Create or update an organization's OIDC connection

curl --request PUT \
  --url https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "issuer": "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0",
  "client_id": "0oa8f2k3l9XyZ1abc357",
  "client_secret": "<string>",
  "scopes": [
    "openid",
    "email",
    "profile"
  ],
  "claims": {
    "email": "email",
    "email_verified": "xms_edov",
    "name": "name",
    "groups": "groups"
  }
}
'

import requests

url = "https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc"

payload = {
    "issuer": "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0",
    "client_id": "0oa8f2k3l9XyZ1abc357",
    "client_secret": "<string>",
    "scopes": ["openid", "email", "profile"],
    "claims": {
        "email": "email",
        "email_verified": "xms_edov",
        "name": "name",
        "groups": "groups"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    issuer: 'https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0',
    client_id: '0oa8f2k3l9XyZ1abc357',
    client_secret: '<string>',
    scopes: ['openid', 'email', 'profile'],
    claims: {email: 'email', email_verified: 'xms_edov', name: 'name', groups: 'groups'}
  })
};

fetch('https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'issuer' => 'https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0',
    'client_id' => '0oa8f2k3l9XyZ1abc357',
    'client_secret' => '<string>',
    'scopes' => [
        'openid',
        'email',
        'profile'
    ],
    'claims' => [
        'email' => 'email',
        'email_verified' => 'xms_edov',
        'name' => 'name',
        'groups' => 'groups'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc"

	payload := strings.NewReader("{\n  \"issuer\": \"https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0\",\n  \"client_id\": \"0oa8f2k3l9XyZ1abc357\",\n  \"client_secret\": \"<string>\",\n  \"scopes\": [\n    \"openid\",\n    \"email\",\n    \"profile\"\n  ],\n  \"claims\": {\n    \"email\": \"email\",\n    \"email_verified\": \"xms_edov\",\n    \"name\": \"name\",\n    \"groups\": \"groups\"\n  }\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"issuer\": \"https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0\",\n  \"client_id\": \"0oa8f2k3l9XyZ1abc357\",\n  \"client_secret\": \"<string>\",\n  \"scopes\": [\n    \"openid\",\n    \"email\",\n    \"profile\"\n  ],\n  \"claims\": {\n    \"email\": \"email\",\n    \"email_verified\": \"xms_edov\",\n    \"name\": \"name\",\n    \"groups\": \"groups\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"issuer\": \"https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0\",\n  \"client_id\": \"0oa8f2k3l9XyZ1abc357\",\n  \"client_secret\": \"<string>\",\n  \"scopes\": [\n    \"openid\",\n    \"email\",\n    \"profile\"\n  ],\n  \"claims\": {\n    \"email\": \"email\",\n    \"email_verified\": \"xms_edov\",\n    \"name\": \"name\",\n    \"groups\": \"groups\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "id": "8b1d3f5a-2c4e-4f6a-8b0d-1e3f5a7c9b2d",
  "organization_id": "3f8c2a1e-7b4d-4e9a-9c61-2d5e8f0a1b7c",
  "protocol": "oidc",
  "issuer": "https://acme.okta.com",
  "client_id": "0oa8f2k3l9XyZ1abc357",
  "client_secret": {
    "set": true,
    "last4": "x9Qk"
  },
  "scopes": [
    "openid",
    "email",
    "profile"
  ],
  "claims": {
    "email": "email",
    "email_verified": "email_verified",
    "name": "name",
    "groups": "groups"
  },
  "status": "draft",
  "redirect_uri": "https://console.qumo-deploy.com/oauth/sso/callback",
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "last_tested_at": "2023-11-07T05:31:56Z",
  "last_test_succeeded_at": "2023-11-07T05:31:56Z",
  "last_test_result": "passed"
}

{
  "id": "8b1d3f5a-2c4e-4f6a-8b0d-1e3f5a7c9b2d",
  "organization_id": "3f8c2a1e-7b4d-4e9a-9c61-2d5e8f0a1b7c",
  "protocol": "oidc",
  "issuer": "https://acme.okta.com",
  "client_id": "0oa8f2k3l9XyZ1abc357",
  "client_secret": {
    "set": true,
    "last4": "x9Qk"
  },
  "scopes": [
    "openid",
    "email",
    "profile"
  ],
  "claims": {
    "email": "email",
    "email_verified": "email_verified",
    "name": "name",
    "groups": "groups"
  },
  "status": "draft",
  "redirect_uri": "https://console.qumo-deploy.com/oauth/sso/callback",
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "last_tested_at": "2023-11-07T05:31:56Z",
  "last_test_succeeded_at": "2023-11-07T05:31:56Z",
  "last_test_result": "passed"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

