Identity Providers

Endpointhttps://api.kontorion.eu/v1

List the org's linked identity providers

GET

https://api.kontorion.eu/v1

/identity-providers

Returns the IdPs currently linked to the active organization. Each entry carries alias, provider_id, display_name, enabled flag, and hide_on_login. Config is intentionally omitted here - secrets like client_secret stay server-side; fetch a single IdP to receive its config.

List the org's linked identity providers › Headers

X-Workspace-Id

string

Selects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.

Workspace UUID or slug.

List the org's linked identity providers › Responses

array | null · required

Attach an identity provider to the org

POST

https://api.kontorion.eu/v1

/identity-providers

Creates a realm-level IdP and links it to the active org in one saga - on link failure the realm IdP is deleted to avoid orphans. Provider IDs supported: oidc, keycloak-oidc, saml. The config map is forwarded to Keycloak as-is (issuer URL, client secret, SAML metadata, etc.).

Attach an identity provider to the org › Headers

Idempotency-Key

string · required

Unique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.

Client-generated idempotency key (e.g. a UUID).

X-Workspace-Id

string

Workspace UUID or slug.

Attach an identity provider to the org › Request Body

alias

string

object

display_name

string

enabled

boolean

hide_on_login

boolean

provider_id

string

Attach an identity provider to the org › Responses

Created

object · required

POST/identity-providers

curl --request POST \
  --url https://api.kontorion.eu/v1/identity-providers \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <string>' \
  --data '
{
  "alias": "alias",
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}
'

shell

Example Request Body

{
  "alias": "alias",
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}

json

Example Responses

{
  "data": {
    "alias": "alias",
    "config": {
      "key": "string"
    },
    "display_name": "display_name",
    "enabled": true,
    "hide_on_login": true,
    "provider_id": "provider_id"
  }
}

json

application/json

Fetch one identity provider including config

GET

https://api.kontorion.eu/v1

/identity-providers/{alias}

Returns one IdP's full representation including config. 404 when the alias isn't linked to the active org (cross-tenant guard).

Fetch one identity provider including config › path Parameters

alias

string · required

Realm-level IdP alias

Fetch one identity provider including config › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Fetch one identity provider including config › Responses

object · required

Detach an identity provider from the org

DELETE

https://api.kontorion.eu/v1

/identity-providers/{alias}

Unlinks the IdP from the active org and deletes the realm-level IdP itself. Refuses (409 LAST_AUTH_PATH_GUARD) to remove the last identity provider while password login is disabled.

Detach an identity provider from the org › path Parameters

alias

string · required

Realm-level IdP alias

Detach an identity provider from the org › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Detach an identity provider from the org › Responses

No Content

No data returned

Update an identity provider's representation

PATCH

https://api.kontorion.eu/v1

/identity-providers/{alias}

Replaces the IdP's representation. Keycloak's update is full-representation replace, not partial-merge - fetch the IdP first and pass back the merged shape to preserve unchanged fields. 404 when the alias isn't linked to the active org (cross-tenant guard).

Update an identity provider's representation › path Parameters

alias

string · required

Realm-level IdP alias

Update an identity provider's representation › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Update an identity provider's representation › Request Body

object

display_name

string

enabled

boolean

hide_on_login

boolean

provider_id

string

Update an identity provider's representation › Responses

object · required

PATCH/identity-providers/{alias}

curl --request PATCH \
  --url https://api.kontorion.eu/v1/identity-providers/:alias \
  --header 'Content-Type: application/json' \
  --data '
{
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}
'

shell

Example Request Body

{
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}

json

Example Responses

{
  "data": {
    "alias": "alias",
    "config": {
      "key": "string"
    },
    "display_name": "display_name",
    "enabled": true,
    "hide_on_login": true,
    "provider_id": "provider_id"
  }
}

json

application/json

List the org's email domains

GET

https://api.kontorion.eu/v1

/organization/domains

Returns the domain list Keycloak holds for the active organization. Each entry carries the hostname and the verified flag (true once the org admin has asserted ownership in v1; v2 will require DNS-TXT proof). Empty array when the org has no domains.

List the org's email domains › Headers

X-Workspace-Id

string

Workspace UUID or slug.

