Identity providers

Identity providers define how your users authenticate to your tenant when attempting to access content.

Download OpenAPI spec

List IdPs

This endpoint retrieves any IdPs registered on the tenant.

Facts

Rate limit Tier 1 (1000 requests per minute)

Query Parameters

  • active boolean

    If provided, filters the results by the active field.

  • limit number

    The number of IdP entries to retrieve.

    minimum = 1, maximum = 100, default = 20, default = 20

  • next string

    The next page cursor.

  • prev string

    The previous page cursor.

Responses

200

Success

  • application/json object
    Show application/json properties
    • data array of undefineds

      An array of IdPs.

      One of:
      • IDPOIDC object

        An OIDC-compliant identity provider.

        Show IDPOIDC properties
        • id string

          The unique identifier for the IdP.

        • meta object
        • active boolean

          Indicates whether the IdP is available for use.

        • created string

          The timestamp for when the IdP was created.

          format = "date-time"

        • protocol string

          The protocol to be used for communicating with the identity provider. Valid values are OIDC, SAML, jwtAuth, and qsefw-local-bearer-token.

          Can be one of: "OIDC""SAML""jwtAuth""qsefw-local-bearer-token"

        • provider string

          The identity provider to be used. If protocol is OIDC, the valid values are auth0, okta, generic, salesforce, keycloak, adfs, and azureAD. If protocol is jwtAuth, the valid value is external.

          Can be one of: "auth0""okta""qlik""generic""salesforce""keycloak""adfs""external""azureAD"

        • tenantIds array of strings

          The tenant identifiers associated with the given IdP.

        • description string
        • interactive boolean

          Indicates the type of connection with the IdP, either interactive login or a machine to machine connection.

        • lastUpdated string

          The timestamp for when the IdP was last updated.

          format = "date-time"

        • clockToleranceSec integer
        • createNewUsersOnLogin boolean

          When the flag is true, new users should be created when logging in for the first time.

        • postLogoutRedirectUri string

          Direct the user on logout to a specific URI.

        • options object
          Show options properties
          • realm string

            The realm identifier for the IdP.

          • scope string

            Scope that will be sent along with token requests to the IdP.

          • issuer string

            This field is only used in Qlik Sense Enterprise Client-Managed IdPs.

          • clientId string

            The client identifier used as part of authenticating an interactive identity provider.

          • clientSecret string

            The client secret used as part of authenticating an interactive identity provider.

          • discoveryUrl string

            The OpenID configuration endpoint. (Ex: https:///.well-known/openid-configuration).

          • claimsMapping object

            Mappings from claim name to an array of JSON pointers that point to locations in the claims from the IdP to retrieve the value from.

            Show claimsMapping properties
            • sub array of strings

              A list of JSON pointers used to map the user's subject.

            • name array of strings

              A list of JSON pointers used to map the user's name.

            • email array of strings

              A list of JSON pointers used to map the user's email.

            • groups array of strings

              A list of JSON pointers used to map the user's groups.

            • locale array of strings

              A list of JSON pointers used to map the user's locale.

            • picture array of strings

              A list of JSON pointers used to map the user's picture.

            • zoneinfo array of strings

              A list of JSON pointers used to map the user's zoneinfo.

            • client_id array of strings

              A list of JSON pointers used to map the user's client ID.

            • email_verified array of strings

              A list of JSON pointers used to map the user's email_verified claim.
          • decryptingKey object

            A decrypting key used to decrypt OIDC encrypted assertions

            Show decryptingKey properties
            • jwks string

              The public key in jwk format

            • keyId string

              The id of the decrypting key

            • keySize integer
              Required

              The algorithm size of the decrypting key

            • keyType string
              Required

              The algorithm type of the decrypting key

            • createdAt string

              The timestamp for when the decrypting key was created.

              format = "date-time"

            • createdBy string

              The user id of the user who created the decrypting key

            • publicKey string

              The public key in pem format

            • certificate string

              The key's certificate in pem format
          • openid_configuration object

            OpenID configuration

            Show openid_configuration properties
            • issuer string
              Required

              OpenID Provider issuer

            • jwks_uri string
              Required

              URL of the OP's JSON Web Key Set [JWK] document

            • token_endpoint string
              Required

              OAuth 2.0 Token Endpoint

            • userinfo_endpoint string

              URL of the OP's UserInfo Endpoint

            • end_session_endpoint string

              URL at the OP to which an RP can perform a redirect to request that the End-User be logged out at the OP.

            • authorization_endpoint string
              Required

              OAuth 2.0 Authorization Endpoint

            • introspection_endpoint string

              The introspection endpoint is an OAuth 2.0 endpoint that takes a parameter representing an OAuth 2.0 token and returns a JSON [RFC7159] document representing the meta information.
          • blockOfflineAccessScope boolean

            If true, the offline_access scope will not be requested from the IdP, where applicable.

          • emailVerifiedAlwaysTrue boolean

            Determines if email_verified should be always true. This field is only used in ADFS and AzureAD IdPs.
        • pendingState string

          The state of pendingOptions. This represents the latest IdP test result.

          Can be one of: "verified""pending""error"

        • pendingResult object
          Show pendingResult properties
          • error string

            A unique readable error message based on the error that has occurred.

          • status string
            Required

            The status of the IdP configuration being tested.

            Can be one of: "success""pending""error""claimsError""callbackError""tokenError""protocolError""networkError""configChangedDuringTestError"

          • started string

            The timestamp for when the test was started for an IdP configuration. This field is only available during lifespan of the test.

            format = "date-time"

          • protocol string

            The protocol used to communicate with the IdP during the test flow.

            Can be one of: "OIDC""SAML"

          • idpClaims object

            The claims retrieved from the external IdP.

          • oauth2Error object
            Show oauth2Error properties
            • error string
              Required

              An error code to identity the authentication error.

            • errorURI string

              An optional URI that includes additional information about the given error.

            • errorDescription string

              An optional human-readable description for the given error code.
          • resultantClaims object

            The resultant claims based on the claims received from the external IdP.
        • pendingOptions object
          Show pendingOptions properties
          • realm string

            The realm identifier for the IdP.

          • scope string

            Scope that will be sent along with token requests to the IdP.

          • issuer string

            This field is only used in Qlik Sense Enterprise Client-Managed IdPs.

          • clientId string

            The client identifier used as part of authenticating an interactive identity provider.

          • clientSecret string

            The client secret used as part of authenticating an interactive identity provider.

          • discoveryUrl string

            The OpenID configuration endpoint. (Ex: https:///.well-known/openid-configuration).

          • claimsMapping object

            Mappings from claim name to an array of JSON pointers that point to locations in the claims from the IdP to retrieve the value from.

            Show claimsMapping properties
            • sub array of strings

              A list of JSON pointers used to map the user's subject.

            • name array of strings

              A list of JSON pointers used to map the user's name.

            • email array of strings

              A list of JSON pointers used to map the user's email.

            • groups array of strings

              A list of JSON pointers used to map the user's groups.

            • locale array of strings

              A list of JSON pointers used to map the user's locale.

            • picture array of strings

              A list of JSON pointers used to map the user's picture.

            • zoneinfo array of strings

              A list of JSON pointers used to map the user's zoneinfo.

            • client_id array of strings

              A list of JSON pointers used to map the user's client ID.

            • email_verified array of strings

              A list of JSON pointers used to map the user's email_verified claim.
          • decryptingKey object

            A decrypting key used to decrypt OIDC encrypted assertions

            Show decryptingKey properties
            • jwks string

              The public key in jwk format

            • keyId string

              The id of the decrypting key

            • keySize integer
              Required

              The algorithm size of the decrypting key

            • keyType string
              Required

              The algorithm type of the decrypting key

            • createdAt string

              The timestamp for when the decrypting key was created.

              format = "date-time"

            • createdBy string

              The user id of the user who created the decrypting key

            • publicKey string

              The public key in pem format

            • certificate string

              The key's certificate in pem format
          • openid_configuration object

            OpenID configuration

            Show openid_configuration properties
            • issuer string
              Required

              OpenID Provider issuer

            • jwks_uri string
              Required

              URL of the OP's JSON Web Key Set [JWK] document

            • token_endpoint string
              Required

              OAuth 2.0 Token Endpoint

            • userinfo_endpoint string

              URL of the OP's UserInfo Endpoint

            • end_session_endpoint string

              URL at the OP to which an RP can perform a redirect to request that the End-User be logged out at the OP.

