---
title: "Set Up an Identity Provider"
method: POST
path: "/v2.0/identityprovider/configure"
tags: ["Identity Providers"]
---

# Set Up an Identity Provider

`POST /v2.0/identityprovider/configure`

Sets up an identity provider (SAML or OIDC) for your organization, including login/logout URLs, certificates, client credentials, and security settings, enabling Single Sign-On (SSO) authentication.

## Headers

- `Accept` 'application/json' | 'application/hal+json' | 'application/xml' | 'text/xml' | 'text/csv'

## Request body

- union
  - object
    - `idpType` 'saml'
    - `idpIssuer` string, url — The value that will be in the issuer field in the SAML request.
    - `idpLoginEndpoint` string, url — The URL to use to login in the IDP. Used in the SP initiated Flow.
    - `idpLogoutEndpoint` string, url — The URL to send SLO requests against. Not all identity providers support this.
    - `idpCertificate` string — The certificate from the ID used to sign the SAML requests. It is base64 encoded.
    - `wantAuthnResponseSigned` boolean — If the SAML authentification response should be signed, not all providers support this.
    - `decryptionPrivateKey` string — An optional decryption key. This is necessary if the SAML request is encoded.
    - `idpDisableRequestedAuthnContext` boolean — For some providers, e.g. Azure on-prem, it might be necessary to disable the authn context field in the SAML request.
  - object
    - `idpType` 'oidc'
    - `idpIssuer` string, url — The URL of the OIDC identity provider. Must include `https://` to ensure a secure connection. Example `https://accounts.google.com`.
    - `idpClientId` string — The client identifier issued to the client during the registration process. The authorization server issues the registered client a client identifier -- a unique string representing the registration information provided by the client. The client identifier is not a secret; it is exposed to the resource owner and MUST NOT be used alone for client authentication. The client identifier is unique to the authorization server. https://tools.ietf.org/html/rfc6749#section-2.3.1
    - `idpClientSecret` string — This value is used by Confidential Clients to authenticate to the Token Endpoint, as described in Section 2.3.1 of OAuth 2.0, and for the derivation of symmetric encryption key values, as described in Section 10.2 of OpenID Connect Core 1.0 [OpenID.Core]. https://tools.ietf.org/html/rfc6749#section-2.3.1 https://openid.net/specs/openid-connect-core-1_0.html#Encryption
    - `idpAdditionalScope` string — The scopes associated with Access Tokens determine what resources will be available when they are used to access OAuth 2.0 protected endpoints. For OpenID Connect, scopes can be used to request that specific sets of information be made available as Claim Values. The scopes openid, profile, email and offline_access are always requested.
    - `idpFrontChannelLogoutUrl` string, url
    - `idpIdTokenSignedResponseAlg` 'RS256' | 'RS384' | 'RS512' | 'HS256' | 'HS384' | 'HS512' — The Algorithm used to sign the ID Token issued to this Client.
    - `idpTokenEndpointAuthMethod` 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'tls_client_auth' | 'self_signed_tls_client_auth' | 'none' — Requested Client Authentication method for the Token Endpoint. https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication

## Response `204`

The identity provider was configured for your organisation.

## Other responses

- `400` — The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing)
- `401` — The request has not been applied because it lacks valid authentication credentials for the target resource.
- `402` — Upgrade your Plan to increase your Quota.
- `403` — The server understood the request but refuses to authorize it.
- `404` — The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.
- `405` — The method received in the request-line is known by the origin server but not supported by the target resource.
- `409` — The request conflicts with current state of the server.
- `413` — The request entity is larger than limits defined by server.
- `500` — The server encountered an unexpected condition that prevented it from fulfilling the request.
- `501` — The server does not support the functionality required to fulfill the request.
- `502` — The server, while acting as a gateway or proxy, received an invalid response from an inbound server it accessed while attempting to fulfill the request.
- `503` — The server is not ready to handle the request.
- `504` — The server, while acting as a gateway or proxy, did not receive a timely response from an upstream server it needed to access in order to complete the request.

---

[API](https://skmtc.net/cognigy/apis/simulator-openapi-rest-ful-api-reference.md) · [All operations](https://skmtc.net/cognigy/apis/simulator-openapi-rest-ful-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cognigy/simulator-openapi-rest-ful-api-reference/revisions/85b2872bdfb7/schema)