Identity Providers

Endpointhttps://api.kontier.eu/v1

Single sign-on for your organization: linked identity providers and the email domains that route to them.

List the org's linked identity providers

GET

https://api.kontier.eu/v1

/identity-providers

Returns the identity providers linked to the organization. Each item has the shape GET /identity-providers/{alias} returns. config is sent only with include=config; secrets in it are masked.

Required scope: org.security.read (Read security settings).

List the org's linked identity providers › query Parameters

include

string[] · explode: true

Extra data to add to the response: config. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400.

Enum values:

config

List the org's linked identity providers › Headers

X-Workspace-Id

string

Selects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.

Workspace UUID or slug.

List the org's linked identity providers › Responses

array | null · required

object · required

Attach an identity provider to the org

POST

https://api.kontier.eu/v1

/identity-providers

Creates a realm-level IdP and links it to the active org in one saga - on link failure the realm IdP is deleted to avoid orphans. Provider IDs supported: oidc, keycloak-oidc, saml. The config map is forwarded to Keycloak as-is (issuer URL, client secret, SAML metadata, etc.).

Required scope: org.security.manage (Manage security settings).

Attach an identity provider to the org › query Parameters

include

string[] · explode: true

Extra data to add to the response: config. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. config is sent without being asked until 2026-11-30; after that date it is sent only when named here.

Enum values:

config

Attach an identity provider to the org › Headers

Idempotency-Key

string · required

Unique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.

Client-generated idempotency key (e.g. a UUID).

X-Workspace-Id

string

Workspace UUID or slug.

Attach an identity provider to the org › Request Body

alias

string · required

provider_id

string · required

object

display_name

string

enabled

boolean

hide_on_login

boolean

Attach an identity provider to the org › Responses

Created

object · required

POST/identity-providers

curl --request POST \
  --url https://api.kontier.eu/v1/identity-providers \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <string>' \
  --data '
{
  "alias": "alias",
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}
'

shell

Example Request Body

{
  "alias": "alias",
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}

json

Example Responses

{
  "data": {
    "alias": "alias",
    "config": {
      "key": "string"
    },
    "display_name": "display_name",
    "enabled": true,
    "hide_on_login": true,
    "id": "3698bffc-192e-5da1-81d0-bcaf91300d14",
    "provider_id": "provider_id"
  }
}

json

application/json

Fetch one identity provider

GET

https://api.kontier.eu/v1

/identity-providers/{alias}

Returns one identity provider linked to the organization; secrets in config are masked. 404 when the alias is not linked to the organization.

Required scope: org.security.read (Read security settings).

Fetch one identity provider › path Parameters

alias

string · required

Realm-level IdP alias

Fetch one identity provider › query Parameters

include

string[] · explode: true

Enum values:

config

Fetch one identity provider › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Fetch one identity provider › Responses

object · required

Detach an identity provider from the org

DELETE

https://api.kontier.eu/v1

/identity-providers/{alias}

Unlinks the IdP from the active org and deletes the realm-level IdP itself.

Required scope: org.security.manage (Manage security settings).

Detach an identity provider from the org › path Parameters

alias

string · required

Realm-level IdP alias

Detach an identity provider from the org › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Detach an identity provider from the org › Responses

No Content

No data returned

Update an identity provider's representation

PATCH

https://api.kontier.eu/v1

/identity-providers/{alias}

Replaces the IdP's representation. Keycloak's update is full-representation replace, not partial-merge - fetch the IdP first and pass back the merged shape to preserve unchanged fields. 404 when the alias isn't linked to the active org (cross-tenant guard).

Required scope: org.security.manage (Manage security settings).

Update an identity provider's representation › path Parameters

alias

string · required

Realm-level IdP alias

Update an identity provider's representation › query Parameters

include

string[] · explode: true

Enum values:

config

Update an identity provider's representation › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Update an identity provider's representation › Request Body

object

display_name

string

enabled

boolean

hide_on_login

boolean

provider_id

string

Update an identity provider's representation › Responses

object · required

PATCH/identity-providers/{alias}

curl --request PATCH \
  --url https://api.kontier.eu/v1/identity-providers/:alias \
  --header 'Content-Type: application/json' \
  --data '
{
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}
'

shell

Example Request Body

{
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}

json

Example Responses

{
  "data": {
    "alias": "alias",
    "config": {
      "key": "string"
    },
    "display_name": "display_name",
    "enabled": true,
    "hide_on_login": true,
    "id": "3698bffc-192e-5da1-81d0-bcaf91300d14",
    "provider_id": "provider_id"
  }
}

json

application/json

List the org's email domains

GET

https://api.kontier.eu/v1

/organization/domains

Returns the domain list Keycloak holds for the active organization. Each entry carries the hostname and the verified flag (true once the org admin has asserted ownership in v1; v2 will require DNS-TXT proof). Empty array when the org has no domains.

Required scope: org.security.read (Read security settings).

List the org's email domains › Headers

X-Workspace-Id

string

Workspace UUID or slug.