            • authorization_endpoint string
              Required

              OAuth 2.0 Authorization Endpoint

            • introspection_endpoint string

              The introspection endpoint is an OAuth 2.0 endpoint that takes a parameter representing an OAuth 2.0 token and returns a JSON [RFC7159] document representing the meta information.
          • blockOfflineAccessScope boolean

            If true, the offline_access scope will not be requested from the IdP, where applicable.

          • emailVerifiedAlwaysTrue boolean

            Determines if email_verified should be always true. This field is only used in ADFS and AzureAD IdPs.
      • IDPSAML object

        A SAML-compliant identity provider.

        Show IDPSAML properties
        • id string

          The unique identifier for the IdP.

        • meta object
        • active boolean

          Indicates whether the IdP is available for use.

        • created string

          The timestamp for when the IdP was created.

          format = "date-time"

        • protocol string

          The protocol to be used for communicating with the identity provider. Valid values are OIDC, SAML, jwtAuth, and qsefw-local-bearer-token.

          Can be one of: "OIDC""SAML""jwtAuth""qsefw-local-bearer-token"

        • provider string

          The identity provider to be used. If protocol is OIDC, the valid values are auth0, okta, generic, salesforce, keycloak, adfs, and azureAD. If protocol is jwtAuth, the valid value is external.

          Can be one of: "auth0""okta""qlik""generic""salesforce""keycloak""adfs""external""azureAD"

        • tenantIds array of strings

          The tenant identifiers associated with the given IdP.

        • description string
        • interactive boolean

          Indicates the type of connection with the IdP, either interactive login or a machine to machine connection.

        • lastUpdated string

          The timestamp for when the IdP was last updated.

          format = "date-time"

        • clockToleranceSec integer
        • createNewUsersOnLogin boolean

          When the flag is true, new users should be created when logging in for the first time.

        • postLogoutRedirectUri string

          Direct the user on logout to a specific URI.

        • options object
          Show options properties
          • entityId string

            The entity URL for the SAML IdP.

          • signOnUrl string

            The sign on URL for the SAML IdP.

          • signingKeys array of objects

            Set of certificates used to sign SAMLRequest payloads. Not present in pendingOptions.

            Show signingKeys properties
            • refId string

              The reference ID for choosing this key pair.

            • certificate string

              The certificate to be uploaded to the identity provider for verifying SAML requests.
          • certificates array of objects

            The certificates used for validating signed responses.

            Show certificates properties
            • name string

              Given name for this certificate.

            • signature boolean

              Indicates whether the certificate is used for the signature.

              default = true

            • encryption boolean

              Indicates whether the certificate is used for encryption.

              default = false

            • certificate string
              Required

              The X.509 certificate for validating signed SAML responses.
          • nameIdFormat string

            The name identifier format that will be requested from the identity provider.

            Can be one of: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress""urn:oasis:names:tc:SAML:2.0:nameid-format:persistent""urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

          • claimsMapping object

            Mappings from claim name to an array of SAML attribute names that point to locations in the claims from the IdP to retrieve the value from.

            Show claimsMapping properties
            • sub array of strings
              Required

              A list of SAML attributes used to map the user's subject.

            • name array of strings
              Required

              A list of SAML attributes used to map the user's name.

            • email array of strings
              Required

              A list of SAML attributes used to map the user's email.

            • groups array of strings
              Required

              A list of SAML attributes used to map the user's groups.

            • picture array of strings
              Required

              A list of SAML attributes used to map the user's picture.
          • allowIdpInitiatedLogin boolean

            Toggle to allow IdP initated login by the SAML IdP.

          • signingKeySelectedRefId string

            The reference ID of the chosen signing key pair.
        • pendingState string

          The state of pendingOptions. This represents the latest IdP test result.

          Can be one of: "verified""pending""error"

        • pendingResult object
          Show pendingResult properties
          • error string

            A unique readable error message based on the error that has occurred.

          • status string
            Required

            The status of the IdP configuration being tested.

            Can be one of: "success""pending""error""claimsError""callbackError""tokenError""protocolError""networkError""configChangedDuringTestError"

          • started string

            The timestamp for when the test was started for an IdP configuration. This field is only available during lifespan of the test.

            format = "date-time"

          • protocol string

            The protocol used to communicate with the IdP during the test flow.

            Can be one of: "OIDC""SAML"

          • idpClaims object

            The claims retrieved from the external IdP.

          • oauth2Error object
            Show oauth2Error properties
            • error string
              Required

              An error code to identity the authentication error.

            • errorURI string

              An optional URI that includes additional information about the given error.

            • errorDescription string

              An optional human-readable description for the given error code.
          • resultantClaims object

            The resultant claims based on the claims received from the external IdP.
        • pendingOptions object
          Show pendingOptions properties
          • entityId string

            The entity URL for the SAML IdP.

          • signOnUrl string

            The sign on URL for the SAML IdP.

          • signingKeys array of objects

            Set of certificates used to sign SAMLRequest payloads. Not present in pendingOptions.

            Show signingKeys properties
            • refId string

              The reference ID for choosing this key pair.

            • certificate string

              The certificate to be uploaded to the identity provider for verifying SAML requests.
          • certificates array of objects

            The certificates used for validating signed responses.

            Show certificates properties
            • name string

              Given name for this certificate.

            • signature boolean

              Indicates whether the certificate is used for the signature.

              default = true

            • encryption boolean

              Indicates whether the certificate is used for encryption.

              default = false

            • certificate string
              Required

              The X.509 certificate for validating signed SAML responses.
          • nameIdFormat string

            The name identifier format that will be requested from the identity provider.

            Can be one of: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress""urn:oasis:names:tc:SAML:2.0:nameid-format:persistent""urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

          • claimsMapping object

            Mappings from claim name to an array of SAML attribute names that point to locations in the claims from the IdP to retrieve the value from.

            Show claimsMapping properties
            • sub array of strings
              Required

              A list of SAML attributes used to map the user's subject.

            • name array of strings
              Required

              A list of SAML attributes used to map the user's name.

            • email array of strings
              Required

              A list of SAML attributes used to map the user's email.

            • groups array of strings
              Required

              A list of SAML attributes used to map the user's groups.

            • picture array of strings
              Required

              A list of SAML attributes used to map the user's picture.
          • allowIdpInitiatedLogin boolean

            Toggle to allow IdP initated login by the SAML IdP.

          • signingKeySelectedRefId string

            The reference ID of the chosen signing key pair.
      • IDPJWTAuth object

        An identity provider for JWT authentication.

        Show IDPJWTAuth properties
        • id string

          The unique identifier for the IdP.

        • meta object
        • active boolean

          Indicates whether the IdP is available for use.

        • created string

          The timestamp for when the IdP was created.

          format = "date-time"

        • protocol string

          The protocol to be used for communicating with the identity provider. Valid values are OIDC, SAML, jwtAuth, and qsefw-local-bearer-token.

          Can be one of: "OIDC""SAML""jwtAuth""qsefw-local-bearer-token"

        • provider string

          The identity provider to be used. If protocol is OIDC, the valid values are auth0, okta, generic, salesforce, keycloak, adfs, and azureAD. If protocol is jwtAuth, the valid value is external.

          Can be one of: "auth0""okta""qlik""generic""salesforce""keycloak""adfs""external""azureAD"

        • tenantIds array of strings

          The tenant identifiers associated with the given IdP.

        • description string
        • interactive boolean

          Indicates the type of connection with the IdP, either interactive login or a machine to machine connection.

        • lastUpdated string

          The timestamp for when the IdP was last updated.

          format = "date-time"

        • clockToleranceSec integer
        • createNewUsersOnLogin boolean

          When the flag is true, new users should be created when logging in for the first time.

        • postLogoutRedirectUri string

          Direct the user on logout to a specific URI.

        • options object
          Show options properties
          • issuer string

            The expected JWT issuer

          • staticKeys array of objects
            Show staticKeys properties
            • kid string

              Key ID used to sign the JWTs.

            • pem string

              Pem-encoded public key for verifying the JWTs.
    • links object

      Contains pagination links.

      Show links properties
      • next object
        Show next properties
        • href string

          Link to the next page of items.
      • prev object
        Show prev properties
        • href string

          Link to the previous page of items.
      • self object
        Show self properties
        • href string

          Link to the current page of items.

