API7 Docs
API7 GatewayAPI7 Enterprise Admin APIsCreate a login option

Create a login option

POST /api/login_options

POST /api/login_options

Interactive request editor loads with JavaScript.

Authorization

X-API-KEY<token>

In: header

Request Body

application/json

Response Body

application/json

curl -X POST "$API_BASE_URL/api/login_options" \  -H "Content-Type: application/json" \  -d '{}'

Successfully retrieved the paginated list of login options.

{
  "total": 1,
  "list": [
    {
      "id": "bd58fce2-b6cc-4d2d-a53c-6ce11b19c101",
      "created_at": 1742288232,
      "updated_at": 1742288235,
      "name": "example-login",
      "logo": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAYAAADgdz34AAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAH4SURBVHgBrVVLUhsxEH3SaBJSxJQWLLJKzAkClcqCVcINkhuYk6RygnCDkBOYI3iXTVKQE9ipggIGKKb42TAjNWrbY0+BkcY2b6ceqV/3688Ac6CrF+r/tfzmuyMxI25rL75klO+exDbFcxP0luItAjXbKteSsOe7qzAFWBJpbZOIVhNlkAkgyvHP96ZyBiyJMGaXnd8JQhJZgNBZSzGfRKS1LiRxR822dpwPPgq/PAyvRCzJnb1pukhXC9uZi5ylGfgPEzyZQbcWNwpJChtLcxyZ8WOaMYPua/XZRffzoT1xzq0Yn3vGX+B+EJOMr67yFkXZivO1XdjOnTRpROVr6XqKDmYh6JO4xy8vs00mMpJ2kpI0QwTl8RKUiZSlX+9yhcWSPqIiQaVBEyQ/Lbi2X7EK19LiULlOArWqvK00aC7wUSctWom3WcQZNH6/QT30VqACerX4HMMhY+yrfFxwgW3H9339aHLBgwQ8bG4e2sWZu+lAPSq4m0VsfDxF66E9KJE02Uge099Bj5ynzntjknNGuMgk3hd5JqU1McReluOrbx7CRRaynwGvCd5DIzOw5Vb1RmjYghkQdxCVNuhAks0PZ9hBBXgJSEPfGqoXPxdUkGQq8NK7WFL0Zxn0dxk/MAO8GQhX4E6cTSXJVAQnsdHXBmvzSHIP3R3bZScnj8UAAAAASUVORK5CYII=",
      "disable": false,
      "role_mapping": [
        {
          "role_id": "bd58fce2-b6cc-4d2d-a53c-6ce11b19c101",
          "role_attribute_key": "Position",
          "operation": "exact_match",
          "role_attribute_value": "Team Leader"
        }
      ],
      "boundary_mapping": [
        {
          "permission_policy_id": "b32e678e-7f6b-4a50-b113-550621ed4c01",
          "attribute_key": "Group",
          "operation": "exact_match",
          "attribute_value": "Finance"
        }
      ],
      "provider_type": "oidc",
      "oidc_config": {
        "client_id": "my-oidc-client-id",
        "client_secret": "s3cr3tK3yForOIDC",
        "issuer": "https://accounts.example.com",
        "request_scopes": [
          "openid",
          "email",
          "profile"
        ],
        "ssl_verify": true,
        "callback_url": "http://127.0.0.1:7080",
        "logout_url": "https://accounts.example.com/logout",
        "attributes": {
          "first_name": "john",
          "last_name": "doe",
          "username": "johndoe"
        }
      }
    }
  ]
}
Complete operation details and schema variants

POST /api/login_options

Create a login option

Create a new login option for external authentication integration. Supported protocols include OIDC, LDAP, SAML 2.0, and CAS. Required IAM Permission: Action iam:CreateLoginOption, Resource arn:api7:iam:organization/*

