> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mountthor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create IdP

> Adds an external OIDC issuer to the customer's trust boundary. The issuer URL
is canonicalized on write, and active issuers must be unique per customer.



## OpenAPI

````yaml /api-reference/customer-api.v1.openapi.json post /v1/admin/identity/providers
openapi: 3.1.0
info:
  title: Mount Thor Customer API
  version: v1
servers:
  - description: Mount Thor customer API edge
    url: https://api.mountthor.com
security: []
paths:
  /v1/admin/identity/providers:
    post:
      tags:
        - identity-workload
      summary: Create IdP
      description: >-
        Adds an external OIDC issuer to the customer's trust boundary. The
        issuer URL

        is canonicalized on write, and active issuers must be unique per
        customer.
      operationId: create_trusted_issuer
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TrustedIssuerCreateRequest'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TrustedIssuerResponse'
          description: IdP registered
        '400':
          description: Request body failed validation
        '401':
          description: Missing or invalid customer API key
        '403':
          description: API key is missing issuers:write scope
        '409':
          description: An active issuer already exists for this issuer URL
        '429':
          content:
            text/plain:
              schema:
                type: string
          description: Rate limit exceeded
          headers:
            Retry-After:
              description: Seconds before retry.
              schema:
                minimum: 1
                type: integer
      security:
        - api_key_bearer:
            - issuers:write
components:
  schemas:
    TrustedIssuerCreateRequest:
      additionalProperties: false
      description: Request body for `POST /v1/admin/identity/providers`.
      properties:
        allowed_clock_skew_seconds:
          description: Permitted clock skew (seconds) when checking `exp`/`nbf`/`iat`.
          example: 60
          format: int64
          type:
            - integer
            - 'null'
        audiences:
          example:
            - api.mountthor.com
          items:
            type: string
          type: array
        display_name:
          description: Customer-facing label for the issuer.
          example: GitHub Actions OIDC
          maxLength: 200
          type: string
        issuer:
          description: >-
            OIDC issuer identifier. Stored canonicalized (trailing slash
            stripped)

            so the token `iss` claim is compared against a single normalized
            form.
          example: https://token.actions.githubusercontent.com
          maxLength: 512
          type: string
        jwks_document_ref:
          description: >-
            Out-of-band JWKS document reference. Required when
            `jwks_source_type`

            is `stored-jwks`.
          maxLength: 512
          type:
            - string
            - 'null'
        jwks_source_type:
          description: '`discovery` (default), `https`, or `stored-jwks`.'
          example: discovery
          type: string
        jwks_uri:
          description: Explicit JWKS URI. Required when `jwks_source_type` is `https`.
          maxLength: 512
          type:
            - string
            - 'null'
      required:
        - display_name
        - issuer
        - audiences
      type: object
    TrustedIssuerResponse:
      allOf:
        - $ref: '#/components/schemas/TrustedIssuerMetadata'
        - additionalProperties: false
          properties:
            customer_id:
              description: Stable UUID for the customer account.
              type: string
          required:
            - customer_id
          type: object
      description: Identity provider detail response.
    TrustedIssuerMetadata:
      additionalProperties: false
      description: Identity provider metadata.
      properties:
        allowed_clock_skew_seconds:
          description: Clock skew allowed when validating token time claims.
          example: 60
          format: int64
          type: integer
        audiences:
          description: Accepted token audiences.
          example:
            - api.mountthor.com
          items:
            type: string
          type: array
        created_at:
          description: RFC 3339 creation timestamp.
          example: '2026-05-25T17:20:00Z'
          type: string
        display_name:
          description: Customer-facing IdP label.
          example: GitHub Actions OIDC
          type: string
        id:
          description: Stable IdP UUID.
          type: string
        issuer:
          description: Canonical OIDC issuer URL used to match the token `iss` claim.
          example: https://token.actions.githubusercontent.com
          type: string
        issuer_type:
          description: IdP category. Currently `oidc`.
          example: oidc
          type: string
        jwks_document_ref:
          description: Stored JWKS reference when `jwks_source_type` is `stored-jwks`.
          type:
            - string
            - 'null'
        jwks_source_type:
          description: 'JWKS resolution mode: `discovery`, `https`, or `stored-jwks`.'
          example: discovery
          type: string
        jwks_uri:
          description: Explicit JWKS URI when `jwks_source_type` is `https`.
          type:
            - string
            - 'null'
        status:
          description: IdP lifecycle state. Disabled IdPs cannot mint sessions.
          example: active
          type: string
        updated_at:
          description: RFC 3339 update timestamp.
          example: '2026-05-25T17:30:00Z'
          type: string
      required:
        - id
        - display_name
        - issuer_type
        - issuer
        - jwks_source_type
        - audiences
        - allowed_clock_skew_seconds
        - status
        - created_at
        - updated_at
      type: object
  securitySchemes:
    api_key_bearer:
      bearerFormat: mthr_live_*
      description: Bearer scheme name used by typed customer admin operations.
      scheme: bearer
      type: http

````