--- title: Get an Access identity provider --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [Zero Trust](https://developers.cloudflare.com/api/resources/zero_trust) [Identity Providers](https://developers.cloudflare.com/api/resources/zero_trust/subresources/identity_providers) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Get an Access identity provider GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers/{identity\_provider\_id} Fetches a configured identity provider. ##### Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token. **Example:**Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**X-Auth-Email: user@example.com The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

##### Accepted Permissions (at least one required) `Access: Organizations, Identity Providers, and Groups Write``Access: Organizations, Identity Providers, and Groups Read` ##### P ath ParametersExpand Collapse identity\_provider\_id: string UUID. maxLength36 [Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(method)%20get%20%3E%20(params)%20default%20%3E%20(param)%20identity_provider_id%20%3E%20(schema)>) account\_id: optional string The Account ID to use for this endpoint. Mutually exclusive with the Zone ID. [Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(method)%20get%20%3E%20(params)%20default%20%3E%20(param)%20account_id%20%3E%20(schema)>) zone\_id: optional string The Zone ID to use for this endpoint. Mutually exclusive with the Account ID. [Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(method)%20get%20%3E%20(params)%20default%20%3E%20(param)%20zone_id%20%3E%20(schema)>) ##### ReturnsExpand Collapse

errors: array of object {code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(method)%20get%20%3E%20(network%20schema)%20%3E%20(property)%20errors>)

messages: array of object {code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(method)%20get%20%3E%20(network%20schema)%20%3E%20(property)%20messages>) success: true Whether the API call was successful. [Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(method)%20get%20%3E%20(network%20schema)%20%3E%20(property)%20success>)

result: optional IdentityProvider

One of the following:

AzureAD object {config, name, type, 5 more }

config: object {claims, client\_id, client\_secret, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

claims: optional array of string Custom claims Link to this property client\_id: optional string Your OAuth Client ID Link to this property client\_secret: optional string Your OAuth Client Secret Link to this property conditional\_access\_enabled: optional boolean Should Cloudflare try to load authentication contexts from your account Link to this property directory\_id: optional string Your Azure directory uuid Link to this property email\_claim\_name: optional string The claim name for email in the id\_token response. Link to this property

prompt: optional "login"or "select\_account"or "none" Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction\_required error. prompt=select\_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.

One of the following: "login" Link to this property "select\_account" Link to this property "none" Link to this property

Link to this property support\_groups: optional boolean Should Cloudflare try to load groups from your account Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

Link to this property id: optional string UUID. maxLength36 Link to this property read\_only: optional boolean Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property

saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more } The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.

created\_at: string Timestamp when the certificate set was created formatdate-time Link to this property uid: string Unique identifier for the certificate set formatuuid Link to this property updated\_at: string Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

is\_current: boolean Indicates whether this is the currently active certificate Link to this property not\_after: string Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: string Unique identifier for the certificate formatuuid Link to this property

Link to this property previous\_certificate: optional unknown The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property

Link to this property saml\_certificate\_set\_id: optional string The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property

scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more } The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

identity\_update\_behavior: optional "automatic"or "reauth"or "no\_action" Indicates how a SCIM event updates a user identity used for policy evaluation. Use “automatic” to automatically update a user’s identity and augment it with fields from the SCIM user resource. Use “reauth” to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With “reauth” identities will not contain fields from the SCIM user resource. With “no\_action” identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property scim\_base\_url: optional string The base URL of Cloudflare’s SCIM V2.0 API endpoint. Link to this property seat\_deprovision: optional boolean A flag to remove a user’s seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user\_deprovision is also enabled. Link to this property secret: optional string A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity\_providers/:idpID/refresh\_scim\_secret. Link to this property user\_deprovision: optional boolean A flag to enable revoking a user’s session in Access and Gateway when they have been deprovisioned in the Identity Provider. Link to this property

Link to this property

AccessCentrify object {config, name, type, 5 more }

config: object {centrify\_account, centrify\_app\_id, claims, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

centrify\_account: optional string Your centrify account url Link to this property centrify\_app\_id: optional string Your centrify app id Link to this property claims: optional array of string Custom claims Link to this property client\_id: optional string Your OAuth Client ID Link to this property client\_secret: optional string Your OAuth Client Secret Link to this property email\_claim\_name: optional string The claim name for email in the id\_token response. Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessFacebook object {config, name, type, 5 more }

config: GenericOAuthConfig { client\_id, client\_secret } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

