Skip to main content
PATCH
Update IdP

Authorizations

Authorization
string
header
required

Bearer scheme name used by typed customer admin operations.

Path Parameters

id
string<uuid>
required

IdP UUID

Body

application/json

Request body for PATCH /v1/admin/identity/providers/{id}.

The trust root (issuer URL + JWKS source) is intentionally immutable — re-register to rotate it, so a silent change of which keys are trusted cannot ride in on an update. Mutable: label, accepted audiences, clock skew, and status (disable / re-enable).

allowed_clock_skew_seconds
integer<int64> | null

Replacement clock skew allowance in seconds.

Example:

60

audiences
string[] | null

Replacement accepted token audiences.

Example:
display_name
string | null

New customer-facing label.

Maximum string length: 200
status
string | null

New lifecycle state: active or disabled.

Example:

"disabled"

Response

IdP updated

Identity provider detail response.

allowed_clock_skew_seconds
integer<int64>
required

Clock skew allowed when validating token time claims.

Example:

60

audiences
string[]
required

Accepted token audiences.

Example:
created_at
string
required

RFC 3339 creation timestamp.

Example:

"2026-05-25T17:20:00Z"

display_name
string
required

Customer-facing IdP label.

Example:

"GitHub Actions OIDC"

id
string
required

Stable IdP UUID.

issuer
string
required

Canonical OIDC issuer URL used to match the token iss claim.

Example:

"https://token.actions.githubusercontent.com"

issuer_type
string
required

IdP category. Currently oidc.

Example:

"oidc"

jwks_source_type
string
required

JWKS resolution mode: discovery, https, or stored-jwks.

Example:

"discovery"

status
string
required

IdP lifecycle state. Disabled IdPs cannot mint sessions.

Example:

"active"

updated_at
string
required

RFC 3339 update timestamp.

Example:

"2026-05-25T17:30:00Z"

customer_id
string
required

Stable UUID for the customer account.

jwks_document_ref
string | null

Stored JWKS reference when jwks_source_type is stored-jwks.

jwks_uri
string | null

Explicit JWKS URI when jwks_source_type is https.