404

Not Found

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.
GET /api/v1/identity-providers 
import { createQlikApi } from '@qlik/api'


const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})


await qlik.identityProviders.getIdps({})
qlik identity-provider ls
curl "https://{tenant}.{region}.qlikcloud.com/api/v1/identity-providers" \
-H "Authorization: Bearer <access_token>"

Example Response

{
  "data": [
    {
      "id": "string",
      "meta": {},
      "active": true,
      "created": "2018-10-30T07:06:22Z",
      "protocol": "OIDC",
      "provider": "auth0",
      "tenantIds": [
        "string"
      ],
      "description": "string",
      "interactive": true,
      "lastUpdated": "2018-10-30T07:06:22Z",
      "clockToleranceSec": 42,
      "createNewUsersOnLogin": true,
      "postLogoutRedirectUri": "string",
      "options": {
        "realm": "string",
        "scope": "string",
        "issuer": "string",
        "clientId": "string",
        "clientSecret": "string",
        "discoveryUrl": "string",
        "claimsMapping": {
          "sub": [
            "string"
          ],
          "name": [
            "string"
          ],
          "email": [
            "string"
          ],
          "groups": [
            "string"
          ],
          "locale": [
            "string"
          ],
          "picture": [
            "string"
          ],
          "zoneinfo": [
            "string"
          ],
          "client_id": [
            "string"
          ],
          "email_verified": [
            "string"
          ]
        },
        "decryptingKey": {
          "jwks": "string",
          "keyId": "string",
          "keySize": 42,
          "keyType": "string",
          "createdAt": "2018-10-30T07:06:22Z",
          "createdBy": "string",
          "publicKey": "string",
          "certificate": "string"
        },
        "openid_configuration": {
          "issuer": "string",
          "jwks_uri": "string",
          "token_endpoint": "string",
          "userinfo_endpoint": "string",
          "end_session_endpoint": "string",
          "authorization_endpoint": "string",
          "introspection_endpoint": "string"
        },
        "blockOfflineAccessScope": true,
        "emailVerifiedAlwaysTrue": true
      },
      "pendingState": "verified",
      "pendingResult": {
        "error": "string",
        "status": "success",
        "started": "2018-10-30T07:06:22Z",
        "protocol": "OIDC",
        "idpClaims": {},
        "oauth2Error": {
          "error": "string",
          "errorURI": "string",
          "errorDescription": "string"
        },
        "resultantClaims": {}
      },
      "pendingOptions": {
        "realm": "string",
        "scope": "string",
        "issuer": "string",
        "clientId": "string",
        "clientSecret": "string",
        "discoveryUrl": "string",
        "claimsMapping": {
          "sub": [
            "string"
          ],
          "name": [
            "string"
          ],
          "email": [
            "string"
          ],
          "groups": [
            "string"
          ],
          "locale": [
            "string"
          ],
          "picture": [
            "string"
          ],
          "zoneinfo": [
            "string"
          ],
          "client_id": [
            "string"
          ],
          "email_verified": [
            "string"
          ]
        },
        "decryptingKey": {
          "jwks": "string",
          "keyId": "string",
          "keySize": 42,
          "keyType": "string",
          "createdAt": "2018-10-30T07:06:22Z",
          "createdBy": "string",
          "publicKey": "string",
          "certificate": "string"
        },
        "openid_configuration": {
          "issuer": "string",
          "jwks_uri": "string",
          "token_endpoint": "string",
          "userinfo_endpoint": "string",
          "end_session_endpoint": "string",
          "authorization_endpoint": "string",
          "introspection_endpoint": "string"
        },
        "blockOfflineAccessScope": true,
        "emailVerifiedAlwaysTrue": true
      }
    }
  ],
  "links": {
    "next": {
      "href": "string"
    },
    "prev": {
      "href": "string"
    },
    "self": {
      "href": "string"
    }
  }
}

Create a new IdP

Creates a new IdP on a tenant. Requesting user must be assigned the TenantAdmin role. For non-interactive IdPs (e.g. JWT), IdP must be created by sending options payload. For interactive IdPs (e.g. SAML or OIDC), send pendingOptions payload to require the interactive verification step; or send options payload with skipVerify set to true to skip validation step and make IdP immediately available.

Facts

Rate limit Tier 2 (100 requests per minute)

Request Body

Attributes that the user wants to set for a new identity provider resource.

  • application/json object
    One of:
    • CreateOIDCPayload object

      Payload for creating an OIDC-compatible identity provider.

      Show CreateOIDCPayload properties
      • options object

        Required OIDC configurations for non-interactive IdPs and interactive IdPs with skipVerify flag enabled.

        Show options properties
        • realm string

          The realm identifier for the IdP.

          maxLength = 254, pattern = "^[A-Za-z0-9][A-Za-z0-9.\-_]+$"

        • audience string

          Allows for setting audience in access tokens.

          maxLength = 256

        • discoveryUrl string

          The OpenID configuration endpoint. (Ex: https:///.well-known/openid-configuration). Required if openid_configuration is not given.

        • claimsMapping object
          Required

          Mappings from claim name to an array of JSON pointers that point to locations in the claims from the IdP to retrieve the value from.

          Show claimsMapping properties
          • sub array of strings

            A list of JSON pointers used to map the user's subject.

          • client_id array of strings

            A list of JSON pointers used to map the user's client ID.
        • allowedClientIds array of strings

          Only clients with IDs in this list will be allowed API access. A blank list or empty value means any client IDs authenticated against the IdP will be allowed access.

        • openid_configuration object

          OpenID configuration

          Show openid_configuration properties
          • issuer string
            Required

            OpenID Provider issuer

          • jwks_uri string
            Required

            URL of the OP's JSON Web Key Set [JWK] document

          • token_endpoint string
            Required

            OAuth 2.0 Token Endpoint

          • userinfo_endpoint string

            URL of the OP's UserInfo Endpoint

          • end_session_endpoint string

            URL at the OP to which an RP can perform a redirect to request that the End-User be logged out at the OP.

          • authorization_endpoint string
            Required

            OAuth 2.0 Authorization Endpoint

          • introspection_endpoint string

            The introspection endpoint is an OAuth 2.0 endpoint that takes a parameter representing an OAuth 2.0 token and returns a JSON [RFC7159] document representing the meta information.
      • protocol string
        Required

        The protocol to be used for communicating with the identity provider.

        Can be one of: "OIDC"

      • provider string
        Required

        The identity provider to be used.

        Can be one of: "auth0""okta""generic""salesforce""keycloak""adfs""azureAD"

      • tenantIds array of strings

        The tenant identifiers that map to the given IdP.

      • skipVerify boolean

        If set to true, skips IdP verification process and assumes the IdP is verified.

        default = false

      • description string

        maxLength = 128

      • interactive boolean
        Required

        Indicates whether the IdP is meant for interactive login.

        default = false

      • pendingOptions object

        Required OIDC configurations for interactive IdPs that require verification.

        Show pendingOptions properties
        • realm string

          The realm identifier for the IdP.

          maxLength = 254, pattern = "^[A-Za-z0-9][A-Za-z0-9.\-_]+$"

        • scope string

          Scope which will be sent along with token requests to the IdP. Scopes should be space delimited. Will default to certain values depending on the IdP provider.

          maxLength = 254

        • clientId string
          Required

          The client identifier used as part of authenticating an interactive identity provider.

        • clientSecret string
          Required

          The client secret used as part of authenticating an interactive identity provider.

        • discoveryUrl string

          The OpenID configuration endpoint. (Ex: https:///.well-known/openid-configuration). Required if openid_configuration is not given.

        • claimsMapping object
          Required

          Mappings from claim name to an array of JSON pointers that point to locations in the claims from the IdP to retrieve the value from.

          Show claimsMapping properties
          • sub array of strings

            A list of JSON pointers used to map the user's subject.

          • name array of strings

            A list of JSON pointers used to map the user's name.

          • email array of strings

            A list of JSON pointers used to map the user's email.

          • groups array of strings

            A list of JSON pointers used to map the user's groups.

          • locale array of strings

            A list of JSON pointers used to map the user's locale.

          • picture array of strings

            A list of JSON pointers used to map the user's picture.

          • zoneinfo array of strings

            A list of JSON pointers used to map the user's zoneinfo.

