HomeUse CasesConceptsConfig GuidesDeveloper GuidesAPI Reference
API Reference

Updates the OpenID Connect federation configuration.

put
https://{tenanturl}/v1.0/oidc/federation

Modify federation settings for this tenant.

Entitlements required: manageFederations (Manage federations)

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests

LoadingLoading

Body Params

Federation settings

string
required

Host name used for the JWT issuer. It must be the tenant host name or one of the vanity host names. The full issuer string will be https://{issuerHostname}/oidc/endpoint/default

idTokenLifetime
object
required
boolean

Add extended attributes to the 'ext' claim in ID token or user info.

int32

Time skew for JWT 'iat', 'exp' and 'nbf' validation in seconds. Maximum 300, minimum 0. Default is 0.

boolean

Whether to enforce client authentication on device authorization endpoint.

deviceFlowPollingInterval
object
deviceFlowCodeLifetime
object
extraMetadataAttributes
object

Top level attributes for well-known endpoint to override the existing attribute.

boolean

Setting to exclude 'x5c' in JWKS.

boolean

Setting to exclude 'x5t' and 'x5t#S256' in JWKS.

string

Base URL for MTLS endpoints. This must include the protocol scheme like https.

string

Default signing key for JWT.

string

Default encryption key for JWT.

refreshTokenFaultToleranceLifetime
object
string
enum

Refresh token fault tolerance option.

Allowed:
tokenExchangeIdTokenToleranceWindow
object
string
enum

Options to exchange token for SSO session. When this is not set, token exchange for SSO session will be allowed.

Allowed:
int32

Default lifetime in days for rotated client secrets.

int32

Auto-generated client secret length. Default to 10 if not provided.

scopeToClaimsMap
object

Scope to claims mapping. This map configures which claims should be produced in ID token or user info for a particular scope.

boolean

Setting to fully switch to new OIDC implementation.

string
enum

Option for how client assertion's audience is validated. 'issuer_only' allows only for the issuer value to be in the audience claim and expects the claim to be a string instead of an array. This is the recommended option. 'legacy' allows for issuer, token endpoint, or the endpoint where this client assertion is being used on in the audience claim, as per RFC 7523. When not set, the default value is 'legacy'.

Allowed:
boolean

Indicates whether plain PKCE is allowed. Default is true.

int32

Pushed authorization requests default lifetime.

Responses
204

The federation configuration was updated.

403

Access was forbidden.

Updated over 2 years ago

Language
URL
LoadingLoading

Response
Choose an example:
*/*

Updated over 2 years ago