--- title: "Add an identity provider" description: "OIDC (authorization code with PKCE) or SAML (SP-initiated, signed responses and assertions). Upstream metadata and keys are fetched by sso-worker through the hardened egress, within seconds and then every 6 hours." --- > Documentation Index > Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt > Use this file to discover all available pages before exploring further. Path: EZGH SSO API `POST /v1/organizations/{orgId}/sso/identity-providers` OIDC (authorization code with PKCE) or SAML (SP-initiated, signed responses and assertions). Upstream metadata and keys are fetched by sso-worker through the hardened egress, within seconds and then every 6 hours. ## Authentication Requires one of the following: - `apiKey`, http, header `Authorization` - `oauth`, http, header `Authorization` - `sessionCookie`, apiKey, in cookie ## Path parameters - `CreateIdentityProvider.path.orgId` (string, required) - format `uuid` ## Header parameters - `CreateIdentityProvider.header.Idempotency-Key` (string, optional) — Makes a retry safe: the same key and request get the stored response. - pattern `^[\x21-\x7e]{1,200}$` ## Request body _Required._ - `CreateIdentityProvider.name` (string, required) - maxLength 100 - `CreateIdentityProvider.protocol` (string, required) - one of `"oidc"`, `"saml"` - `CreateIdentityProvider.description` (string, optional) - maxLength 1024 - `CreateIdentityProvider.domains` (array, optional) - `CreateIdentityProvider.groupMappings` (array, optional) - `CreateIdentityProvider.groupMappings.groupId` (string, required) — A hosted directory group. - format `uuid` - `CreateIdentityProvider.groupMappings.idpGroup` (string, required) — The group's name at the identity provider, or * for everyone who signs in through it. - `CreateIdentityProvider.oidc` (object, optional) - `CreateIdentityProvider.oidc.clientId` (string, optional) - `CreateIdentityProvider.oidc.clientSecret` (string | null, optional) — Write-only; null removes it. Sealed at rest, never shown. - `CreateIdentityProvider.oidc.emailClaim` (string, optional) - `CreateIdentityProvider.oidc.groupsClaim` (string, optional) - `CreateIdentityProvider.oidc.issuer` (string, optional) - format `uri` - `CreateIdentityProvider.oidc.scopes` (array, optional) - `CreateIdentityProvider.oidc.tokenEndpointAuthMethod` (string, optional) - one of `"client_secret_basic"`, `"client_secret_post"`, `"none"` - `CreateIdentityProvider.saml` (object, optional) - `CreateIdentityProvider.saml.emailAttribute` (string, optional) — Empty: the NameID (emailAddress format) or a common email attribute. - `CreateIdentityProvider.saml.groupsAttribute` (string, optional) - `CreateIdentityProvider.saml.metadataUrl` (string | null, optional) - format `uri` - `CreateIdentityProvider.saml.metadataXml` (string, optional) — The IdP's metadata by value, instead of metadataUrl. - maxLength 262144 - `CreateIdentityProvider.tags` (map, optional) ## Example request ```json { "description": "string", "domains": [ "string" ], "groupMappings": [ { "groupId": "eb54e96e-21b8-4f54-9cd4-80fccbd06f55", "idpGroup": "string" } ], "name": "string", "oidc": { "clientId": "string", "clientSecret": "string", "emailClaim": "string", "groupsClaim": "string", "issuer": "http://example.com", "scopes": [ "string" ], "tokenEndpointAuthMethod": "client_secret_basic" }, "protocol": "oidc", "saml": { "emailAttribute": "string", "groupsAttribute": "string", "metadataUrl": "http://example.com", "metadataXml": "string" }, "tags": { "property1": "string", "property2": "string" } } ``` ## Code samples ### cURL ```curl curl --request POST \ --url https://sso.ezghcloud.com/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/sso/identity-providers \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data ' { "description": "string", "domains": [ "string" ], "groupMappings": [ { "groupId": "eb54e96e-21b8-4f54-9cd4-80fccbd06f55", "idpGroup": "string" } ], "name": "string", "oidc": { "clientId": "string", "clientSecret": "string", "emailClaim": "string", "groupsClaim": "string", "issuer": "http://example.com", "scopes": [ "string" ], "tokenEndpointAuthMethod": "client_secret_basic" }, "protocol": "oidc", "saml": { "emailAttribute": "string", "groupsAttribute": "string", "metadataUrl": "http://example.com", "metadataXml": "string" }, "tags": { "property1": "string", "property2": "string" } } ' ``` ### TypeScript ```typescript const url = 'https://sso.ezghcloud.com/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/sso/identity-providers'; const options = { method: 'POST', headers: {'Content-Type': 'application/json', Authorization: 'Bearer '}, body: JSON.stringify({ description: 'string', domains: ['string'], groupMappings: [{groupId: 'eb54e96e-21b8-4f54-9cd4-80fccbd06f55', idpGroup: 'string'}], name: 'string', oidc: { clientId: 'string', clientSecret: 'string', emailClaim: 'string', groupsClaim: 'string', issuer: 'http://example.com', scopes: ['string'], tokenEndpointAuthMethod: 'client_secret_basic' }, protocol: 'oidc', saml: { emailAttribute: 'string', groupsAttribute: 'string', metadataUrl: 'http://example.com', metadataXml: 'string' }, tags: {property1: 'string', property2: 'string'} }) }; fetch(url, options) .then(res => res.json()) .then(json => console.log(json)) .catch(err => console.error(err)); ``` ### Python ```python import requests url = "https://sso.ezghcloud.com/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/sso/identity-providers" payload = { "description": "string", "domains": ["string"], "groupMappings": [ { "groupId": "eb54e96e-21b8-4f54-9cd4-80fccbd06f55", "idpGroup": "string" } ], "name": "string", "oidc": { "clientId": "string", "clientSecret": "string", "emailClaim": "string", "groupsClaim": "string", "issuer": "http://example.com", "scopes": ["string"], "tokenEndpointAuthMethod": "client_secret_basic" }, "protocol": "oidc", "saml": { "emailAttribute": "string", "groupsAttribute": "string", "metadataUrl": "http://example.com", "metadataXml": "string" }, "tags": { "property1": "string", "property2": "string" } } headers = { "Content-Type": "application/json", "Authorization": "Bearer " } response = requests.post(url, json=payload, headers=headers) print(response.text) ``` ## Responses ### 201 The identity provider. #### Example ```json { "createdAt": "2019-08-24T14:15:22Z", "description": "string", "directoryId": "786c2ec1-fb9a-4593-b705-005b34c18c18", "domains": [ "string" ], "groupMappings": [ { "groupId": "eb54e96e-21b8-4f54-9cd4-80fccbd06f55", "idpGroup": "string" } ], "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "metadata": { "error": "string", "fetchedAt": "2019-08-24T14:15:22Z", "refreshRequestedAt": "2019-08-24T14:15:22Z" }, "name": "string", "oidc": { "clientId": "string", "clientSecretSet": true, "customDomainRedirectUris": [ "http://example.com" ], "discovery": { "authorizationEndpoint": "string", "idTokenSigningAlgs": [ "string" ], "issuer": "string", "jwksUri": "string", "tokenEndpoint": "string" }, "emailClaim": "string", "groupsClaim": "string", "issuer": "http://example.com", "redirectUri": "http://example.com", "scopes": [ "string" ], "tokenEndpointAuthMethod": "client_secret_basic" }, "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9", "projectId": "string", "protocol": "oidc", "provisioning": { "jit": true, "scim": true }, "region": "string", "resourceName": "string", "saml": { "emailAttribute": "string", "groupsAttribute": "string", "identityProvider": { "certificates": [ { "notAfter": "2019-08-24T14:15:22Z", "sha256": "string", "subject": "string" } ], "entityId": "string", "ssoUrl": "string" }, "metadataUrl": "http://example.com", "serviceProvider": { "acsUrl": "string", "customDomainAcsUrls": [ "http://example.com" ], "entityId": "string", "metadataUrl": "string" } }, "slug": "string", "status": "string", "tags": { "property1": "string", "property2": "string" }, "updatedAt": "2019-08-24T14:15:22Z" } ``` - `CreateIdentityProvider.response.201.createdAt` (string, required) - format `date-time` - `CreateIdentityProvider.response.201.description` (string, required) - `CreateIdentityProvider.response.201.directoryId` (string, required) - format `uuid` - `CreateIdentityProvider.response.201.domains` (array, required) — The directory's domains routed here; each routes only while verified. - `CreateIdentityProvider.response.201.groupMappings` (array, required) - `CreateIdentityProvider.response.201.groupMappings.groupId` (string, required) — A hosted directory group. - format `uuid` - `CreateIdentityProvider.response.201.groupMappings.idpGroup` (string, required) — The group's name at the identity provider, or * for everyone who signs in through it. - `CreateIdentityProvider.response.201.id` (string, required) - format `uuid` - `CreateIdentityProvider.response.201.metadata` (object, required) - `CreateIdentityProvider.response.201.metadata.error` (string | null, required) - `CreateIdentityProvider.response.201.metadata.fetchedAt` (string | null, required) - format `date-time` - `CreateIdentityProvider.response.201.metadata.refreshRequestedAt` (string | null, required) - format `date-time` - `CreateIdentityProvider.response.201.name` (string, required) - `CreateIdentityProvider.response.201.oidc` (one of, required) - one of: [IdpOidc](/sso-api/schemas/IdpOidc/), `null` - `CreateIdentityProvider.response.201.organizationId` (string, required) - format `uuid` - `CreateIdentityProvider.response.201.projectId` (string | null, required) - `CreateIdentityProvider.response.201.protocol` (string, required) - one of `"oidc"`, `"saml"` - `CreateIdentityProvider.response.201.provisioning` (object, required) — scim: a live directory SCIM token names this identity provider, so only provisioned users sign in; otherwise jit. - `CreateIdentityProvider.response.201.provisioning.jit` (boolean, required) - `CreateIdentityProvider.response.201.provisioning.scim` (boolean, required) - `CreateIdentityProvider.response.201.region` (string, required) - `CreateIdentityProvider.response.201.resourceName` (string, required) - `CreateIdentityProvider.response.201.saml` (one of, required) - one of: [IdpSaml](/sso-api/schemas/IdpSaml/), `null` - `CreateIdentityProvider.response.201.slug` (string, required) - `CreateIdentityProvider.response.201.status` (string, required) - `CreateIdentityProvider.response.201.tags` (map, required) - `CreateIdentityProvider.response.201.updatedAt` (string, required) - format `date-time` ### 400 invalid_request (with issues), invalid_cursor, or the endpoint's own 400 codes. #### Example ```json { "error": { "code": "string", "issues": [ { "message": "string", "path": "string" } ], "message": "string", "quota": { "id": "string", "inFlight": 0, "kind": "allocation", "limit": 0, "periodStart": "2019-08-24T14:15:22Z", "region": "string", "resetsAt": "2019-08-24T14:15:22Z", "scope": "organization", "scopeResourceName": "string", "used": 0, "window": "string" } } } ``` - `CreateIdentityProvider.response.400.error` (object, required) - `CreateIdentityProvider.response.400.error.code` (string, required) - maxLength 64; pattern `^[a-z][a-z0-9_]*$` - `CreateIdentityProvider.response.400.error.message` (string, required) - maxLength 1024 - `CreateIdentityProvider.response.400.error.issues` (array, optional) — invalid_request: one entry per problem, at a dotted path. - `CreateIdentityProvider.response.400.error.issues.message` (string, required) - `CreateIdentityProvider.response.400.error.issues.path` (string, required) - `CreateIdentityProvider.response.400.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After. - `CreateIdentityProvider.response.400.error.quota.id` (string, required) - `CreateIdentityProvider.response.400.error.quota.kind` (unknown, required) - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"` - `CreateIdentityProvider.response.400.error.quota.limit` (integer, required) - min 0 - `CreateIdentityProvider.response.400.error.quota.scope` (unknown, required) - one of `"organization"`, `"project"`, `"resource"` - `CreateIdentityProvider.response.400.error.quota.inFlight` (integer, optional) - min 0 - `CreateIdentityProvider.response.400.error.quota.periodStart` (string, optional) - format `date-time` - `CreateIdentityProvider.response.400.error.quota.region` (string, optional) - `CreateIdentityProvider.response.400.error.quota.resetsAt` (string, optional) - format `date-time` - `CreateIdentityProvider.response.400.error.quota.scopeResourceName` (string, optional) - `CreateIdentityProvider.response.400.error.quota.used` (integer, optional) - min 0 - `CreateIdentityProvider.response.400.