List configured OIDC providers..

GET

/v1/iam/oidc-providers

Code sample: Shell / cURL

curl --request GET \
  --url https://stratum.example.com/v1/iam/oidc-providers \
  --header 'Authorization: Bearer <token>'

• A Stratum cluster endpoint.

Admin list: every provider, enabled or not, with the full field set. Requires iam:ListOIDCProviders (; anonymous callers used to get the active ones). The sign-in page reads the public GET /v1/iam/sign-in-providers instead.

Authorizations

• bearerAuth

Responses

200

Provider list.

Media typeapplication/json

Complete: returns every configured OIDC provider.

This list is bounded by the install’s own configuration rather than by tenant activity, so it is not paginated and carries no nextPageToken. A client has the whole set in one response.

object

items

required

Array<object>

Registered external OpenID Connect identity provider. clientSecretRef is a reference to the secret store path backing the client secret — the secret itself never appears on responses. Per the provider model is identity-only: no group/role mapping fields, since Stratum’s role bindings decide what a JIT-provisioned user can do.

object

id

required

string

/^oidcp-[a-z0-9]+$/

name

required

string

/^[a-z0-9-]{1,64}$/

displayName

required

string

<= 100 characters

issuerUrl

required

string format: uri

clientId

required

string

clientSecretRef

required

string

scopes

required

Array<string>

claimMapping

required

Names the upstream id_token claim that populates each Stratum field. Defaults match RFC names (email, name, sub).

object

email

required

string

displayName

required

string

externalId

required

string

jitEnabled

required

boolean

state

required

string

Allowed values: active disabled

createdAt

required

string format: date-time

updatedAt

required

string format: date-time

createdBy

required

string

Example

{
  "items": [
    {
      "state": "active"
    }
  ]
}

401

Missing or invalid token.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

Headers

WWW-Authenticate

string

403

Authenticated but not authorized.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}