          • client_id array of strings

            A list of JSON pointers used to map the user's client ID.

          • email_verified array of strings

            A list of JSON pointers used to map the user's email_verified claim.
        • decryptingKey object

          A decrypting key used to decrypt OIDC encrypted assertions

          Show decryptingKey properties
          • jwks string

            The public key in jwk format

          • keyId string

            The id of the decrypting key

          • keySize integer
            Required

            The algorithm size of the decrypting key

          • keyType string
            Required

            The algorithm type of the decrypting key

          • createdAt string

            The timestamp for when the decrypting key was created.

            format = "date-time"

          • createdBy string

            The user id of the user who created the decrypting key

          • publicKey string

            The public key in pem format

          • certificate string

            The key's certificate in pem format
        • idTokenSignatureAlg string

          The algorithm used to sign the ID token. The default algorithm is RS256.

          Can be one of: "RS256""RS512"

          default = "RS256"

        • openid_configuration object

          OpenID configuration

          Show openid_configuration properties
          • issuer string
            Required

            OpenID Provider issuer

          • jwks_uri string
            Required

            URL of the OP's JSON Web Key Set [JWK] document

          • token_endpoint string
            Required

            OAuth 2.0 Token Endpoint

          • userinfo_endpoint string

            URL of the OP's UserInfo Endpoint

          • end_session_endpoint string

            URL at the OP to which an RP can perform a redirect to request that the End-User be logged out at the OP.

          • authorization_endpoint string
            Required

            OAuth 2.0 Authorization Endpoint

          • introspection_endpoint string

            The introspection endpoint is an OAuth 2.0 endpoint that takes a parameter representing an OAuth 2.0 token and returns a JSON [RFC7159] document representing the meta information.
        • useClaimsFromIdToken boolean

          If true, will use the claims from the ID token. By default it is set to true for ADFS and AzureAD.

        • blockOfflineAccessScope boolean

          When true, the offline_access scope will not be requested from the IdP where applicable.

        • emailVerifiedAlwaysTrue boolean

          Only ADFS and AzureAD IdPs can set this property. For ADFS and AzureAD, it defaults to false. For other IdPs, it defaults to undefined.
      • clockToleranceSec integer

        There can be clock skew between the IdP and Qlik's login server. In these cases, a tolerance can be set.

        minimum = 0, maximum = 7200, default = 5, default = 5

      • createNewUsersOnLogin boolean

        Tells the consumer of the IdP that new users should be created on login if they don't exist.

        default = true

      • postLogoutRedirectUri string

        Direct the user on logout to a specific URI.

        maxLength = 2083

    • CreateJWTAuthPayload object

      Payload for creating an identity provider using JWT authentication.

      Show CreateJWTAuthPayload properties
      • options object
        Required

        Required IdP configurations.

        Show options properties
        • issuer string
          Required

          The JWT issuer.

        • staticKeys array of objects
          Required

          Keys for verifying JWTs. Limited to 1 key per identity provider.

          Show staticKeys properties
          • kid string
            Required

            Key ID used to sign the JWTs.

          • pem string
            Required

            Pem-encoded public key for verifying the JWTs.
      • protocol string
        Required

        The protocol to be used for communicating with the identity provider.

        Can be one of: "jwtAuth"

      • provider string
        Required

        The identity provider to be used.

        Can be one of: "external"

      • tenantIds array of strings

        The tenant identifiers that map to the given IdP.

      • description string

        maxLength = 128

      • clockToleranceSec integer

        There can be clock skew between the IdP and Qlik's login server. In these cases, a tolerance can be set.

        minimum = 0, maximum = 7200, default = 5, default = 5

    • CreateSAMLPayload object

      Payload for creating a SAML compatible identity provider.

      Show CreateSAMLPayload properties
      • options object

        Required SAML configurations for IdPs with skipVerify flag enabled.

        Show options properties
        • entityId string

          The entity ID for the SAML IdP. Required if metadata is not provided.

        • metadata object

          Metadata for the SAML IdP. Required if individual SAML parameters are not provided.

          Show metadata properties
          • raw string
            Required

            The IDP metadata XML in base64-encoded format.

            format = "byte"

        • signOnUrl string

          The sign on URL for the SAML IdP. Required if metadata is not provided.

        • certificates array of objects

          The certificates used for validating signed responses. Required if metadata is not provided.

          minItems = 1, maxItems = 5

          Show certificates properties
          • name string

            Given name for this certificate.

          • signature boolean

            Indicates whether the certificate is used for the signature.

            default = true

          • encryption boolean

            Indicates whether the certificate is used for encryption.

            default = false

          • certificate string
            Required

            The X.509 certificate for validating signed SAML responses.
        • nameIdFormat string

          The name identifier format that will be requested from the identity provider.

          Can be one of: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress""urn:oasis:names:tc:SAML:2.0:nameid-format:persistent""urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

        • claimsMapping object
          Required

          Mappings from claim name to an array of SAML attribute names that point to locations in the claims from the IdP to retrieve the value from.

          Show claimsMapping properties
          • sub array of strings
            Required

            A list of SAML attributes used to map the user's subject.

          • name array of strings
            Required

            A list of SAML attributes used to map the user's name.

          • email array of strings
            Required

            A list of SAML attributes used to map the user's email.

          • groups array of strings
            Required

            A list of SAML attributes used to map the user's groups.

          • picture array of strings
            Required

            A list of SAML attributes used to map the user's picture.
        • allowIdpInitiatedLogin boolean

          Toggle to allow IdP initated login by the SAML IdP.

          default = false

      • protocol string
        Required

        The protocol to be used for communicating with the identity provider.

        Can be one of: "SAML"

      • provider string
        Required

        The identity provider to be used.

        Can be one of: "okta""generic""adfs""azureAD"

      • tenantIds array of strings

        The tenant identifiers that map to the given IdP.

      • skipVerify boolean

        If set to true, skips IdP verification process and assumes the IdP is verified.

        default = false

      • description string

        maxLength = 128

      • interactive boolean
        Required

        Indicates whether the IdP is meant for interactive login. Must be true for SAML IdPs.

      • pendingOptions object

        Required configurations for SAML IdPs that require verification.

        Show pendingOptions properties
        • entityId string

          The entity ID for the SAML IdP. Required if metadata is not provided.

        • metadata object

          Metadata for the SAML IdP. Required if individual SAML parameters are not provided.

          Show metadata properties
          • raw string
            Required

            The IDP metadata XML in base64-encoded format.

            format = "byte"

        • signOnUrl string

          The sign on URL for the SAML IdP. Required if metadata is not provided.

        • certificates array of objects

          The certificates used for validating signed responses. Required if metadata is not provided.

          Show certificates properties
          • name string

            Given name for this certificate.

          • signature boolean

            Indicates whether the certificate is used for the signature.

            default = true

          • encryption boolean

            Indicates whether the certificate is used for encryption.

            default = false

          • certificate string
            Required

            The X.509 certificate for validating signed SAML responses.
        • nameIdFormat string

          The name identifier format that will be requested from the identity provider.

          Can be one of: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress""urn:oasis:names:tc:SAML:2.0:nameid-format:persistent""urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

        • claimsMapping object
          Required

          Mappings from claim name to an array of SAML attribute names that point to locations in the claims from the IdP to retrieve the value from.

          Show claimsMapping properties
          • sub array of strings
            Required

            A list of SAML attributes used to map the user's subject.

          • name array of strings
            Required

            A list of SAML attributes used to map the user's name.

          • email array of strings
            Required

            A list of SAML attributes used to map the user's email.

          • groups array of strings
            Required

            A list of SAML attributes used to map the user's groups.

          • picture array of strings
            Required

            A list of SAML attributes used to map the user's picture.
        • allowIdpInitiatedLogin boolean

          Toggle to allow IdP initated login by the SAML IdP.

          default = false

      • clockToleranceSec integer

        There can be clock skew between the IdP and Qlik's login server. In these cases, a tolerance can be set.

        minimum = 0, maximum = 7200, default = 5, default = 5

      • createNewUsersOnLogin boolean

        Tells the consumer of the IdP that new users should be created on login if they don't exist.

        default = true

      • postLogoutRedirectUri string

        Direct the user on logout to a specific URI.

        maxLength = 2083

Responses

201

Created

  • application/json any
    One of:
    • IDPOIDC object

      An OIDC-compliant identity provider.