List the org's email domains › Responses

array | null · required

Replace the org's email domain list

PUT

https://api.kontorion.eu/v1

/organization/domains

Replaces the org's domain list with the supplied entries. v1 ships operator-asserted: every domain the request supplies is set verified=true so Keycloak's OrganizationAuthenticator picks it up for home-realm-discovery. Empty arrays clear the list.

Replace the org's email domain list › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Replace the org's email domain list › Request Body

domains

array | null

Replace the org's email domain list › Responses

array | null · required

Checkout Links Me

Kontorion Billing API

Identity Providers

Endpointhttps://api.kontorion.eu/v1

List the org's linked identity providers

GET

https://api.kontorion.eu/v1

/identity-providers

List the org's linked identity providers › Headers

X-Workspace-Id

string

Workspace UUID or slug.

List the org's linked identity providers › Responses

array | null · required

Attach an identity provider to the org

POST

https://api.kontorion.eu/v1

/identity-providers

Attach an identity provider to the org › Headers

Idempotency-Key

string · required

Client-generated idempotency key (e.g. a UUID).

X-Workspace-Id

string

Workspace UUID or slug.

Attach an identity provider to the org › Request Body

alias

string

object

display_name

string

enabled

boolean

hide_on_login

boolean

provider_id

string

Attach an identity provider to the org › Responses

Created

object · required

POST/identity-providers

curl --request POST \
  --url https://api.kontorion.eu/v1/identity-providers \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <string>' \
  --data '
{
  "alias": "alias",
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}
'

shell

Example Request Body

{
  "alias": "alias",
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}

json

Example Responses

{
  "data": {
    "alias": "alias",
    "config": {
      "key": "string"
    },
    "display_name": "display_name",
    "enabled": true,
    "hide_on_login": true,
    "provider_id": "provider_id"
  }
}

json

application/json

Fetch one identity provider including config

GET

https://api.kontorion.eu/v1

/identity-providers/{alias}

Returns one IdP's full representation including config. 404 when the alias isn't linked to the active org (cross-tenant guard).

Fetch one identity provider including config › path Parameters

alias

string · required

Realm-level IdP alias

Fetch one identity provider including config › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Fetch one identity provider including config › Responses

object · required

Detach an identity provider from the org

DELETE

https://api.kontorion.eu/v1

/identity-providers/{alias}

Unlinks the IdP from the active org and deletes the realm-level IdP itself. Refuses (409 LAST_AUTH_PATH_GUARD) to remove the last identity provider while password login is disabled.

Detach an identity provider from the org › path Parameters

alias

string · required

Realm-level IdP alias

Detach an identity provider from the org › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Detach an identity provider from the org › Responses

No Content

No data returned

Update an identity provider's representation

PATCH

https://api.kontorion.eu/v1

/identity-providers/{alias}

Update an identity provider's representation › path Parameters

alias

string · required

Realm-level IdP alias

Update an identity provider's representation › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Update an identity provider's representation › Request Body

object

display_name

string

enabled

boolean

hide_on_login

boolean

provider_id

string

Update an identity provider's representation › Responses

object · required

PATCH/identity-providers/{alias}

curl --request PATCH \
  --url https://api.kontorion.eu/v1/identity-providers/:alias \
  --header 'Content-Type: application/json' \
  --data '
{
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}
'

shell

Example Request Body

{
  "config": {
    "key": "string"
  },
  "display_name": "display_name",
  "enabled": true,
  "hide_on_login": true,
  "provider_id": "provider_id"
}

json

Example Responses

{
  "data": {
    "alias": "alias",
    "config": {
      "key": "string"
    },
    "display_name": "display_name",
    "enabled": true,
    "hide_on_login": true,
    "provider_id": "provider_id"
  }
}

json

application/json

List the org's email domains

GET

https://api.kontorion.eu/v1

/organization/domains

List the org's email domains › Headers

X-Workspace-Id

string

Workspace UUID or slug.

List the org's email domains › Responses

array | null · required

Replace the org's email domain list

PUT

https://api.kontorion.eu/v1

/organization/domains

Replace the org's email domain list › Headers

X-Workspace-Id

string

Workspace UUID or slug.

Replace the org's email domain list › Request Body

domains

array | null

Replace the org's email domain list › Responses

array | null · required

Checkout Links Me