client\_id: optional string Your OAuth Client ID Link to this property client\_secret: optional string Your OAuth Client Secret Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessGitHub object {config, name, type, 5 more }

client\_id: optional string Your OAuth Client ID Link to this property client\_secret: optional string Your OAuth Client Secret Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessGoogle object {config, name, type, 5 more }

config: object {claims, client\_id, client\_secret, email\_claim\_name } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

claims: optional array of string Custom claims Link to this property client\_id: optional string Your OAuth Client ID Link to this property client\_secret: optional string Your OAuth Client Secret Link to this property email\_claim\_name: optional string The claim name for email in the id\_token response. Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessGoogleApps object {config, name, type, 5 more }

config: object {apps\_domain, claims, client\_id, 4 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

apps\_domain: optional string Your companies TLD Link to this property claims: optional array of string Custom claims Link to this property client\_id: optional string Your OAuth Client ID Link to this property client\_secret: optional string Your OAuth Client Secret Link to this property email\_claim\_name: optional string The claim name for email in the id\_token response. Link to this property

prompt: optional "none"or "consent"or "select\_account" Configures the prompt behavior for Google authentication.

One of the following: "none" Link to this property "consent" Link to this property "select\_account" Link to this property

Link to this property use\_login\_hint: optional boolean Whether to use a previously authenticated Access email as a Google login hint when exactly one email matches the Workspace domain. Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessLinkedin object {config, name, type, 5 more }

client\_id: optional string Your OAuth Client ID Link to this property client\_secret: optional string Your OAuth Client Secret Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessOIDC object {config, name, type, 5 more }

config: object {auth\_url, certs\_url, claims, 6 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

auth\_url: optional string The authorization\_endpoint URL of your IdP Link to this property certs\_url: optional string The jwks\_uri endpoint of your IdP to allow the IdP keys to sign the tokens Link to this property claims: optional array of string Custom claims Link to this property client\_id: optional string Your OAuth Client ID Link to this property client\_secret: optional string Your OAuth Client Secret Link to this property email\_claim\_name: optional string The claim name for email in the id\_token response. Link to this property pkce\_enabled: optional boolean Enable Proof Key for Code Exchange (PKCE) Link to this property scopes: optional array of string OAuth scopes Link to this property token\_url: optional string The token\_endpoint URL of your IdP Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessOkta object {config, name, type, 5 more }

config: object {authorization\_server\_id, claims, client\_id, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

authorization\_server\_id: optional string Your okta authorization server id Link to this property claims: optional array of string Custom claims Link to this property client\_id: optional string Your OAuth Client ID Link to this property client\_secret: optional string Your OAuth Client Secret Link to this property email\_claim\_name: optional string The claim name for email in the id\_token response. Link to this property okta\_account: optional string Your okta account url Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessOnelogin object {config, name, type, 5 more }

config: object {claims, client\_id, client\_secret, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

claims: optional array of string Custom claims Link to this property client\_id: optional string Your OAuth Client ID Link to this property client\_secret: optional string Your OAuth Client Secret Link to this property email\_claim\_name: optional string The claim name for email in the id\_token response. Link to this property onelogin\_account: optional string Your OneLogin account url Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessPingone object {config, name, type, 5 more }

claims: optional array of string Custom claims Link to this property client\_id: optional string Your OAuth Client ID Link to this property client\_secret: optional string Your OAuth Client Secret Link to this property email\_claim\_name: optional string The claim name for email in the id\_token response. Link to this property ping\_env\_id: optional string Your PingOne environment identifier Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessSAML object {config, name, type, 5 more }

config: object {attributes, email\_attribute\_name, enable\_encryption, 7 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

attributes: optional array of string A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules. Link to this property email\_attribute\_name: optional string The attribute name for email in the SAML response. Link to this property enable\_encryption: optional boolean Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set. To enable encryption: 1. Create a certificate set via POST to /identity_providers/{id}/saml_certificate 2. Set this field to true and include saml_certificate_set_id in the PUT request 3. Configure the public certificate in your external Identity Provider Note: Requires saml_certificate_set_id to be set when true. Link to this property force\_authn: optional boolean Asks the IdP to reauthenticate the user for each SAML authentication request. Link to this property

header\_attributes: optional array of object {attribute\_name, header\_name } Add a list of attribute names that will be returned in the response header from the Access callback.

attribute\_name: optional string attribute name from the IDP Link to this property header\_name: optional string header that will be added on the request to the origin Link to this property

