Update OIDC Provider

PATCH /environments/{env_id}/oidc_providers/{oidc_provider_id}

Update OIDC Provider

Update selected fields on an OIDC provider. The provider name is fixed at creation — delete and recreate the provider to change it. Changes take effect on new requests without a gateway restart.

Parameters

• env_id (path, string, required): Environment ID that scopes the request.
• oidc_provider_id (path, string, required): OIDC provider ID within the environment.

Request body

Content type: application/json

• issuer (string, optional): Expected iss claim. Unique within the environment.

• audiences (array, optional): Accepted aud values.

• jwks_uri (string, optional): Endpoint the token signing keys are fetched from. Set to null to fall back to OIDC discovery on the issuer.

• identity_claim (string, optional): Claim whose value selects the API key to act as.

• required_scopes (array, optional): Scopes that must all be present in the token's scope claim. Set to null or [] to require none.

• bound_claims (object, optional): Replacement claim requirements. Set to null or an empty object to remove all bound-claim requirements.

• allOf variant 1

• oneOf variant 1

• oneOf variant 2

• leeway_secs (integer, optional): Clock-skew allowance in seconds.

• enabled (boolean, optional): Whether the provider participates in JWT authentication.

Responses

• 200: OK

• oidc_provider (object, required): An identity provider the gateway trusts for JWT authentication. Requests presenting a JWT issued by an enabled provider run as the API key whose jwt_subject equals the token's identity claim.

• oidc_provider.id (string, required): OIDC provider ID.

• oidc_provider.env_id (string, required): Environment ID that owns this provider.

• oidc_provider.name (string, required): Human-readable provider name, unique within the environment. Fixed at creation.

• oidc_provider.issuer (string, required): Expected iss claim, compared exactly against the token's issuer. Tokens whose issuer matches no enabled provider are rejected.

• oidc_provider.audiences (array, required): Accepted aud values. A token's audience must contain at least one of these; tokens without an audience claim are rejected.

• oidc_provider.jwks_uri (string, optional): Endpoint the token signing keys are fetched from. When omitted, the endpoint is resolved from the issuer's OIDC discovery document (<issuer>/.well-known/openid-configuration). Signing-key rotation at the identity provider is picked up automatically.

• oidc_provider.identity_claim (string, required): Claim whose value selects the API key to act as: the request is bound to the key whose jwt_subject equals this claim's value. Dots traverse nested objects.

• oidc_provider.required_scopes (array, required): Scopes that must all be present in the token's scope claim (a space-delimited string or an array of strings). An empty list requires nothing.

• oidc_provider.bound_claims (object, optional): Claim requirements a token must satisfy, all of which must hold. Keys name claims, with dots traversing nested objects (for example realm_access.roles). Each requirement is satisfied when the claim equals — or, for array claims, contains — the expected value (a single string) or at least one of the expected values (an array of strings).

• oneOf variant 1

• oneOf variant 2

• oidc_provider.leeway_secs (integer, required): Clock-skew allowance in seconds applied to the token's time-based claims.

• oidc_provider.enabled (boolean, required): Disabled providers are kept but tokens they issued no longer authenticate.

• oidc_provider.created_at (string, required): Time when the provider was created.

• oidc_provider.updated_at (string, required): Time when the provider was last updated.

• 400: Request body or parameters failed validation.

• error (object, required): Error details.

• error.code (string, required): Machine-readable identifier. Examples: UNAUTHENTICATED, INVALID_REQUEST, MASTER_KEY_UNSET, INTERNAL.

• error.message (string, required): Human-readable explanation; safe to surface to operators.

• 401: Missing or invalid bearer. Response fields (application/json): identical to PATCH /environments/{env_id}/oidc_providers/{oidc_provider_id}, response 400 above.

• 403: Authenticated request is not permitted. Response fields (application/json): identical to PATCH /environments/{env_id}/oidc_providers/{oidc_provider_id}, response 400 above.

• 404: Resource not found. Response fields (application/json): identical to PATCH /environments/{env_id}/oidc_providers/{oidc_provider_id}, response 400 above.

• 409: Request conflicts with current resource state. Response fields (application/json): identical to PATCH /environments/{env_id}/oidc_providers/{oidc_provider_id}, response 400 above.

cURL

curl -X PATCH '$AISIX_CP/environments/{env_id}/oidc_providers/{oidc_provider_id}' -H 'Authorization: Bearer $AISIX_TOKEN'