration for a GitHub OAuth2 provider.
      - `oauthDiscovery` object, required — The OAuth2 discovery information for the GitHub provider.
        - `discoveryUrl` string — The discovery URL for the OAuth2 provider.
        - `authorizationServerMetadata` object — The authorization server metadata for the OAuth2 provider.
          - `issuer` string, required — The issuer URL for the OAuth2 authorization server.
          - `authorizationEndpoint` string, required — The authorization endpoint URL for the OAuth2 authorization server.
          - `tokenEndpoint` string, required — The token endpoint URL for the OAuth2 authorization server.
          - `responseTypes` ResponseType[] — The supported response types for the OAuth2 authorization server.
          - `tokenEndpointAuthMethods` TokenAuthMethod[] — The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
      - `clientId` string — The client ID for the GitHub OAuth2 provider.
    - `slackOauth2ProviderConfig` object — The output configuration for a Slack OAuth2 provider.
      - `oauthDiscovery` object, required — The OAuth2 discovery information for the Slack provider.
        - `discoveryUrl` string — The discovery URL for the OAuth2 provider.
        - `authorizationServerMetadata` object — The authorization server metadata for the OAuth2 provider.
          - `issuer` string, required — The issuer URL for the OAuth2 authorization server.
          - `authorizationEndpoint` string, required — The authorization endpoint URL for the OAuth2 authorization server.
          - `tokenEndpoint` string, required — The token endpoint URL for the OAuth2 authorization server.
          - `responseTypes` ResponseType[] — The supported response types for the OAuth2 authorization server.
          - `tokenEndpointAuthMethods` TokenAuthMethod[] — The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
      - `clientId` string — The client ID for the Slack OAuth2 provider.
    - `salesforceOauth2ProviderConfig` object — The output configuration for a Salesforce OAuth2 provider.
      - `oauthDiscovery` object, required — The OAuth2 discovery information for the Salesforce provider.
        - `discoveryUrl` string — The discovery URL for the OAuth2 provider.
        - `authorizationServerMetadata` object — The authorization server metadata for the OAuth2 provider.
          - `issuer` string, required — The issuer URL for the OAuth2 authorization server.
          - `authorizationEndpoint` string, required — The authorization endpoint URL for the OAuth2 authorization server.
          - `tokenEndpoint` string, required — The token endpoint URL for the OAuth2 authorization server.
          - `responseTypes` ResponseType[] — The supported response types for the OAuth2 authorization server.
          - `tokenEndpointAuthMethods` TokenAuthMethod[] — The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
      - `clientId` string — The client ID for the Salesforce OAuth2 provider.
    - `microsoftOauth2ProviderConfig` object — The output configuration for a Microsoft OAuth2 provider.
      - `oauthDiscovery` object, required — The OAuth2 discovery information for the Microsoft provider.
        - `discoveryUrl` string — The discovery URL for the OAuth2 provider.
        - `authorizationServerMetadata` object — The authorization server metadata for the OAuth2 provider.
          - `issuer` string, required — The issuer URL for the OAuth2 authorization server.
          - `authorizationEndpoint` string, required — The authorization endpoint URL for the OAuth2 authorization server.
          - `tokenEndpoint` string, required — The token endpoint URL for the OAuth2 authorization server.
          - `responseTypes` ResponseType[] — The supported response types for the OAuth2 authorization server.
          - `tokenEndpointAuthMethods` TokenAuthMethod[] — The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
      - `clientId` string — The client ID for the Microsoft OAuth2 provider.
    - `atlassianOauth2ProviderConfig` object — The configuration details for the Atlassian OAuth2 provider.
      - `oauthDiscovery` Oauth2Discovery, required — Contains the discovery information for an OAuth2 provider.
        - `discoveryUrl` string — The discovery URL for the OAuth2 provider.
        - `authorizationServerMetadata` object — The authorization server metadata for the OAuth2 provider.
          - `issuer` string, required — The issuer URL for the OAuth2 authorization server.
          - `authorizationEndpoint` string, required — The authorization endpoint URL for the OAuth2 authorization server.
          - `tokenEndpoint` string, required — The token endpoint URL for the OAuth2 authorization server.
          - `responseTypes` ResponseType[] — The supported response types for the OAuth2 authorization server.
          - `tokenEndpointAuthMethods` TokenAuthMethod[] — The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
      - `clientId` string — The client ID for the Atlassian OAuth2 provider.
    - `linkedinOauth2ProviderConfig` object — The configuration details for the LinkedIn OAuth2 provider.
      - `oauthDiscovery` Oauth2Discovery, required — Contains the discovery information for an OAuth2 provider.
        - `discoveryUrl` string — The discovery URL for the OAuth2 provider.
        - `authorizationServerMetadata` object — The authorization server metadata for the OAuth2 provider.
          - `issuer` string, required — The issuer URL for the OAuth2 authorization server.
          - `authorizationEndpoint` string, required — The authorization endpoint URL for the OAuth2 authorization server.
          - `tokenEndpoint` string, required — The token endpoint URL for the OAuth2 authorization server.
          - `responseTypes` ResponseType[] — The supported response types for the OAuth2 authorization server.
          - `tokenEndpointAuthMethods` TokenAuthMethod[] — The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
      - `clientId` string — The client ID for the LinkedIn OAuth2 provider.
    - `includedOauth2ProviderConfig` object — The configuration for a non-custom OAuth2 provider. This includes the configuration details for supported OAuth2 providers that have built-in integration support.
      - `oauthDiscovery` Oauth2Discovery, required — Contains the discovery information for an OAuth2 provider.
        - `discoveryUrl` string — The discovery URL for the OAuth2 provider.
        - `authorizationServerMetadata` object — The authorization server metadata for the OAuth2 provider.
          - `issuer` string, required — The issuer URL for the OAuth2 authorization server.
          - `authorizationEndpoint` string, required — The authorization endpoint URL for the OAuth2 authorization server.
          - `tokenEndpoint` string, required — The token endpoint URL for the OAuth2 authorization server.
          - `responseTypes` ResponseType[] — The supported response types for the OAuth2 authorization server.
          - `tokenEndpointAuthMethods` TokenAuthMethod[] — The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
      - `clientId` string — The client ID for the supported OAuth2 provider.
  - `createdTime` string, date-time, required — The timestamp when the OAuth2 credential provider was created.
  - `lastUpdatedTime` string, date-time, required — The timestamp when the OAuth2 credential provider was last updated.
  - `status` 'CREATING' | 'CREATE_FAILED' | 'UPDATING' | 'UPDATE_FAILED' | 'READY' | 'DELETING' | 'DELETE_FAILED' — The current status of the OAuth2 credential provider.
  - `failureReason` string — The reason for failure if the OAuth2 credential provider is in a failed state.

## Other responses

- `480` — UnauthorizedException
- `481` — ValidationException
- `482` — AccessDeniedException
- `483` — DecryptionFailure
- `484` — ResourceNotFoundException
- `485` — ThrottlingException
- `486` — InternalServerException

---

[API](https://skmtc.net/aws/apis/bedrock-agentcore-control.md) · [All operations](https://skmtc.net/aws/apis/bedrock-agentcore-control/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/bedrock-agentcore-control/revisions/0ebde766792b/schema)