--- title: Identity Providers --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Zero Trust](https://developers.cloudflare.com/api/python/resources/zero_trust) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Identity Providers ##### [List Access identity providers](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/methods/list) zero\_trust.identity\_providers.list(IdentityProviderListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[IdentityProviderListResponse]()] GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers ##### [Get an Access identity provider](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/methods/get) zero\_trust.identity\_providers.get(stridentity\_provider\_id, IdentityProviderGetParams\*\*kwargs) -> [IdentityProvider]() GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers/{identity\_provider\_id} ##### [Add an Access identity provider](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/methods/create) zero\_trust.identity\_providers.create(IdentityProviderCreateParams\*\*kwargs) -> [IdentityProvider]() POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers ##### [Update an Access identity provider](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/methods/update) zero\_trust.identity\_providers.update(stridentity\_provider\_id, IdentityProviderUpdateParams\*\*kwargs) -> [IdentityProvider]() PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers/{identity\_provider\_id} ##### [Delete an Access identity provider](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/methods/delete) zero\_trust.identity\_providers.delete(stridentity\_provider\_id, IdentityProviderDeleteParams\*\*kwargs) -> [IdentityProviderDeleteResponse]() DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers/{identity\_provider\_id} ##### ModelsExpand Collapse
class AzureAD: …
config: Config The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property conditional\_access\_enabled: Optional\[bool] Should Cloudflare try to load authentication contexts from your account Link to this property directory\_id: Optional\[str] Your Azure directory uuid Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
prompt: Optional\[Literal\["login", "select\_account", "none"]] Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction\_required error. prompt=select\_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. One of the following: "login" Link to this property "select\_account" Link to this property "none" Link to this property
Link to this property support\_groups: Optional\[bool] Should Cloudflare try to load groups from your account Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[SAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[SAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20azure_ad%20%3E%20(schema)>)
class GenericOAuthConfig: … client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20generic_oauth_config%20%3E%20(schema)>)
IdentityProvider One of the following:
class AzureAD: …
config: Config The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property conditional\_access\_enabled: Optional\[bool] Should Cloudflare try to load authentication contexts from your account Link to this property directory\_id: Optional\[str] Your Azure directory uuid Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
prompt: Optional\[Literal\["login", "select\_account", "none"]] Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction\_required error. prompt=select\_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. One of the following: "login" Link to this property "select\_account" Link to this property "none" Link to this property
Link to this property support\_groups: Optional\[bool] Should Cloudflare try to load groups from your account Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[SAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[SAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessCentrify: …
config: AccessCentrifyConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. centrify\_account: Optional\[str] Your centrify account url Link to this property centrify\_app\_id: Optional\[str] Your centrify app id Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessCentrifySAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessCentrifySAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessFacebook: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessFacebookSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessFacebookSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessGitHub: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessGitHubSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessGitHubSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessGoogle: …
config: AccessGoogleConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessGoogleSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessGoogleSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessGoogleApps: …
config: AccessGoogleAppsConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. apps\_domain: Optional\[str] Your companies TLD Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
prompt: Optional\[Literal\["none", "consent", "select\_account"]] Configures the prompt behavior for Google authentication. One of the following: "none" Link to this property "consent" Link to this property "select\_account" Link to this property
Link to this property use\_login\_hint: Optional\[bool] Whether to use a previously authenticated Access email as a Google login hint when exactly one email matches the Workspace domain. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessGoogleAppsSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessGoogleAppsSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessLinkedin: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessLinkedinSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessLinkedinSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOIDC: …
config: AccessOIDCConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. auth\_url: Optional\[str] The authorization\_endpoint URL of your IdP Link to this property certs\_url: Optional\[str] The jwks\_uri endpoint of your IdP to allow the IdP keys to sign the tokens Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property pkce\_enabled: Optional\[bool] Enable Proof Key for Code Exchange (PKCE) Link to this property scopes: Optional\[List\[str]] OAuth scopes Link to this property token\_url: Optional\[str] The token\_endpoint URL of your IdP Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOIDCSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOIDCSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOkta: …
config: AccessOktaConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. authorization\_server\_id: Optional\[str] Your okta authorization server id Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property okta\_account: Optional\[str] Your okta account url Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOktaSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOktaSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOnelogin: …
config: AccessOneloginConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property onelogin\_account: Optional\[str] Your OneLogin account url Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOneloginSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOneloginSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessPingone: …
config: AccessPingoneConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property ping\_env\_id: Optional\[str] Your PingOne environment identifier Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessPingoneSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessPingoneSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessSAML: …