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H. ### 401 unauthenticated: no credential, or one that doesn't check out. #### Example ```json { "error": { "code": "string", "issues": [ { "message": "string", "path": "string" } ], "message": "string", "quota": { "id": "string", "inFlight": 0, "kind": "allocation", "limit": 0, "periodStart": "2019-08-24T14:15:22Z", "region": "string", "resetsAt": "2019-08-24T14:15:22Z", "scope": "organization", "scopeResourceName": "string", "used": 0, "window": "string" } } } ``` - `CreateIdentityProvider.response.401.error` (object, required) - `CreateIdentityProvider.response.401.error.code` (string, required) - maxLength 64; pattern `^[a-z][a-z0-9_]*$` - `CreateIdentityProvider.response.401.error.message` (string, required) - maxLength 1024 - `CreateIdentityProvider.response.401.error.issues` (array, optional) — invalid_request: one entry per problem, at a dotted path. - `CreateIdentityProvider.response.401.error.issues.message` (string, required) - `CreateIdentityProvider.response.401.error.issues.path` (string, required) - `CreateIdentityProvider.response.401.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After. - `CreateIdentityProvider.response.401.error.quota.id` (string, required) - `CreateIdentityProvider.response.401.error.quota.kind` (unknown, required) - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"` - `CreateIdentityProvider.response.401.error.quota.limit` (integer, required) - min 0 - `CreateIdentityProvider.response.401.error.quota.scope` (unknown, required) - one of `"organization"`, `"project"`, `"resource"` - `CreateIdentityProvider.response.401.error.quota.inFlight` (integer, optional) - min 0 - `CreateIdentityProvider.response.401.error.quota.periodStart` (string, optional) - format `date-time` - `CreateIdentityProvider.response.401.error.quota.region` (string, optional) - `CreateIdentityProvider.response.401.error.quota.resetsAt` (string, optional) - format `date-time` - `CreateIdentityProvider.response.401.error.quota.scopeResourceName` (string, optional) - `CreateIdentityProvider.response.401.error.quota.used` (integer, optional) - min 0 - `CreateIdentityProvider.response.401.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H. ### 403 access_denied: the caller's policies don't allow the action; forbidden_origin: a cookie-authenticated write from an origin that isn't allowed; spend_limit_reached. #### Example ```json { "error": { "code": "string", "issues": [ { "message": "string", "path": "string" } ], "message": "string", "quota": { "id": "string", "inFlight": 0, "kind": "allocation", "limit": 0, "periodStart": "2019-08-24T14:15:22Z", "region": "string", "resetsAt": "2019-08-24T14:15:22Z", "scope": "organization", "scopeResourceName": "string", "used": 0, "window": "string" } } } ``` - `CreateIdentityProvider.response.403.error` (object, required) - `CreateIdentityProvider.response.403.error.code` (string, required) - maxLength 64; pattern `^[a-z][a-z0-9_]*$` - `CreateIdentityProvider.response.403.error.message` (string, required) - maxLength 1024 - `CreateIdentityProvider.response.403.error.issues` (array, optional) — invalid_request: one entry per problem, at a dotted path. - `CreateIdentityProvider.response.403.error.issues.message` (string, required) - `CreateIdentityProvider.response.403.error.issues.path` (string, required) - `CreateIdentityProvider.response.403.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After. - `CreateIdentityProvider.response.403.error.quota.id` (string, required) - `CreateIdentityProvider.response.403.error.quota.kind` (unknown, required) - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"` - `CreateIdentityProvider.response.403.error.quota.limit` (integer, required) - min 0 - `CreateIdentityProvider.response.403.error.quota.scope` (unknown, required) - one of `"organization"`, `"project"`, `"resource"` - `CreateIdentityProvider.response.403.error.quota.inFlight` (integer, optional) - min 0 - `CreateIdentityProvider.response.403.error.quota.periodStart` (string, optional) - format `date-time` - `CreateIdentityProvider.response.403.error.quota.region` (string, optional) - `CreateIdentityProvider.response.403.error.quota.resetsAt` (string, optional) - format `date-time` - `CreateIdentityProvider.response.403.error.quota.scopeResourceName` (string, optional) - `CreateIdentityProvider.response.403.error.quota.used` (integer, optional) - min 0 - `CreateIdentityProvider.response.403.