Create Oauth Provider
const url = 'https://example.com/api/settings/oauth-providers/';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"slug":"example","display_name":"example","provider_type":"google","client_id":"example","client_secret":"example","discovery_url":"example","authorize_url":"example","token_url":"example","userinfo_url":"example","idp_entity_id":"example","idp_sso_url":"example","idp_certificate":"example","sp_entity_id":"example","scopes":"openid profile email","default_role":"viewer","group_claim":"example","group_role_mapping":{},"enabled":true}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/api/settings/oauth-providers/ \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "slug": "example", "display_name": "example", "provider_type": "google", "client_id": "example", "client_secret": "example", "discovery_url": "example", "authorize_url": "example", "token_url": "example", "userinfo_url": "example", "idp_entity_id": "example", "idp_sso_url": "example", "idp_certificate": "example", "sp_entity_id": "example", "scopes": "openid profile email", "default_role": "viewer", "group_claim": "example", "group_role_mapping": {}, "enabled": true }'Create a new OAuth or SAML provider (admin only).
Audit-log payload includes the full created snapshot with non-secret
fields verbatim and <redacted> markers for secrets that were submitted
in the request body (SAML-12 / Pitfall 9 / T-217-03-AUDIT-LEAK).
Authorizations
Section titled “Authorizations ”Request Body required
Section titled “Request Body required ”Schema for creating a new OAuth provider.
object
URL-safe identifier used in callback URLs (e.g. ‘google’, ‘azure-ad’). Lowercase, digits, and hyphens only.
Human-readable label shown on the login page button.
OAuth or SAML provider type. ‘google’ and ‘microsoft’ auto-populate the discovery URL; ‘oidc’ is generic OAuth/OIDC; ‘saml’ enables SAML SSO (requires enterprise edition).
Space-separated OAuth scopes.
Role assigned to new users created via this provider: ‘viewer’, ‘editor’, or ‘admin’.
Whether the provider button appears on the login page.
Responses
Section titled “ Responses ”Successful Response
Response schema for OAuth/SAML provider.
Write-only credentials are never exposed:
client_secret_encrypted(OAuth client secret) — excluded.idp_certificate(SAML IdP signing cert, Fernet-encrypted at rest) — excluded.
The 3 non-secret SAML fields (idp_entity_id, idp_sso_url,
sp_entity_id) ARE exposed so the admin UI can display them.
Pitfall 11 interaction: those 3 fields are declared with deferred=True
on the OAuth ORM model so community DBs (which lack the columns) do not
crash on SELECT. Pydantic’s from_attributes=True would normally trigger
an implicit deferred load on attribute access, which fails under FastAPI’s
async context with MissingGreenlet. The model_validator(mode="before")
below reads the SAML fields directly from obj.__dict__ so unloaded
attributes default to None instead of triggering IO. SAML admin endpoints
that need the values must use undefer_group("saml") at query time.
object
Unique provider identifier.
URL-safe identifier used in the callback URL.
Label shown on the login page button.
Provider type: ‘google’, ‘microsoft’, ‘oidc’, or ‘saml’.
Space-separated OAuth scopes.
Default role assigned to new users.
Whether the provider button appears on the login page.
Timestamp the provider was created.
Timestamp the provider was last updated.
Example generated
{ "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "slug": "example", "display_name": "example", "provider_type": "example", "client_id": "example", "discovery_url": "example", "authorize_url": "example", "token_url": "example", "userinfo_url": "example", "idp_entity_id": "example", "idp_sso_url": "example", "sp_entity_id": "example", "scopes": "example", "default_role": "example", "group_claim": "example", "group_role_mapping": {}, "enabled": true, "created_at": "2026-04-15T12:00:00Z", "updated_at": "2026-04-15T12:00:00Z"}Bad request — invalid query parameters or payload
object
Example
{ "type": "about:blank"}Unauthorized — missing or invalid credentials
object
Example
{ "type": "about:blank"}Forbidden — caller lacks access to this resource
object
Example
{ "type": "about:blank"}Not found
object
Example
{ "type": "about:blank"}Validation error
object
Example
{ "type": "about:blank"}Internal server error
object
Example
{ "type": "about:blank"}