Parameters

Request body

Content type: application/json

  • allOf variant 1
  • name (string, optional): Name of the login option.
  • logo (string, optional): The base64-encoded logo image.
  • disable (boolean, optional): If true, disable the login option.
  • role_mapping (array, optional): A list of role mappings defining operations and conditions under which roles are applied.
  • role_mapping[].role_id (string, required): Unique identifier for the role.
  • role_mapping[].role_attribute_key (string, required): The key used to identify the role attribute.
  • role_mapping[].operation (string, required): The operation to apply on the role attribute.
  • role_mapping[].role_attribute_value (string, required): The value expected for the role attribute based on the operation.
  • boundary_mapping (array, optional): A list of permission boundary mappings defining operations and conditions under which permission boundary are applied.
  • boundary_mapping[].permission_policy_id (string, required): Unique identifier for the boundary permission policy.
  • boundary_mapping[].attribute_key (string, required): The Name of the boundary permission policy attribute.
  • boundary_mapping[].operation (string, required): The operation to apply on the role attribute.
  • boundary_mapping[].attribute_value (string, required): The value expected for the boundary permission policy attribute based on the operation.
  • allOf variant 2
  • oneOf variant 1: OIDC
  • provider_type (string, optional): The login option type.
  • oidc_config (object, optional): OIDC configuration.
  • oidc_config.client_id (string, required): The client ID of the OIDC provider.
  • oidc_config.client_secret (string, required): The client secret of the OIDC provider.
  • oidc_config.issuer (string, required): The issuer URL of the OIDC provider.
  • oidc_config.request_scopes (array, required): The request scopes of the OIDC provider.
  • oidc_config.ssl_verify (boolean, optional): If true, verify the SSL certificate of the OIDC provider.
  • oidc_config.root_url (string, required): The root URL for the OIDC provider used to generate the callback URL.
  • oneOf variant 1: url
  • oneOf variant 2: $env://
  • oidc_config.logout_url (string, optional): The logout URL of the OIDC provider.
  • oneOf variant 1: url
  • oneOf variant 2: $env://
  • oidc_config.attributes (object, optional): The attributes used to map the user information to API7 Enterprise.
  • oneOf variant 2: SAML
  • provider_type (string, optional): The login option type.
  • saml_config (object, optional): SAML configuration.
  • saml_config.idp_metadata_url (string, required): The IdP metadata URL of the SAML provider.
  • oneOf variant 1: url
  • oneOf variant 2: $env://
  • saml_config.sp_root_url (string, required): The SP root URL of the SAML provider.
  • oneOf variant 1: url
  • oneOf variant 2: $env://
  • saml_config.sign_request (boolean, optional): Whether to sign the request of the SAML provider.
  • saml_config.logout_idp_session (boolean, optional): Whether redirect to IdP for logout or not.
  • saml_config.private_key (string, optional): The private key of the SAML provider.
  • saml_config.certificate (string, optional): The certificate of the SAML provider.
  • saml_config.entity_id (string, optional): The entity ID of the SAML provider.
  • saml_config.attributes (object, optional): The attributes used to map the user information to API7 Enterprise.
  • oneOf variant 3: LDAP
  • provider_type (string, optional): The login option type.
  • ldap_config (object, optional): LDAP configuration.
  • ldap_config.host (string, required): The host domain of the LDAP server.
  • ldap_config.port (string, required): The port ID of the LDAP server.
  • ldap_config.base_dn (string, required): The base DN of the LDAP server.
  • ldap_config.bind_dn (string, required): Search user bind DN.
  • ldap_config.bind_password (string, optional): Search user bind password.
  • ldap_config.identifier (string, required): The identifier of the LDAP server. Together with the username, it forms the full DN.
  • ldap_config.attributes (object, optional): The attributes used to map the user information to API7 Enterprise.
  • ldap_config.timeout (integer, optional): Timeout in seconds.
  • ldap_config.use_ssl (boolean, optional): Set it to true if the LDAP server uses an encrypted TLS connection.
  • ldap_config.ssl_verify (boolean, optional): Set it to false if you want to skip SSL certificate validation.
  • ldap_config.root_ca_cert (string, optional): Set the data of your root CA certificate.
  • ldap_config.client_cert (string, optional): The client certificate.
  • ldap_config.client_key (string, optional): The client private key.
  • oneOf variant 4: CAS
  • provider_type (string, optional): The login option type.
  • cas_config (object, optional): CAS configuration.
  • cas_config.url (string, required): The URL of the CAS provider.
  • cas_config.send_service (boolean, optional): Whether to send service parameters.
  • cas_config.ssl_verify (boolean, optional): If true, verify the SSL certificate of the CAS provider.
  • cas_config.attributes (object, optional): The attributes used to map the user information to API7 Enterprise.
  • oneOf variant 5: Built-in
  • provider_type (string, optional): The login option type.
  • builtin_config (object, optional): Built-in configuration.
  • builtin_config.login_with_email (boolean, optional): If true, enable email login.