      Show IDPOIDC properties
      • id string

        The unique identifier for the IdP.

      • meta object
      • active boolean

        Indicates whether the IdP is available for use.

      • created string

        The timestamp for when the IdP was created.

        format = "date-time"

      • protocol string

        The protocol to be used for communicating with the identity provider. Valid values are OIDC, SAML, jwtAuth, and qsefw-local-bearer-token.

        Can be one of: "OIDC""SAML""jwtAuth""qsefw-local-bearer-token"

      • provider string

        The identity provider to be used. If protocol is OIDC, the valid values are auth0, okta, generic, salesforce, keycloak, adfs, and azureAD. If protocol is jwtAuth, the valid value is external.

        Can be one of: "auth0""okta""qlik""generic""salesforce""keycloak""adfs""external""azureAD"

      • tenantIds array of strings

        The tenant identifiers associated with the given IdP.

      • description string
      • interactive boolean

        Indicates the type of connection with the IdP, either interactive login or a machine to machine connection.

      • lastUpdated string

        The timestamp for when the IdP was last updated.

        format = "date-time"

      • clockToleranceSec integer
      • createNewUsersOnLogin boolean

        When the flag is true, new users should be created when logging in for the first time.

      • postLogoutRedirectUri string

        Direct the user on logout to a specific URI.

      • options object
        Show options properties
        • realm string

          The realm identifier for the IdP.

        • scope string

          Scope that will be sent along with token requests to the IdP.

        • issuer string

          This field is only used in Qlik Sense Enterprise Client-Managed IdPs.

        • clientId string

          The client identifier used as part of authenticating an interactive identity provider.

        • clientSecret string

          The client secret used as part of authenticating an interactive identity provider.

        • discoveryUrl string

          The OpenID configuration endpoint. (Ex: https:///.well-known/openid-configuration).

        • claimsMapping object

          Mappings from claim name to an array of JSON pointers that point to locations in the claims from the IdP to retrieve the value from.

          Show claimsMapping properties
          • sub array of strings

            A list of JSON pointers used to map the user's subject.

          • name array of strings

            A list of JSON pointers used to map the user's name.

          • email array of strings

            A list of JSON pointers used to map the user's email.

          • groups array of strings

            A list of JSON pointers used to map the user's groups.

          • locale array of strings

            A list of JSON pointers used to map the user's locale.

          • picture array of strings

            A list of JSON pointers used to map the user's picture.

          • zoneinfo array of strings

            A list of JSON pointers used to map the user's zoneinfo.

          • client_id array of strings

            A list of JSON pointers used to map the user's client ID.

          • email_verified array of strings

            A list of JSON pointers used to map the user's email_verified claim.
        • decryptingKey object

          A decrypting key used to decrypt OIDC encrypted assertions

          Show decryptingKey properties
          • jwks string

            The public key in jwk format

          • keyId string

            The id of the decrypting key

          • keySize integer
            Required

            The algorithm size of the decrypting key

          • keyType string
            Required

            The algorithm type of the decrypting key

          • createdAt string

            The timestamp for when the decrypting key was created.

            format = "date-time"

          • createdBy string

            The user id of the user who created the decrypting key

          • publicKey string

            The public key in pem format

          • certificate string

            The key's certificate in pem format
        • openid_configuration object

          OpenID configuration

          Show openid_configuration properties
          • issuer string
            Required

            OpenID Provider issuer

          • jwks_uri string
            Required

            URL of the OP's JSON Web Key Set [JWK] document

          • token_endpoint string
            Required

            OAuth 2.0 Token Endpoint

          • userinfo_endpoint string

            URL of the OP's UserInfo Endpoint

          • end_session_endpoint string

            URL at the OP to which an RP can perform a redirect to request that the End-User be logged out at the OP.

          • authorization_endpoint string
            Required

            OAuth 2.0 Authorization Endpoint

          • introspection_endpoint string

            The introspection endpoint is an OAuth 2.0 endpoint that takes a parameter representing an OAuth 2.0 token and returns a JSON [RFC7159] document representing the meta information.
        • blockOfflineAccessScope boolean

          If true, the offline_access scope will not be requested from the IdP, where applicable.

        • emailVerifiedAlwaysTrue boolean

          Determines if email_verified should be always true. This field is only used in ADFS and AzureAD IdPs.
      • pendingState string

        The state of pendingOptions. This represents the latest IdP test result.

        Can be one of: "verified""pending""error"

      • pendingResult object
        Show pendingResult properties
        • error string

          A unique readable error message based on the error that has occurred.

        • status string
          Required

          The status of the IdP configuration being tested.

          Can be one of: "success""pending""error""claimsError""callbackError""tokenError""protocolError""networkError""configChangedDuringTestError"

        • started string

          The timestamp for when the test was started for an IdP configuration. This field is only available during lifespan of the test.

          format = "date-time"

        • protocol string

          The protocol used to communicate with the IdP during the test flow.

          Can be one of: "OIDC""SAML"

        • idpClaims object

          The claims retrieved from the external IdP.

        • oauth2Error object
          Show oauth2Error properties
          • error string
            Required

            An error code to identity the authentication error.

          • errorURI string

            An optional URI that includes additional information about the given error.

          • errorDescription string

            An optional human-readable description for the given error code.
        • resultantClaims object

          The resultant claims based on the claims received from the external IdP.
      • pendingOptions object
        Show pendingOptions properties
        • realm string

          The realm identifier for the IdP.

        • scope string

          Scope that will be sent along with token requests to the IdP.

        • issuer string

          This field is only used in Qlik Sense Enterprise Client-Managed IdPs.

        • clientId string

          The client identifier used as part of authenticating an interactive identity provider.

        • clientSecret string

          The client secret used as part of authenticating an interactive identity provider.

        • discoveryUrl string

          The OpenID configuration endpoint. (Ex: https:///.well-known/openid-configuration).

        • claimsMapping object

          Mappings from claim name to an array of JSON pointers that point to locations in the claims from the IdP to retrieve the value from.

          Show claimsMapping properties
          • sub array of strings

            A list of JSON pointers used to map the user's subject.

          • name array of strings

            A list of JSON pointers used to map the user's name.

          • email array of strings

            A list of JSON pointers used to map the user's email.

          • groups array of strings

            A list of JSON pointers used to map the user's groups.

          • locale array of strings

            A list of JSON pointers used to map the user's locale.

          • picture array of strings

            A list of JSON pointers used to map the user's picture.

          • zoneinfo array of strings

            A list of JSON pointers used to map the user's zoneinfo.

          • client_id array of strings

            A list of JSON pointers used to map the user's client ID.

          • email_verified array of strings

            A list of JSON pointers used to map the user's email_verified claim.
        • decryptingKey object

          A decrypting key used to decrypt OIDC encrypted assertions

          Show decryptingKey properties
          • jwks string

            The public key in jwk format

          • keyId string

            The id of the decrypting key

          • keySize integer
            Required

            The algorithm size of the decrypting key

          • keyType string
            Required

            The algorithm type of the decrypting key

          • createdAt string

            The timestamp for when the decrypting key was created.

            format = "date-time"

          • createdBy string

            The user id of the user who created the decrypting key

          • publicKey string

            The public key in pem format

          • certificate string

            The key's certificate in pem format
        • openid_configuration object

          OpenID configuration

          Show openid_configuration properties
          • issuer string
            Required

            OpenID Provider issuer

          • jwks_uri string
            Required

            URL of the OP's JSON Web Key Set [JWK] document

          • token_endpoint string
            Required

            OAuth 2.0 Token Endpoint

          • userinfo_endpoint string

            URL of the OP's UserInfo Endpoint

          • end_session_endpoint string

            URL at the OP to which an RP can perform a redirect to request that the End-User be logged out at the OP.

          • authorization_endpoint string
            Required

            OAuth 2.0 Authorization Endpoint

          • introspection_endpoint string

            The introspection endpoint is an OAuth 2.0 endpoint that takes a parameter representing an OAuth 2.0 token and returns a JSON [RFC7159] document representing the meta information.
        • blockOfflineAccessScope boolean

          If true, the offline_access scope will not be requested from the IdP, where applicable.

        • emailVerifiedAlwaysTrue boolean

          Determines if email_verified should be always true. This field is only used in ADFS and AzureAD IdPs.
    • IDPSAML object

      A SAML-compliant identity provider.