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H. ### 404 not_found: unknown, malformed, or in an organization the caller isn't in. #### Example ```json { "error": { "code": "string", "issues": [ { "message": "string", "path": "string" } ], "message": "string", "quota": { "id": "string", "inFlight": 0, "kind": "allocation", "limit": 0, "periodStart": "2019-08-24T14:15:22Z", "region": "string", "resetsAt": "2019-08-24T14:15:22Z", "scope": "organization", "scopeResourceName": "string", "used": 0, "window": "string" } } } ``` - `CreateIdentityProvider.response.404.error` (object, required) - `CreateIdentityProvider.response.404.error.code` (string, required) - maxLength 64; pattern `^[a-z][a-z0-9_]*$` - `CreateIdentityProvider.response.404.error.message` (string, required) - maxLength 1024 - `CreateIdentityProvider.response.404.error.issues` (array, optional) — invalid_request: one entry per problem, at a dotted path. - `CreateIdentityProvider.response.404.error.issues.message` (string, required) - `CreateIdentityProvider.response.404.error.issues.path` (string, required) - `CreateIdentityProvider.response.404.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After. - `CreateIdentityProvider.response.404.error.quota.id` (string, required) - `CreateIdentityProvider.response.404.error.quota.kind` (unknown, required) - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"` - `CreateIdentityProvider.response.404.error.quota.limit` (integer, required) - min 0 - `CreateIdentityProvider.response.404.error.quota.scope` (unknown, required) - one of `"organization"`, `"project"`, `"resource"` - `CreateIdentityProvider.response.404.error.quota.inFlight` (integer, optional) - min 0 - `CreateIdentityProvider.response.404.error.quota.periodStart` (string, optional) - format `date-time` - `CreateIdentityProvider.response.404.error.quota.region` (string, optional) - `CreateIdentityProvider.response.404.error.quota.resetsAt` (string, optional) - format `date-time` - `CreateIdentityProvider.response.404.error.quota.scopeResourceName` (string, optional) - `CreateIdentityProvider.response.404.error.quota.used` (integer, optional) - min 0 - `CreateIdentityProvider.response.404.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H. ### 409 quota_exceeded (an allocation quota, with quota), idempotency_conflict, idempotency_in_progress (with Retry-After), organization_deletion_pending, operation_in_progress, or the endpoint's own 409 codes. #### Example ```json { "error": { "code": "string", "issues": [ { "message": "string", "path": "string" } ], "message": "string", "quota": { "id": "string", "inFlight": 0, "kind": "allocation", "limit": 0, "periodStart": "2019-08-24T14:15:22Z", "region": "string", "resetsAt": "2019-08-24T14:15:22Z", "scope": "organization", "scopeResourceName": "string", "used": 0, "window": "string" } } } ``` - `CreateIdentityProvider.response.409.error` (object, required) - `CreateIdentityProvider.response.409.error.code` (string, required) - maxLength 64; pattern `^[a-z][a-z0-9_]*$` - `CreateIdentityProvider.response.409.error.message` (string, required) - maxLength 1024 - `CreateIdentityProvider.response.409.error.issues` (array, optional) — invalid_request: one entry per problem, at a dotted path. - `CreateIdentityProvider.response.409.error.issues.message` (string, required) - `CreateIdentityProvider.response.409.error.issues.path` (string, required) - `CreateIdentityProvider.response.409.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After. - `CreateIdentityProvider.response.409.error.quota.id` (string, required) - `CreateIdentityProvider.response.409.error.quota.kind` (unknown, required) - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"` - `CreateIdentityProvider.response.409.error.quota.limit` (integer, required) - min 0 - `CreateIdentityProvider.response.409.error.quota.scope` (unknown, required) - one of `"organization"`, `"project"`, `"resource"` - `CreateIdentityProvider.response.409.error.quota.inFlight` (integer, optional) - min 0 - `CreateIdentityProvider.response.409.error.quota.periodStart` (string, optional) - format `date-time` - `CreateIdentityProvider.response.409.error.quota.region` (string, optional) - `CreateIdentityProvider.response.409.error.quota.resetsAt` (string, optional) - format `date-time` - `CreateIdentityProvider.response.409.error.quota.scopeResourceName` (string, optional) - `CreateIdentityProvider.response.409.error.quota.used` (integer, optional) - min 0 - `CreateIdentityProvider.response.409.