config: AccessSAMLConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. attributes: Optional\[List\[str]] A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules. Link to this property email\_attribute\_name: Optional\[str] The attribute name for email in the SAML response. Link to this property enable\_encryption: Optional\[bool] Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set. To enable encryption: 1. Create a certificate set via POST to /identity_providers/{id}/saml_certificate 2. Set this field to true and include saml_certificate_set_id in the PUT request 3. Configure the public certificate in your external Identity Provider Note: Requires saml_certificate_set_id to be set when true. Link to this property force\_authn: Optional\[bool] Asks the IdP to reauthenticate the user for each SAML authentication request. Link to this property
header\_attributes: Optional\[List\[AccessSAMLConfigHeaderAttribute]] Add a list of attribute names that will be returned in the response header from the Access callback. attribute\_name: Optional\[str] attribute name from the IDP Link to this property header\_name: Optional\[str] header that will be added on the request to the origin Link to this property
Link to this property idp\_public\_certs: Optional\[List\[str]] X509 certificate to verify the signature in the SAML authentication response Link to this property issuer\_url: Optional\[str] IdP Entity ID or Issuer URL Link to this property max\_sso\_url\_length: Optional\[int] The maximum URL length the IdP accepts for the SSO redirect URL. When the constructed SSO URL would exceed this length, the RelayState is stored server-side and a short nonce is passed to the IdP instead. Set this if your IdP enforces a URL length limit. maximum100000 minimum512 Link to this property sign\_request: Optional\[bool] Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints. Link to this property sso\_target\_url: Optional\[str] URL to send the SAML authentication requests to Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessSAMLSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessSAMLSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessYandex: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessYandexSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessYandexSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOnetimepin: …
config: AccessOnetimepinConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. redirect\_url: Optional\[str] Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOnetimepinSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOnetimepinSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessCloudflare: …
config: AccessCloudflareConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. redirect\_url: Optional\[str] Link to this property restrict\_to\_account\_members: Optional\[bool] When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessCloudflareSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessCloudflareSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessPasskeys: …
config: AccessPasskeysConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. login\_page\_auto\_prompt: Optional\[bool] When enabled, the Access login page automatically prompts the user to authenticate with a passkey. Link to this property redirect\_url: Optional\[str] Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessPasskeysSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessPasskeysSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider%20%3E%20(schema)>)
class IdentityProviderSCIMConfig: … The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. enabled: Optional\[bool] A flag to enable or disable SCIM for the identity provider. Link to this property
identity\_update\_behavior: Optional\[Literal\["automatic", "reauth", "no\_action"]] Indicates how a SCIM event updates a user identity used for policy evaluation. Use “automatic” to automatically update a user’s identity and augment it with fields from the SCIM user resource. Use “reauth” to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With “reauth” identities will not contain fields from the SCIM user resource. With “no\_action” identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property
Link to this property scim\_base\_url: Optional\[str] The base URL of Cloudflare’s SCIM V2.0 API endpoint. Link to this property seat\_deprovision: Optional\[bool] A flag to remove a user’s seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user\_deprovision is also enabled. Link to this property secret: Optional\[str] A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity\_providers/:idpID/refresh\_scim\_secret. Link to this property user\_deprovision: Optional\[bool] A flag to enable revoking a user’s session in Access and Gateway when they have been deprovisioned in the Identity Provider. Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_scim_config%20%3E%20(schema)>)
Literal\["onetimepin", "azureAD", "saml", 13 more] The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. One of the following: "onetimepin" Link to this property "azureAD" Link to this property "saml" Link to this property "centrify" Link to this property "facebook" Link to this property "github" Link to this property "google-apps" Link to this property "google" Link to this property "linkedin" Link to this property "oidc" Link to this property "okta" Link to this property "onelogin" Link to this property "pingone" Link to this property "yandex" Link to this property "cloudflare" Link to this property "passkeys" Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_type%20%3E%20(schema)>)
IdentityProviderListResponse One of the following:
class AzureAD: …
config: Config The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property conditional\_access\_enabled: Optional\[bool] Should Cloudflare try to load authentication contexts from your account Link to this property directory\_id: Optional\[str] Your Azure directory uuid Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
prompt: Optional\[Literal\["login", "select\_account", "none"]] Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction\_required error. prompt=select\_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. One of the following: "login" Link to this property "select\_account" Link to this property "none" Link to this property
Link to this property support\_groups: Optional\[bool] Should Cloudflare try to load groups from your account Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[SAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[SAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessCentrify: …
config: AccessCentrifyConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. centrify\_account: Optional\[str] Your centrify account url Link to this property centrify\_app\_id: Optional\[str] Your centrify app id Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessCentrifySAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessCentrifySAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessFacebook: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessFacebookSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessFacebookSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessGitHub: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessGitHubSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessGitHubSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessGoogle: …
config: AccessGoogleConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessGoogleSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessGoogleSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessGoogleApps: …
config: AccessGoogleAppsConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. apps\_domain: Optional\[str] Your companies TLD Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
prompt: Optional\[Literal\["none", "consent", "select\_account"]] Configures the prompt behavior for Google authentication. One of the following: "none" Link to this property "consent" Link to this property "select\_account" Link to this property