      Show IDPSAML properties
      • id string

        The unique identifier for the IdP.

      • meta object
      • active boolean

        Indicates whether the IdP is available for use.

      • created string

        The timestamp for when the IdP was created.

        format = "date-time"

      • protocol string

        The protocol to be used for communicating with the identity provider. Valid values are OIDC, SAML, jwtAuth, and qsefw-local-bearer-token.

        Can be one of: "OIDC""SAML""jwtAuth""qsefw-local-bearer-token"

      • provider string

        The identity provider to be used. If protocol is OIDC, the valid values are auth0, okta, generic, salesforce, keycloak, adfs, and azureAD. If protocol is jwtAuth, the valid value is external.

        Can be one of: "auth0""okta""qlik""generic""salesforce""keycloak""adfs""external""azureAD"

      • tenantIds array of strings

        The tenant identifiers associated with the given IdP.

      • description string
      • interactive boolean

        Indicates the type of connection with the IdP, either interactive login or a machine to machine connection.

      • lastUpdated string

        The timestamp for when the IdP was last updated.

        format = "date-time"

      • clockToleranceSec integer
      • createNewUsersOnLogin boolean

        When the flag is true, new users should be created when logging in for the first time.

      • postLogoutRedirectUri string

        Direct the user on logout to a specific URI.

      • options object
        Show options properties
        • entityId string

          The entity URL for the SAML IdP.

        • signOnUrl string

          The sign on URL for the SAML IdP.

        • signingKeys array of objects

          Set of certificates used to sign SAMLRequest payloads. Not present in pendingOptions.

          Show signingKeys properties
          • refId string

            The reference ID for choosing this key pair.

          • certificate string

            The certificate to be uploaded to the identity provider for verifying SAML requests.
        • certificates array of objects

          The certificates used for validating signed responses.

          Show certificates properties
          • name string

            Given name for this certificate.

          • signature boolean

            Indicates whether the certificate is used for the signature.

            default = true

          • encryption boolean

            Indicates whether the certificate is used for encryption.

            default = false

          • certificate string
            Required

            The X.509 certificate for validating signed SAML responses.
        • nameIdFormat string

          The name identifier format that will be requested from the identity provider.

          Can be one of: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress""urn:oasis:names:tc:SAML:2.0:nameid-format:persistent""urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

        • claimsMapping object

          Mappings from claim name to an array of SAML attribute names that point to locations in the claims from the IdP to retrieve the value from.

          Show claimsMapping properties
          • sub array of strings
            Required

            A list of SAML attributes used to map the user's subject.

          • name array of strings
            Required

            A list of SAML attributes used to map the user's name.

          • email array of strings
            Required

            A list of SAML attributes used to map the user's email.

          • groups array of strings
            Required

            A list of SAML attributes used to map the user's groups.

          • picture array of strings
            Required

            A list of SAML attributes used to map the user's picture.
        • allowIdpInitiatedLogin boolean

          Toggle to allow IdP initated login by the SAML IdP.

        • signingKeySelectedRefId string

          The reference ID of the chosen signing key pair.
      • pendingState string

        The state of pendingOptions. This represents the latest IdP test result.

        Can be one of: "verified""pending""error"

      • pendingResult object
        Show pendingResult properties
        • error string

          A unique readable error message based on the error that has occurred.

        • status string
          Required

          The status of the IdP configuration being tested.

          Can be one of: "success""pending""error""claimsError""callbackError""tokenError""protocolError""networkError""configChangedDuringTestError"

        • started string

          The timestamp for when the test was started for an IdP configuration. This field is only available during lifespan of the test.

          format = "date-time"

        • protocol string

          The protocol used to communicate with the IdP during the test flow.

          Can be one of: "OIDC""SAML"

        • idpClaims object

          The claims retrieved from the external IdP.

        • oauth2Error object
          Show oauth2Error properties
          • error string
            Required

            An error code to identity the authentication error.

          • errorURI string

            An optional URI that includes additional information about the given error.

          • errorDescription string

            An optional human-readable description for the given error code.
        • resultantClaims object

          The resultant claims based on the claims received from the external IdP.
      • pendingOptions object
        Show pendingOptions properties
        • entityId string

          The entity URL for the SAML IdP.

        • signOnUrl string

          The sign on URL for the SAML IdP.

        • signingKeys array of objects

          Set of certificates used to sign SAMLRequest payloads. Not present in pendingOptions.

          Show signingKeys properties
          • refId string

            The reference ID for choosing this key pair.

          • certificate string

            The certificate to be uploaded to the identity provider for verifying SAML requests.
        • certificates array of objects

          The certificates used for validating signed responses.

          Show certificates properties
          • name string

            Given name for this certificate.

          • signature boolean

            Indicates whether the certificate is used for the signature.

            default = true

          • encryption boolean

            Indicates whether the certificate is used for encryption.

            default = false

          • certificate string
            Required

            The X.509 certificate for validating signed SAML responses.
        • nameIdFormat string

          The name identifier format that will be requested from the identity provider.

          Can be one of: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress""urn:oasis:names:tc:SAML:2.0:nameid-format:persistent""urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

        • claimsMapping object

          Mappings from claim name to an array of SAML attribute names that point to locations in the claims from the IdP to retrieve the value from.

          Show claimsMapping properties
          • sub array of strings
            Required

            A list of SAML attributes used to map the user's subject.

          • name array of strings
            Required

            A list of SAML attributes used to map the user's name.

          • email array of strings
            Required

            A list of SAML attributes used to map the user's email.

          • groups array of strings
            Required

            A list of SAML attributes used to map the user's groups.

          • picture array of strings
            Required

            A list of SAML attributes used to map the user's picture.
        • allowIdpInitiatedLogin boolean

          Toggle to allow IdP initated login by the SAML IdP.

        • signingKeySelectedRefId string

          The reference ID of the chosen signing key pair.
    • IDPJWTAuth object

      An identity provider for JWT authentication.

      Show IDPJWTAuth properties
      • id string

        The unique identifier for the IdP.

      • meta object
      • active boolean

        Indicates whether the IdP is available for use.

      • created string

        The timestamp for when the IdP was created.

        format = "date-time"

      • protocol string

        The protocol to be used for communicating with the identity provider. Valid values are OIDC, SAML, jwtAuth, and qsefw-local-bearer-token.

        Can be one of: "OIDC""SAML""jwtAuth""qsefw-local-bearer-token"

      • provider string

        The identity provider to be used. If protocol is OIDC, the valid values are auth0, okta, generic, salesforce, keycloak, adfs, and azureAD. If protocol is jwtAuth, the valid value is external.

        Can be one of: "auth0""okta""qlik""generic""salesforce""keycloak""adfs""external""azureAD"

      • tenantIds array of strings

        The tenant identifiers associated with the given IdP.

      • description string
      • interactive boolean

        Indicates the type of connection with the IdP, either interactive login or a machine to machine connection.

      • lastUpdated string

        The timestamp for when the IdP was last updated.

        format = "date-time"

      • clockToleranceSec integer
      • createNewUsersOnLogin boolean

        When the flag is true, new users should be created when logging in for the first time.

      • postLogoutRedirectUri string

        Direct the user on logout to a specific URI.

      • options object
        Show options properties
        • issuer string

          The expected JWT issuer

        • staticKeys array of objects
          Show staticKeys properties
          • kid string

            Key ID used to sign the JWTs.

          • pem string

            Pem-encoded public key for verifying the JWTs.

400

Bad Request

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.

403

Forbidden. User missing TenantAdmin role, or the tenantID in the JWT does not match any of the tenantIDs in the payload.