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H. ### 413 payload_too_large: the body is over the endpoint's limit (1 MiB unless it says otherwise). #### Example ```json { "error": { "code": "string", "issues": [ { "message": "string", "path": "string" } ], "message": "string", "quota": { "id": "string", "inFlight": 0, "kind": "allocation", "limit": 0, "periodStart": "2019-08-24T14:15:22Z", "region": "string", "resetsAt": "2019-08-24T14:15:22Z", "scope": "organization", "scopeResourceName": "string", "used": 0, "window": "string" } } } ``` - `CreateIdentityProvider.response.413.error` (object, required) - `CreateIdentityProvider.response.413.error.code` (string, required) - maxLength 64; pattern `^[a-z][a-z0-9_]*$` - `CreateIdentityProvider.response.413.error.message` (string, required) - maxLength 1024 - `CreateIdentityProvider.response.413.error.issues` (array, optional) — invalid_request: one entry per problem, at a dotted path. - `CreateIdentityProvider.response.413.error.issues.message` (string, required) - `CreateIdentityProvider.response.413.error.issues.path` (string, required) - `CreateIdentityProvider.response.413.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After. - `CreateIdentityProvider.response.413.error.quota.id` (string, required) - `CreateIdentityProvider.response.413.error.quota.kind` (unknown, required) - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"` - `CreateIdentityProvider.response.413.error.quota.limit` (integer, required) - min 0 - `CreateIdentityProvider.response.413.error.quota.scope` (unknown, required) - one of `"organization"`, `"project"`, `"resource"` - `CreateIdentityProvider.response.413.error.quota.inFlight` (integer, optional) - min 0 - `CreateIdentityProvider.response.413.error.quota.periodStart` (string, optional) - format `date-time` - `CreateIdentityProvider.response.413.error.quota.region` (string, optional) - `CreateIdentityProvider.response.413.error.quota.resetsAt` (string, optional) - format `date-time` - `CreateIdentityProvider.response.413.error.quota.scopeResourceName` (string, optional) - `CreateIdentityProvider.response.413.error.quota.used` (integer, optional) - min 0 - `CreateIdentityProvider.response.413.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H. ### 429 too_many_requests, with Retry-After; or quota_exceeded (a rate, usage or concurrency quota, with quota), never with Retry-After. #### Example ```json { "error": { "code": "string", "issues": [ { "message": "string", "path": "string" } ], "message": "string", "quota": { "id": "string", "inFlight": 0, "kind": "allocation", "limit": 0, "periodStart": "2019-08-24T14:15:22Z", "region": "string", "resetsAt": "2019-08-24T14:15:22Z", "scope": "organization", "scopeResourceName": "string", "used": 0, "window": "string" } } } ``` - `CreateIdentityProvider.response.429.error` (object, required) - `CreateIdentityProvider.response.429.error.code` (string, required) - maxLength 64; pattern `^[a-z][a-z0-9_]*$` - `CreateIdentityProvider.response.429.error.message` (string, required) - maxLength 1024 - `CreateIdentityProvider.response.429.error.issues` (array, optional) — invalid_request: one entry per problem, at a dotted path. - `CreateIdentityProvider.response.429.error.issues.message` (string, required) - `CreateIdentityProvider.response.429.error.issues.path` (string, required) - `CreateIdentityProvider.response.429.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After. - `CreateIdentityProvider.response.429.error.quota.id` (string, required) - `CreateIdentityProvider.response.429.error.quota.kind` (unknown, required) - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"` - `CreateIdentityProvider.response.429.error.quota.limit` (integer, required) - min 0 - `CreateIdentityProvider.response.429.error.quota.scope` (unknown, required) - one of `"organization"`, `"project"`, `"resource"` - `CreateIdentityProvider.response.429.error.quota.inFlight` (integer, optional) - min 0 - `CreateIdentityProvider.response.429.error.quota.periodStart` (string, optional) - format `date-time` - `CreateIdentityProvider.response.429.error.quota.region` (string, optional) - `CreateIdentityProvider.response.429.error.quota.resetsAt` (string, optional) - format `date-time` - `CreateIdentityProvider.response.429.error.quota.scopeResourceName` (string, optional) - `CreateIdentityProvider.response.429.error.quota.used` (integer, optional) - min 0 - `CreateIdentityProvider.response.429.