List the org's email domains › Responses

array | null · required

object · required

Replace the org's email domain list

PUT

https://api.kontier.eu/v1

/organization/domains

Replaces the org's domain list with the supplied entries. v1 ships operator-asserted: every domain the request supplies is set verified=true so Keycloak's OrganizationAuthenticator picks it up for home-realm-discovery. Empty arrays clear the list.

Required scope: org.security.manage (Manage security settings).

Replace the org's email domain list › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Replace the org's email domain list › Request Body

domains

array | null

Replace the org's email domain list › Responses

array | null · required

object · required

API Keys Organization Tree

Kontier Billing API

Identity Providers

Endpointhttps://api.kontier.eu/v1

Single sign-on for your organization: linked identity providers and the email domains that route to them.

List the org's linked identity providers

GET

https://api.kontier.eu/v1

/identity-providers

Returns the identity providers linked to the organization. Each item has the shape GET /identity-providers/{alias} returns. config is sent only with include=config; secrets in it are masked.

Required scope: org.security.read (Read security settings).

List the org's linked identity providers › query Parameters

include

string[] · explode: true

Extra data to add to the response: config. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400.

Enum values:

config

List the org's linked identity providers › Headers

X-Workspace-Id

string

Workspace UUID or slug.

List the org's linked identity providers › Responses

array | null · required

object · required

Attach an identity provider to the org

POST

https://api.kontier.eu/v1

/identity-providers

Required scope: org.security.manage (Manage security settings).

Attach an identity provider to the org › query Parameters

include

string[] · explode: true

Enum values:

config

Attach an identity provider to the org › Headers

Idempotency-Key

string · required

Client-generated idempotency key (e.g. a UUID).

X-Workspace-Id

string

Workspace UUID or slug.

Attach an identity provider to the org › Request Body

alias

string · required

provider_id

string · required

object

display_name

string

enabled

boolean

hide_on_login

boolean

Attach an identity provider to the org › Responses

Created

object · required

POST/identity-providers

curl --request POST \
  --url https://api.kontier.eu/v1/identity-providers \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <string>' \
  --data '
{
  "alias": "alias",
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}
'

shell

Example Request Body

{
  "alias": "alias",
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}

json

Example Responses

{
  "data": {
    "alias": "alias",
    "config": {
      "key": "string"
    },
    "display_name": "display_name",
    "enabled": true,
    "hide_on_login": true,
    "id": "3698bffc-192e-5da1-81d0-bcaf91300d14",
    "provider_id": "provider_id"
  }
}

json

application/json

Fetch one identity provider

GET

https://api.kontier.eu/v1

/identity-providers/{alias}

Returns one identity provider linked to the organization; secrets in config are masked. 404 when the alias is not linked to the organization.

Required scope: org.security.read (Read security settings).

Fetch one identity provider › path Parameters

alias

string · required

Realm-level IdP alias

Fetch one identity provider › query Parameters

include

string[] · explode: true

Enum values:

config

Fetch one identity provider › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Fetch one identity provider › Responses

object · required

Detach an identity provider from the org

DELETE

https://api.kontier.eu/v1

/identity-providers/{alias}

Unlinks the IdP from the active org and deletes the realm-level IdP itself.

Required scope: org.security.manage (Manage security settings).

Detach an identity provider from the org › path Parameters

alias

string · required

Realm-level IdP alias

Detach an identity provider from the org › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Detach an identity provider from the org › Responses

No Content

No data returned

Update an identity provider's representation

PATCH

https://api.kontier.eu/v1

/identity-providers/{alias}

Required scope: org.security.manage (Manage security settings).

Update an identity provider's representation › path Parameters

alias

string · required

Realm-level IdP alias

Update an identity provider's representation › query Parameters

include

string[] · explode: true

Enum values:

config

Update an identity provider's representation › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Update an identity provider's representation › Request Body

object

display_name

string

enabled

boolean

hide_on_login

boolean

provider_id

string

Update an identity provider's representation › Responses

object · required

PATCH/identity-providers/{alias}

curl --request PATCH \
  --url https://api.kontier.eu/v1/identity-providers/:alias \
  --header 'Content-Type: application/json' \
  --data '
{
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}
'

shell

Example Request Body

{
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}

json

Example Responses

{
  "data": {
    "alias": "alias",
    "config": {
      "key": "string"
    },
    "display_name": "display_name",
    "enabled": true,
    "hide_on_login": true,
    "id": "3698bffc-192e-5da1-81d0-bcaf91300d14",
    "provider_id": "provider_id"
  }
}

json

application/json

List the org's email domains

GET

https://api.kontier.eu/v1

/organization/domains

Required scope: org.security.read (Read security settings).

List the org's email domains › Headers

X-Workspace-Id

string

Workspace UUID or slug.

List the org's email domains › Responses

array | null · required

object · required

Replace the org's email domain list

PUT

https://api.kontier.eu/v1

/organization/domains

Required scope: org.security.manage (Manage security settings).

Replace the org's email domain list › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Replace the org's email domain list › Request Body

domains

array | null

Replace the org's email domain list › Responses

array | null · required

object · required

API Keys Organization Tree