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.
POST /api/v1/identity-providers 
import { createQlikApi } from '@qlik/api'


const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})


await qlik.identityProviders.createIdp({
  options: {
    realm: 'string',
    audience: 'string',
    discoveryUrl: 'string',
    claimsMapping: {
      sub: ['string'],
      client_id: ['string'],
    },
    allowedClientIds: ['string'],
    openid_configuration: {
      issuer: 'string',
      jwks_uri: 'string',
      token_endpoint: 'string',
      userinfo_endpoint: 'string',
      end_session_endpoint: 'string',
      authorization_endpoint: 'string',
      introspection_endpoint: 'string',
    },
  },
  protocol: 'OIDC',
  provider: 'auth0',
  tenantIds: ['string'],
  skipVerify: false,
  description: 'string',
  interactive: false,
  pendingOptions: {
    realm: 'string',
    scope: 'string',
    clientId: 'string',
    clientSecret: 'string',
    discoveryUrl: 'string',
    claimsMapping: {
      sub: ['string'],
      name: ['string'],
      email: ['string'],
      groups: ['string'],
      locale: ['string'],
      picture: ['string'],
      zoneinfo: ['string'],
      client_id: ['string'],
      email_verified: ['string'],
    },
    decryptingKey: {
      jwks: 'string',
      keyId: 'string',
      keySize: 42,
      keyType: 'string',
      createdAt: '2018-10-30T07:06:22Z',
      createdBy: 'string',
      publicKey: 'string',
      certificate: 'string',
    },
    idTokenSignatureAlg: 'RS256',
    openid_configuration: {
      issuer: 'string',
      jwks_uri: 'string',
      token_endpoint: 'string',
      userinfo_endpoint: 'string',
      end_session_endpoint: 'string',
      authorization_endpoint: 'string',
      introspection_endpoint: 'string',
    },
    useClaimsFromIdToken: true,
    blockOfflineAccessScope: true,
    emailVerifiedAlwaysTrue: true,
  },
  clockToleranceSec: 5,
  createNewUsersOnLogin: true,
  postLogoutRedirectUri: 'string',
})
qlik identity-provider create \
  --options-claimsMapping-client_id 'string' \
  --options-openid_configuration-authorization_endpoint 'string' \
  --options-openid_configuration-issuer 'string' \
  --options-openid_configuration-jwks_uri 'string' \
  --options-openid_configuration-token_endpoint 'string' \
  --pendingOptions-claimsMapping-client_id 'string' \
  --pendingOptions-claimsMapping-email_verified 'string' \
  --pendingOptions-claimsMapping-locale 'string' \
  --pendingOptions-claimsMapping-zoneinfo 'string' \
  --pendingOptions-clientId 'string' \
  --pendingOptions-clientSecret 'string' \
  --pendingOptions-decryptingKey-keySize 42 \
  --pendingOptions-decryptingKey-keyType 'string' \
  --pendingOptions-openid_configuration-authorization_endpoint 'string' \
  --pendingOptions-openid_configuration-issuer 'string' \
  --pendingOptions-openid_configuration-jwks_uri 'string' \
  --pendingOptions-openid_configuration-token_endpoint 'string' \
  --options-issuer '' \
  --options-staticKeys-kid '' \
  --options-staticKeys-pem '' \
  --options-certificates-certificate '' \
  --options-claimsMapping-email '' \
  --options-claimsMapping-groups '' \
  --options-claimsMapping-name '' \
  --options-claimsMapping-picture '' \
  --options-metadata-raw '' \
  --pendingOptions-certificates-certificate '' \
  --pendingOptions-metadata-raw ''
curl "https://{tenant}.{region}.qlikcloud.com/api/v1/identity-providers" \
-X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer <access_token>" \
-d '{"options":{"realm":"string","audience":"string","discoveryUrl":"string","claimsMapping":{"sub":["string"],"client_id":["string"]},"allowedClientIds":["string"],"openid_configuration":{"issuer":"string","jwks_uri":"string","token_endpoint":"string","userinfo_endpoint":"string","end_session_endpoint":"string","authorization_endpoint":"string","introspection_endpoint":"string"}},"protocol":"OIDC","provider":"auth0","tenantIds":["string"],"skipVerify":false,"description":"string","interactive":false,"pendingOptions":{"realm":"string","scope":"string","clientId":"string","clientSecret":"string","discoveryUrl":"string","claimsMapping":{"sub":["string"],"name":["string"],"email":["string"],"groups":["string"],"locale":["string"],"picture":["string"],"zoneinfo":["string"],"client_id":["string"],"email_verified":["string"]},"decryptingKey":{"jwks":"string","keyId":"string","keySize":42,"keyType":"string","createdAt":"2018-10-30T07:06:22Z","createdBy":"string","publicKey":"string","certificate":"string"},"idTokenSignatureAlg":"RS256","openid_configuration":{"issuer":"string","jwks_uri":"string","token_endpoint":"string","userinfo_endpoint":"string","end_session_endpoint":"string","authorization_endpoint":"string","introspection_endpoint":"string"},"useClaimsFromIdToken":true,"blockOfflineAccessScope":true,"emailVerifiedAlwaysTrue":true},"clockToleranceSec":5,"createNewUsersOnLogin":true,"postLogoutRedirectUri":"string"}'

Example Response

{
  "id": "string",
  "meta": {},
  "active": true,
  "created": "2018-10-30T07:06:22Z",
  "protocol": "OIDC",
  "provider": "auth0",
  "tenantIds": [
    "string"
  ],
  "description": "string",
  "interactive": true,
  "lastUpdated": "2018-10-30T07:06:22Z",
  "clockToleranceSec": 42,
  "createNewUsersOnLogin": true,
  "postLogoutRedirectUri": "string",
  "options": {
    "realm": "string",
    "scope": "string",
    "issuer": "string",
    "clientId": "string",
    "clientSecret": "string",
    "discoveryUrl": "string",
    "claimsMapping": {
      "sub": [
        "string"
      ],
      "name": [
        "string"
      ],
      "email": [
        "string"
      ],
      "groups": [
        "string"
      ],
      "locale": [
        "string"
      ],
      "picture": [
        "string"
      ],
      "zoneinfo": [
        "string"
      ],
      "client_id": [
        "string"
      ],
      "email_verified": [
        "string"
      ]
    },
    "decryptingKey": {
      "jwks": "string",
      "keyId": "string",
      "keySize": 42,
      "keyType": "string",
      "createdAt": "2018-10-30T07:06:22Z",
      "createdBy": "string",
      "publicKey": "string",
      "certificate": "string"
    },
    "openid_configuration": {
      "issuer": "string",
      "jwks_uri": "string",
      "token_endpoint": "string",
      "userinfo_endpoint": "string",
      "end_session_endpoint": "string",
      "authorization_endpoint": "string",
      "introspection_endpoint": "string"
    },
    "blockOfflineAccessScope": true,
    "emailVerifiedAlwaysTrue": true
  },
  "pendingState": "verified",
  "pendingResult": {
    "error": "string",
    "status": "success",
    "started": "2018-10-30T07:06:22Z",
    "protocol": "OIDC",
    "idpClaims": {},
    "oauth2Error": {
      "error": "string",
      "errorURI": "string",
      "errorDescription": "string"
    },
    "resultantClaims": {}
  },
  "pendingOptions": {
    "realm": "string",
    "scope": "string",
    "issuer": "string",
    "clientId": "string",
    "clientSecret": "string",
    "discoveryUrl": "string",
    "claimsMapping": {
      "sub": [
        "string"
      ],
      "name": [
        "string"
      ],
      "email": [
        "string"
      ],
      "groups": [
        "string"
      ],
      "locale": [
        "string"
      ],
      "picture": [
        "string"
      ],
      "zoneinfo": [
        "string"
      ],
      "client_id": [
        "string"
      ],
      "email_verified": [
        "string"
      ]
    },
    "decryptingKey": {
      "jwks": "string",
      "keyId": "string",
      "keySize": 42,
      "keyType": "string",
      "createdAt": "2018-10-30T07:06:22Z",
      "createdBy": "string",
      "publicKey": "string",
      "certificate": "string"
    },
    "openid_configuration": {
      "issuer": "string",
      "jwks_uri": "string",
      "token_endpoint": "string",
      "userinfo_endpoint": "string",
      "end_session_endpoint": "string",
      "authorization_endpoint": "string",
      "introspection_endpoint": "string"
    },
    "blockOfflineAccessScope": true,
    "emailVerifiedAlwaysTrue": true
  }
}

Return IdP configuration metadata

Returns IdP configuration metadata supported on the tenant. Clients can use this information to programmatically configure their interactions with Qlik Cloud.

Facts

Rate limit Tier 1 (1000 requests per minute)

Responses

200

Success

  • application/json object
GET /api/v1/identity-providers/.well-known/metadata.json 
import { createQlikApi } from '@qlik/api'


const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})


await qlik.identityProviders.getIdpWellKnownMetaData()
qlik identity-provider .well-known metadata.json
curl "https://{tenant}.{region}.qlikcloud.com/api/v1/identity-providers/.well-known/metadata.json" \
-H "Authorization: Bearer <access_token>"

Example Response

{}

Get an IdP

Retrieves a specific IdP. Requesting user must be assigned the TenantAdmin role.