Link to this property idp\_public\_certs: optional array of string X509 certificate to verify the signature in the SAML authentication response Link to this property issuer\_url: optional string IdP Entity ID or Issuer URL Link to this property max\_sso\_url\_length: optional number The maximum URL length the IdP accepts for the SSO redirect URL. When the constructed SSO URL would exceed this length, the RelayState is stored server-side and a short nonce is passed to the IdP instead. Set this if your IdP enforces a URL length limit. maximum100000 minimum512 Link to this property sign\_request: optional boolean Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints. Link to this property sso\_target\_url: optional string URL to send the SAML authentication requests to Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessYandex object {config, name, type, 5 more }

client\_id: optional string Your OAuth Client ID Link to this property client\_secret: optional string Your OAuth Client Secret Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessOnetimepin object {config, name, type, 5 more }

config: object {redirect\_url } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

redirect\_url: optional string Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessCloudflare object {config, name, type, 5 more }

config: object {redirect\_url, restrict\_to\_account\_members } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

redirect\_url: optional string Link to this property restrict\_to\_account\_members: optional boolean When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies. Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

AccessPasskeys object {config, name, type, 5 more }

config: object {login\_page\_auto\_prompt, redirect\_url } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

login\_page\_auto\_prompt: optional boolean When enabled, the Access login page automatically prompts the user to authenticate with a passkey. Link to this property redirect\_url: optional string Link to this property

Link to this property name: string The name of the identity provider, shown to users on the login page. Link to this property

type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The currently active certificate used for encrypting SAML assertions

enabled: optional boolean A flag to enable or disable SCIM for the identity provider. Link to this property

One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(method)%20get%20%3E%20(network%20schema)%20%3E%20(property)%20result>) ### Get an Access identity provider HTTP HTTPTypeScriptPythonGoTerraform ``` curl https://api.cloudflare.com/client/v4/$ACCOUNTS_OR_ZONES/$ACCOUNT_OR_ZONE_ID/access/identity_providers/$IDENTITY_PROVIDER_ID \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "config": { "claims": [ "email_verified", "preferred_username", "custom_claim_name" ], "client_id": "", "client_secret": "", "conditional_access_enabled": true, "directory_id": "", "email_claim_name": "custom_claim_name", "prompt": "login", "support_groups": true }, "name": "Widget Corps IDP", "type": "onetimepin", "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "read_only": true, "saml_certificate_set": { "created_at": "2026-05-07T19:16:19.821162Z", "uid": "c409ef44-e72c-41c8-8c0b-278c8a6f4fd8", "updated_at": "2026-05-07T19:16:19.821162Z", "current_certificate": { "is_current": true, "not_after": "2027-05-07T19:11:00Z", "public_certificate": "-----BEGIN CERTIFICATE-----\nMIIEpzCCA4+gAwIBAgIUTh2VSDDJ0oB/gabio6j1L9QwWoUwDQYJKoZIhvcNAQEL\n...\n-----END CERTIFICATE-----\n", "uid": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415" }, "previous_certificate": {} }, "saml_certificate_set_id": "c409ef44-e72c-41c8-8c0b-278c8a6f4fd8", "scim_config": { "enabled": true, "identity_update_behavior": "automatic", "scim_base_url": "scim_base_url", "seat_deprovision": true, "secret": "secret", "user_deprovision": true } } } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "config": { "claims": [ "email_verified", "preferred_username", "custom_claim_name" ], "client_id": "", "client_secret": "", "conditional_access_enabled": true, "directory_id": "", "email_claim_name": "custom_claim_name", "prompt": "login", "support_groups": true }, "name": "Widget Corps IDP", "type": "onetimepin", "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "read_only": true, "saml_certificate_set": { "created_at": "2026-05-07T19:16:19.821162Z", "uid": "c409ef44-e72c-41c8-8c0b-278c8a6f4fd8", "updated_at": "2026-05-07T19:16:19.821162Z", "current_certificate": { "is_current": true, "not_after": "2027-05-07T19:11:00Z", "public_certificate": "-----BEGIN CERTIFICATE-----\nMIIEpzCCA4+gAwIBAgIUTh2VSDDJ0oB/gabio6j1L9QwWoUwDQYJKoZIhvcNAQEL\n...\n-----END CERTIFICATE-----\n", "uid": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415" }, "previous_certificate": {} }, "saml_certificate_set_id": "c409ef44-e72c-41c8-8c0b-278c8a6f4fd8", "scim_config": { "enabled": true, "identity_update_behavior": "automatic", "scim_base_url": "scim_base_url", "seat_deprovision": true, "secret": "secret", "user_deprovision": true } } } ```