Link to this property use\_login\_hint: Optional\[bool] Whether to use a previously authenticated Access email as a Google login hint when exactly one email matches the Workspace domain. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessGoogleAppsSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessGoogleAppsSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessLinkedin: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessLinkedinSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessLinkedinSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOIDC: …
config: AccessOIDCConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. auth\_url: Optional\[str] The authorization\_endpoint URL of your IdP Link to this property certs\_url: Optional\[str] The jwks\_uri endpoint of your IdP to allow the IdP keys to sign the tokens Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property pkce\_enabled: Optional\[bool] Enable Proof Key for Code Exchange (PKCE) Link to this property scopes: Optional\[List\[str]] OAuth scopes Link to this property token\_url: Optional\[str] The token\_endpoint URL of your IdP Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOIDCSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOIDCSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOkta: …
config: AccessOktaConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. authorization\_server\_id: Optional\[str] Your okta authorization server id Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property okta\_account: Optional\[str] Your okta account url Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOktaSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOktaSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOnelogin: …
config: AccessOneloginConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property onelogin\_account: Optional\[str] Your OneLogin account url Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOneloginSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOneloginSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessPingone: …
config: AccessPingoneConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property ping\_env\_id: Optional\[str] Your PingOne environment identifier Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessPingoneSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessPingoneSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessSAML: …
config: AccessSAMLConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. attributes: Optional\[List\[str]] A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules. Link to this property email\_attribute\_name: Optional\[str] The attribute name for email in the SAML response. Link to this property enable\_encryption: Optional\[bool] Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set. To enable encryption: 1. Create a certificate set via POST to /identity_providers/{id}/saml_certificate 2. Set this field to true and include saml_certificate_set_id in the PUT request 3. Configure the public certificate in your external Identity Provider Note: Requires saml_certificate_set_id to be set when true. Link to this property force\_authn: Optional\[bool] Asks the IdP to reauthenticate the user for each SAML authentication request. Link to this property
header\_attributes: Optional\[List\[AccessSAMLConfigHeaderAttribute]] Add a list of attribute names that will be returned in the response header from the Access callback. attribute\_name: Optional\[str] attribute name from the IDP Link to this property header\_name: Optional\[str] header that will be added on the request to the origin Link to this property
Link to this property idp\_public\_certs: Optional\[List\[str]] X509 certificate to verify the signature in the SAML authentication response Link to this property issuer\_url: Optional\[str] IdP Entity ID or Issuer URL Link to this property max\_sso\_url\_length: Optional\[int] The maximum URL length the IdP accepts for the SSO redirect URL. When the constructed SSO URL would exceed this length, the RelayState is stored server-side and a short nonce is passed to the IdP instead. Set this if your IdP enforces a URL length limit. maximum100000 minimum512 Link to this property sign\_request: Optional\[bool] Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints. Link to this property sso\_target\_url: Optional\[str] URL to send the SAML authentication requests to Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessSAMLSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessSAMLSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessYandex: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessYandexSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessYandexSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOnetimepin: …
config: AccessOnetimepinConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. redirect\_url: Optional\[str] Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOnetimepinSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOnetimepinSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessCloudflare: …
config: AccessCloudflareConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. redirect\_url: Optional\[str] Link to this property restrict\_to\_account\_members: Optional\[bool] When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessCloudflareSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessCloudflareSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessPasskeys: …
config: AccessPasskeysConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. login\_page\_auto\_prompt: Optional\[bool] When enabled, the Access login page automatically prompts the user to authenticate with a passkey. Link to this property redirect\_url: Optional\[str] Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessPasskeysSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessPasskeysSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_list_response%20%3E%20(schema)>)
class IdentityProviderDeleteResponse: … id: Optional\[str] UUID. maxLength36 Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_delete_response%20%3E%20(schema)>) #### Identity ProvidersSCIM #### Identity ProvidersSCIMGroups ##### [List SCIM Group resources](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/subresources/scim/subresources/groups/methods/list) zero\_trust.identity\_providers.scim.groups.list(stridentity\_provider\_id, GroupListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[ZeroTrustGroup]()] GET/accounts/{account\_id}/access/identity\_providers/{identity\_provider\_id}/scim/groups #### Identity ProvidersSCIMUsers ##### [List SCIM User resources](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/subresources/scim/subresources/users/methods/list) zero\_trust.identity\_providers.scim.users.list(stridentity\_provider\_id, UserListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[AccessUser]()] GET/accounts/{account\_id}/access/identity\_providers/{identity\_provider\_id}/scim/users #### Identity ProvidersSAML Certificate ##### [Create SAML encryption certificate for Identity Provider](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/subresources/saml_certificate/methods/create) zero\_trust.identity\_providers.saml\_certificate.create(stridentity\_provider\_id, SAMLCertificateCreateParams\*\*kwargs) -> [SAMLCertificateCreateResponse]() POST/accounts/{account\_id}/access/identity\_providers/{identity\_provider\_id}/saml\_certificate ##### ModelsExpand Collapse
class SAMLCertificateCreateResponse: … A SAML encryption certificate set containing current and optionally previous certificates for encryption key rotation. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[CurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers.saml_certificate%20%3E%20(model)%20saml_certificate_create_response%20%3E%20(schema)>)