Responses

  • 200: Successfully retrieved the paginated list of login options.
  • allOf variant 1
  • list (array, optional): An array of resources.
  • total (integer, optional): Total number of objects.
  • allOf variant 2
  • list (array, optional): Array of login options
  • allOf variant 1
  • list[].id (string, optional): The object ID.
  • list[].created_at (integer, optional): The object created timestamp.
  • list[].updated_at (integer, optional): The object updated timestamp.
  • list[].name (string, optional): Name of the login option.
  • list[].logo (string, optional): The base64-encoded logo image.
  • list[].disable (boolean, optional): If true, disable the login option.
  • list[].role_mapping (array, optional): A list of role mappings defining operations and conditions under which roles are applied.
  • list[].role_mapping[].role_id (string, required): Unique identifier for the role.
  • list[].role_mapping[].role_attribute_key (string, required): The key used to identify the role attribute.
  • list[].role_mapping[].operation (string, required): The operation to apply on the role attribute.
  • list[].role_mapping[].role_attribute_value (string, required): The value expected for the role attribute based on the operation.
  • list[].boundary_mapping (array, optional): A list of boundary mappings defining operations and conditions under which boundaries are applied.
  • list[].boundary_mapping[].permission_policy_id (string, required): Unique identifier for the boundary permission policy.
  • list[].boundary_mapping[].attribute_key (string, required): The Name of the boundary permission policy attribute.
  • list[].boundary_mapping[].operation (string, required): The operation to apply on the role attribute.
  • list[].boundary_mapping[].attribute_value (string, required): The value expected for the boundary permission policy attribute based on the operation.
  • allOf variant 2
  • oneOf variant 1: OIDC
  • list[].provider_type (string, optional): The login option type.
  • list[].oidc_config (object, optional): OIDC configuration.
  • list[].oidc_config.client_id (string, required): The client ID of the OIDC provider.
  • list[].oidc_config.client_secret (string, optional): The client secret of the OIDC provider.
  • list[].oidc_config.issuer (string, required): The issuer URL of the OIDC provider.
  • list[].oidc_config.request_scopes (array, required): The request scopes of the OIDC provider.
  • list[].oidc_config.ssl_verify (boolean, optional): If true, verify the SSL certificate of the OIDC provider.
  • list[].oidc_config.callback_url (string, optional): The root URL for the OIDC provider used to generate the callback URL.
  • list[].oidc_config.logout_url (string, optional): The logout URL of the OIDC provider.
  • list[].oidc_config.attributes (object, optional): The attributes used to map the user information to API7 Enterprise.
  • oneOf variant 2: SAML
  • list[].provider_type (string, optional): The login option type.
  • list[].saml_config (object, optional): SAML configuration.
  • list[].saml_config.idp_metadata_url (string, required): The IdP metadata URL of the SAML provider.
  • list[].saml_config.sp_root_url (string, required): The SP root URL of the SAML provider.
  • list[].saml_config.sp_acs_url (string, optional): The SP ACS URL of the SAML provider.
  • list[].saml_config.sp_slo_url (string, optional): The SP SLO URL of the SAML provider.
  • list[].saml_config.sp_metadata_url (string, optional): The SP metadata URL of the SAML provider.
  • list[].saml_config.sign_request (boolean, optional): Whether to sign the request of the SAML provider.
  • list[].saml_config.certificate (string, optional): The certificate of the SAML provider.
  • list[].saml_config.entity_id (string, optional): The entity ID of the SAML provider.
  • list[].saml_config.attributes (object, optional): The attributes used to map the user information to API7 Enterprise.
  • oneOf variant 3: LDAP
  • list[].provider_type (string, optional): The login option type.
  • list[].ldap_config (object, optional): LDAP configuration.
  • list[].ldap_config.host (string, required): The host domain of the LDAP server.
  • list[].ldap_config.port (string, required): The port ID of the LDAP server.
  • list[].ldap_config.base_dn (string, required): The base DN of the LDAP server.
  • list[].ldap_config.bind_dn (string, required): Search user bind DN.
  • list[].ldap_config.bind_password (string, optional): Search user bind password.
  • list[].ldap_config.identifier (string, required): The identifier of the LDAP server. Together with the username, it forms the full DN.
  • list[].ldap_config.attributes (object, optional): The attributes used to map the user information to API7 Enterprise.
  • list[].ldap_config.timeout (integer, optional): Timeout in seconds.
  • list[].ldap_config.use_ssl (boolean, optional): Set it to true if the LDAP server uses an encrypted TLS connection.
  • list[].ldap_config.ssl_verify (boolean, optional): Set it to false if you want to skip SSL certificate validation.
  • list[].ldap_config.root_ca_cert (string, optional): Set the data of your root CA certificate.
  • list[].ldap_config.client_cert (string, optional): The client certificate.
  • list[].ldap_config.client_key (string, optional): The client private key.
  • oneOf variant 4: Built-in
  • list[].provider_type (string, optional): The login option type.
  • list[].builtin_config (object, optional): Built-in configuration.
  • list[].builtin_config.login_with_email (boolean, optional): If true, enable email login.
  • 400: Invalid arguments. Error details will be provided in the response.

cURL

curl -X POST '$API_BASE_URL/api/login_options'

List all login options

Previous Page

List all login options (public)

Next Page