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H. ### 500 internal_error: a bug; the details are in the logs, under the request ID. #### Example ```json { "error": { "code": "string", "issues": [ { "message": "string", "path": "string" } ], "message": "string", "quota": { "id": "string", "inFlight": 0, "kind": "allocation", "limit": 0, "periodStart": "2019-08-24T14:15:22Z", "region": "string", "resetsAt": "2019-08-24T14:15:22Z", "scope": "organization", "scopeResourceName": "string", "used": 0, "window": "string" } } } ``` - `CreateIdentityProvider.response.500.error` (object, required) - `CreateIdentityProvider.response.500.error.code` (string, required) - maxLength 64; pattern `^[a-z][a-z0-9_]*$` - `CreateIdentityProvider.response.500.error.message` (string, required) - maxLength 1024 - `CreateIdentityProvider.response.500.error.issues` (array, optional) — invalid_request: one entry per problem, at a dotted path. - `CreateIdentityProvider.response.500.error.issues.message` (string, required) - `CreateIdentityProvider.response.500.error.issues.path` (string, required) - `CreateIdentityProvider.response.500.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After. - `CreateIdentityProvider.response.500.error.quota.id` (string, required) - `CreateIdentityProvider.response.500.error.quota.kind` (unknown, required) - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"` - `CreateIdentityProvider.response.500.error.quota.limit` (integer, required) - min 0 - `CreateIdentityProvider.response.500.error.quota.scope` (unknown, required) - one of `"organization"`, `"project"`, `"resource"` - `CreateIdentityProvider.response.500.error.quota.inFlight` (integer, optional) - min 0 - `CreateIdentityProvider.response.500.error.quota.periodStart` (string, optional) - format `date-time` - `CreateIdentityProvider.response.500.error.quota.region` (string, optional) - `CreateIdentityProvider.response.500.error.quota.resetsAt` (string, optional) - format `date-time` - `CreateIdentityProvider.response.500.error.quota.scopeResourceName` (string, optional) - `CreateIdentityProvider.response.500.error.quota.used` (integer, optional) - min 0 - `CreateIdentityProvider.response.500.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H. ### 503 unavailable: a dependency the request needs is down. Retry after Retry-After. #### Example ```json { "error": { "code": "string", "issues": [ { "message": "string", "path": "string" } ], "message": "string", "quota": { "id": "string", "inFlight": 0, "kind": "allocation", "limit": 0, "periodStart": "2019-08-24T14:15:22Z", "region": "string", "resetsAt": "2019-08-24T14:15:22Z", "scope": "organization", "scopeResourceName": "string", "used": 0, "window": "string" } } } ``` - `CreateIdentityProvider.response.503.error` (object, required) - `CreateIdentityProvider.response.503.error.code` (string, required) - maxLength 64; pattern `^[a-z][a-z0-9_]*$` - `CreateIdentityProvider.response.503.error.message` (string, required) - maxLength 1024 - `CreateIdentityProvider.response.503.error.issues` (array, optional) — invalid_request: one entry per problem, at a dotted path. - `CreateIdentityProvider.response.503.error.issues.message` (string, required) - `CreateIdentityProvider.response.503.error.issues.path` (string, required) - `CreateIdentityProvider.response.503.error.quota` (object, optional) — quota_exceeded: the quota that refused the request. Never with Retry-After. - `CreateIdentityProvider.response.503.error.quota.id` (string, required) - `CreateIdentityProvider.response.503.error.quota.kind` (unknown, required) - one of `"allocation"`, `"rate"`, `"usage"`, `"concurrency"` - `CreateIdentityProvider.response.503.error.quota.limit` (integer, required) - min 0 - `CreateIdentityProvider.response.503.error.quota.scope` (unknown, required) - one of `"organization"`, `"project"`, `"resource"` - `CreateIdentityProvider.response.503.error.quota.inFlight` (integer, optional) - min 0 - `CreateIdentityProvider.response.503.error.quota.periodStart` (string, optional) - format `date-time` - `CreateIdentityProvider.response.503.error.quota.region` (string, optional) - `CreateIdentityProvider.response.503.error.quota.resetsAt` (string, optional) - format `date-time` - `CreateIdentityProvider.response.503.error.quota.scopeResourceName` (string, optional) - `CreateIdentityProvider.response.503.error.quota.used` (integer, optional) - min 0 - `CreateIdentityProvider.response.503.error.quota.window` (string, optional) — rate only: an ISO 8601 duration, PT1S to PT1H. Source: https://docs.ezghcloud.com/sso-api/CreateIdentityProvider/index.md