List OIDC Providers

GET /environments/{env_id}/oidc_providers

List OIDC Providers

Return every OIDC provider configured for JWT authentication in the environment. The response is not paginated.

Parameters

• env_id (path, string, required): Environment ID that scopes the request.

Responses

• 200: OK

• data (array, required): OIDC providers configured in the environment.

• data[].id (string, required): OIDC provider ID.

• data[].env_id (string, required): Environment ID that owns this provider.

• data[].name (string, required): Human-readable provider name, unique within the environment. Fixed at creation.

• data[].issuer (string, required): Expected iss claim, compared exactly against the token's issuer. Tokens whose issuer matches no enabled provider are rejected.

• data[].audiences (array, required): Accepted aud values. A token's audience must contain at least one of these; tokens without an audience claim are rejected.

• data[].jwks_uri (string, optional): Endpoint the token signing keys are fetched from. When omitted, the endpoint is resolved from the issuer's OIDC discovery document (<issuer>/.well-known/openid-configuration). Signing-key rotation at the identity provider is picked up automatically.

• data[].identity_claim (string, required): Claim whose value selects the API key to act as: the request is bound to the key whose jwt_subject equals this claim's value. Dots traverse nested objects.

• data[].required_scopes (array, required): Scopes that must all be present in the token's scope claim (a space-delimited string or an array of strings). An empty list requires nothing.

• data[].bound_claims (object, optional): Claim requirements a token must satisfy, all of which must hold. Keys name claims, with dots traversing nested objects (for example realm_access.roles). Each requirement is satisfied when the claim equals — or, for array claims, contains — the expected value (a single string) or at least one of the expected values (an array of strings).

• oneOf variant 1

• oneOf variant 2

• data[].leeway_secs (integer, required): Clock-skew allowance in seconds applied to the token's time-based claims.

• data[].enabled (boolean, required): Disabled providers are kept but tokens they issued no longer authenticate.

• data[].created_at (string, required): Time when the provider was created.

• data[].updated_at (string, required): Time when the provider was last updated.

• 400: Request body or parameters failed validation.

• error (object, required): Error details.

• error.code (string, required): Machine-readable identifier. Examples: UNAUTHENTICATED, INVALID_REQUEST, MASTER_KEY_UNSET, INTERNAL.

• error.message (string, required): Human-readable explanation; safe to surface to operators.

• 401: Missing or invalid bearer. Response fields (application/json): identical to GET /environments/{env_id}/oidc_providers, response 400 above.

• 404: Resource not found. Response fields (application/json): identical to GET /environments/{env_id}/oidc_providers, response 400 above.

cURL

curl -X GET '$AISIX_CP/environments/{env_id}/oidc_providers' -H 'Authorization: Bearer $AISIX_TOKEN'