Organizations

Create or update an organization's OIDC connection

Creates the connection (201, in draft) or updates it (200). Every save fetches <issuer>/.well-known/openid-configuration and refuses it (422) unless its issuer is exactly the one given, its endpoints are https, it supports the code response type and RS256 or ES256 ID tokens, and it does not rule out S256 PKCE. The issuer must be a public https URL: internal addresses and redirects are refused. Changing the issuer, client id, client secret, scopes or claims clears the last test result and puts an active connection back to draft. Setting status to active needs the current configuration to have passed a test login (409). Needs the organization’s own plan to include SSO (Pay as you go or Enterprise; 402 on Free), and the organization not to be suspended (403); a save that sets status to disabled is never refused on the plan or a suspension.

PUT

organizations

{id}

sso

oidc

Create or update an organization's OIDC connection

curl --request PUT \
  --url https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "issuer": "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0",
  "client_id": "0oa8f2k3l9XyZ1abc357",
  "client_secret": "<string>",
  "scopes": [
    "openid",
    "email",
    "profile"
  ],
  "claims": {
    "email": "email",
    "email_verified": "xms_edov",
    "name": "name",
    "groups": "groups"
  }
}
'

import requests

url = "https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc"

payload = {
    "issuer": "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0",
    "client_id": "0oa8f2k3l9XyZ1abc357",
    "client_secret": "<string>",
    "scopes": ["openid", "email", "profile"],
    "claims": {
        "email": "email",
        "email_verified": "xms_edov",
        "name": "name",
        "groups": "groups"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    issuer: 'https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0',
    client_id: '0oa8f2k3l9XyZ1abc357',
    client_secret: '<string>',
    scopes: ['openid', 'email', 'profile'],
    claims: {email: 'email', email_verified: 'xms_edov', name: 'name', groups: 'groups'}
  })
};

fetch('https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'issuer' => 'https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0',
    'client_id' => '0oa8f2k3l9XyZ1abc357',
    'client_secret' => '<string>',
    'scopes' => [
        'openid',
        'email',
        'profile'
    ],
    'claims' => [
        'email' => 'email',
        'email_verified' => 'xms_edov',
        'name' => 'name',
        'groups' => 'groups'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc"

	payload := strings.NewReader("{\n  \"issuer\": \"https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0\",\n  \"client_id\": \"0oa8f2k3l9XyZ1abc357\",\n  \"client_secret\": \"<string>\",\n  \"scopes\": [\n    \"openid\",\n    \"email\",\n    \"profile\"\n  ],\n  \"claims\": {\n    \"email\": \"email\",\n    \"email_verified\": \"xms_edov\",\n    \"name\": \"name\",\n    \"groups\": \"groups\"\n  }\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"issuer\": \"https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0\",\n  \"client_id\": \"0oa8f2k3l9XyZ1abc357\",\n  \"client_secret\": \"<string>\",\n  \"scopes\": [\n    \"openid\",\n    \"email\",\n    \"profile\"\n  ],\n  \"claims\": {\n    \"email\": \"email\",\n    \"email_verified\": \"xms_edov\",\n    \"name\": \"name\",\n    \"groups\": \"groups\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.qumo-deploy.com/v1/organizations/{id}/sso/oidc")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"issuer\": \"https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0\",\n  \"client_id\": \"0oa8f2k3l9XyZ1abc357\",\n  \"client_secret\": \"<string>\",\n  \"scopes\": [\n    \"openid\",\n    \"email\",\n    \"profile\"\n  ],\n  \"claims\": {\n    \"email\": \"email\",\n    \"email_verified\": \"xms_edov\",\n    \"name\": \"name\",\n    \"groups\": \"groups\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "id": "8b1d3f5a-2c4e-4f6a-8b0d-1e3f5a7c9b2d",
  "organization_id": "3f8c2a1e-7b4d-4e9a-9c61-2d5e8f0a1b7c",
  "protocol": "oidc",
  "issuer": "https://acme.okta.com",
  "client_id": "0oa8f2k3l9XyZ1abc357",
  "client_secret": {
    "set": true,
    "last4": "x9Qk"
  },
  "scopes": [
    "openid",
    "email",
    "profile"
  ],
  "claims": {
    "email": "email",
    "email_verified": "email_verified",
    "name": "name",
    "groups": "groups"
  },
  "status": "draft",
  "redirect_uri": "https://console.qumo-deploy.com/oauth/sso/callback",
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "last_tested_at": "2023-11-07T05:31:56Z",
  "last_test_succeeded_at": "2023-11-07T05:31:56Z",
  "last_test_result": "passed"
}

{
  "id": "8b1d3f5a-2c4e-4f6a-8b0d-1e3f5a7c9b2d",
  "organization_id": "3f8c2a1e-7b4d-4e9a-9c61-2d5e8f0a1b7c",
  "protocol": "oidc",
  "issuer": "https://acme.okta.com",
  "client_id": "0oa8f2k3l9XyZ1abc357",
  "client_secret": {
    "set": true,
    "last4": "x9Qk"
  },
  "scopes": [
    "openid",
    "email",
    "profile"
  ],
  "claims": {
    "email": "email",
    "email_verified": "email_verified",
    "name": "name",
    "groups": "groups"
  },
  "status": "draft",
  "redirect_uri": "https://console.qumo-deploy.com/oauth/sso/callback",
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "last_tested_at": "2023-11-07T05:31:56Z",
  "last_test_succeeded_at": "2023-11-07T05:31:56Z",
  "last_test_result": "passed"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

Authorizations

Authorization

string

header

required

A personal access token (POST /v1/auth/tokens) or a machine identity token (POST /v1/projects/{project_id}/identities/{identity_id}/tokens), both prefixed qumo_pat_. A token's scopes cap what it can do; see Scopes and permissions. A personal token names no organization: on a route whose path names no project or organization, pass ?organization_id=.

Path Parameters

string<uuid>

required

The organization's id.

Body

application/json

issuer

string<uri>

required

The IdP's issuer, an https URL exactly as its discovery document states it.

Example:

"https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0"

client_id

string

required

Required string length: 1 - 255

Example:

"0oa8f2k3l9XyZ1abc357"

client_secret

string

write-only

Required on create. Omit on update to keep the stored secret. Encrypted at rest and never returned.

Required string length: 8 - 1024

scopes

string[]

Must include openid. Omitted, keeps the current scopes (on create, openid email profile).

Maximum array length: 20

Example:

["openid", "email", "profile"]

claims

object

Claim names to change; an omitted one keeps its current value (on create, the default). Each is 1 to 256 printable characters without spaces.

Show child attributes

status

enum<string>

Omitted, keeps the current status (on create, draft). active needs a passed test login of the current configuration.

Available options:

draft,

active,

disabled

Response

The connection was updated.

string<uuid>

required

Example:

"8b1d3f5a-2c4e-4f6a-8b0d-1e3f5a7c9b2d"

organization_id

string<uuid>

required

Example:

"3f8c2a1e-7b4d-4e9a-9c61-2d5e8f0a1b7c"

protocol

enum<string>

required

Available options:

oidc

issuer

string<uri>

required

Example:

"https://acme.okta.com"

client_id

string

required

Example:

"0oa8f2k3l9XyZ1abc357"

client_secret

object

required

What the API says about the client secret; never the secret itself.

Show child attributes

scopes

string[]

required

Example:

["openid", "email", "profile"]

claims

object

required

The ID token claims read for each attribute, by name.

Show child attributes

status

enum<string>

required

draft until activated: a draft connection can be tested but is not used to sign in. active once a test login of the current configuration passed and it was activated. disabled when turned off.

Available options:

draft,

active,

disabled

redirect_uri

string<uri>

required

The redirect URI to register at the IdP.

Example:

"https://console.qumo-deploy.com/oauth/sso/callback"

created_at

string<date-time>

required

updated_at

string<date-time>

required

last_tested_at

string<date-time> | null

required

When the current configuration last finished a test login; cleared when the configuration changes.

last_test_succeeded_at

string<date-time> | null

required

When the current configuration last passed a test login.

last_test_result

enum<string>

The last test login's result; absent before the first.

Available options:

passed,

exchange_failed,

invalid_token,

email_missing,

email_unverified,

discovery_failed,

configuration_changed,

idp_denied