Facts

Rate limit Tier 1 (1000 requests per minute)

Path Parameters

  • id string
    Required

    The identity provider ID.

Responses

200

Success

  • application/json any
    One of:
    • IDPOIDC object

      An OIDC-compliant identity provider.

      Show IDPOIDC properties
      • id string

        The unique identifier for the IdP.

      • meta object
      • active boolean

        Indicates whether the IdP is available for use.

      • created string

        The timestamp for when the IdP was created.

        format = "date-time"

      • protocol string

        The protocol to be used for communicating with the identity provider. Valid values are OIDC, SAML, jwtAuth, and qsefw-local-bearer-token.

        Can be one of: "OIDC""SAML""jwtAuth""qsefw-local-bearer-token"

      • provider string

        The identity provider to be used. If protocol is OIDC, the valid values are auth0, okta, generic, salesforce, keycloak, adfs, and azureAD. If protocol is jwtAuth, the valid value is external.

        Can be one of: "auth0""okta""qlik""generic""salesforce""keycloak""adfs""external""azureAD"

      • tenantIds array of strings

        The tenant identifiers associated with the given IdP.

      • description string
      • interactive boolean

        Indicates the type of connection with the IdP, either interactive login or a machine to machine connection.

      • lastUpdated string

        The timestamp for when the IdP was last updated.

        format = "date-time"

      • clockToleranceSec integer
      • createNewUsersOnLogin boolean

        When the flag is true, new users should be created when logging in for the first time.

      • postLogoutRedirectUri string

        Direct the user on logout to a specific URI.

      • options object
        Show options properties
        • realm string

          The realm identifier for the IdP.

        • scope string

          Scope that will be sent along with token requests to the IdP.

        • issuer string

          This field is only used in Qlik Sense Enterprise Client-Managed IdPs.

        • clientId string

          The client identifier used as part of authenticating an interactive identity provider.

        • clientSecret string

          The client secret used as part of authenticating an interactive identity provider.

        • discoveryUrl string

          The OpenID configuration endpoint. (Ex: https:///.well-known/openid-configuration).

        • claimsMapping object

          Mappings from claim name to an array of JSON pointers that point to locations in the claims from the IdP to retrieve the value from.

          Show claimsMapping properties
          • sub array of strings

            A list of JSON pointers used to map the user's subject.

          • name array of strings

            A list of JSON pointers used to map the user's name.

          • email array of strings

            A list of JSON pointers used to map the user's email.

          • groups array of strings

            A list of JSON pointers used to map the user's groups.

          • locale array of strings

            A list of JSON pointers used to map the user's locale.

          • picture array of strings

            A list of JSON pointers used to map the user's picture.

          • zoneinfo array of strings

            A list of JSON pointers used to map the user's zoneinfo.

          • client_id array of strings

            A list of JSON pointers used to map the user's client ID.

          • email_verified array of strings

            A list of JSON pointers used to map the user's email_verified claim.
        • decryptingKey object

          A decrypting key used to decrypt OIDC encrypted assertions

          Show decryptingKey properties
          • jwks string

            The public key in jwk format

          • keyId string

            The id of the decrypting key

          • keySize integer
            Required

            The algorithm size of the decrypting key

          • keyType string
            Required

            The algorithm type of the decrypting key

          • createdAt string

            The timestamp for when the decrypting key was created.

            format = "date-time"

          • createdBy string

            The user id of the user who created the decrypting key

          • publicKey string

            The public key in pem format

          • certificate string

            The key's certificate in pem format
        • openid_configuration object

          OpenID configuration

          Show openid_configuration properties
          • issuer string
            Required

            OpenID Provider issuer

          • jwks_uri string
            Required

            URL of the OP's JSON Web Key Set [JWK] document

          • token_endpoint string
            Required

            OAuth 2.0 Token Endpoint

          • userinfo_endpoint string

            URL of the OP's UserInfo Endpoint

          • end_session_endpoint string

            URL at the OP to which an RP can perform a redirect to request that the End-User be logged out at the OP.

          • authorization_endpoint string
            Required

            OAuth 2.0 Authorization Endpoint

          • introspection_endpoint string

            The introspection endpoint is an OAuth 2.0 endpoint that takes a parameter representing an OAuth 2.0 token and returns a JSON [RFC7159] document representing the meta information.
        • blockOfflineAccessScope boolean

          If true, the offline_access scope will not be requested from the IdP, where applicable.

        • emailVerifiedAlwaysTrue boolean

          Determines if email_verified should be always true. This field is only used in ADFS and AzureAD IdPs.
      • pendingState string

        The state of pendingOptions. This represents the latest IdP test result.

        Can be one of: "verified""pending""error"

      • pendingResult object
        Show pendingResult properties
        • error string

          A unique readable error message based on the error that has occurred.

        • status string
          Required

          The status of the IdP configuration being tested.

          Can be one of: "success""pending""error""claimsError""callbackError""tokenError""protocolError""networkError""configChangedDuringTestError"

        • started string

          The timestamp for when the test was started for an IdP configuration. This field is only available during lifespan of the test.

          format = "date-time"

        • protocol string

          The protocol used to communicate with the IdP during the test flow.

          Can be one of: "OIDC""SAML"

        • idpClaims object

          The claims retrieved from the external IdP.

        • oauth2Error object
          Show oauth2Error properties
          • error string
            Required

            An error code to identity the authentication error.

          • errorURI string

            An optional URI that includes additional information about the given error.

          • errorDescription string

            An optional human-readable description for the given error code.
        • resultantClaims object

          The resultant claims based on the claims received from the external IdP.
      • pendingOptions object
        Show pendingOptions properties
        • realm string

          The realm identifier for the IdP.

        • scope string

          Scope that will be sent along with token requests to the IdP.

        • issuer string

          This field is only used in Qlik Sense Enterprise Client-Managed IdPs.

        • clientId string

          The client identifier used as part of authenticating an interactive identity provider.

        • clientSecret string

          The client secret used as part of authenticating an interactive identity provider.

        • discoveryUrl string

          The OpenID configuration endpoint. (Ex: https:///.well-known/openid-configuration).

        • claimsMapping object

          Mappings from claim name to an array of JSON pointers that point to locations in the claims from the IdP to retrieve the value from.

          Show claimsMapping properties
          • sub array of strings

            A list of JSON pointers used to map the user's subject.

          • name array of strings

            A list of JSON pointers used to map the user's name.

          • email array of strings

            A list of JSON pointers used to map the user's email.

          • groups array of strings

            A list of JSON pointers used to map the user's groups.

          • locale array of strings

            A list of JSON pointers used to map the user's locale.

          • picture array of strings

            A list of JSON pointers used to map the user's picture.

          • zoneinfo array of strings

            A list of JSON pointers used to map the user's zoneinfo.

          • client_id array of strings

            A list of JSON pointers used to map the user's client ID.

          • email_verified array of strings

            A list of JSON pointers used to map the user's email_verified claim.
        • decryptingKey object

          A decrypting key used to decrypt OIDC encrypted assertions

          Show decryptingKey properties
          • jwks string

            The public key in jwk format

          • keyId string

            The id of the decrypting key

          • keySize integer
            Required

            The algorithm size of the decrypting key

          • keyType string
            Required

            The algorithm type of the decrypting key

          • createdAt string

            The timestamp for when the decrypting key was created.

            format = "date-time"

          • createdBy string

            The user id of the user who created the decrypting key

          • publicKey string

            The public key in pem format

          • certificate string

            The key's certificate in pem format
        • openid_configuration object

          OpenID configuration

          Show openid_configuration properties
          • issuer string
            Required

            OpenID Provider issuer

          • jwks_uri string
            Required

            URL of the OP's JSON Web Key Set [JWK] document

          • token_endpoint string
            Required

            OAuth 2.0 Token Endpoint

          • userinfo_endpoint string

            URL of the OP's UserInfo Endpoint

          • end_session_endpoint string

            URL at the OP to which an RP can perform a redirect to request that the End-User be logged out at the OP.

          • authorization_endpoint string
            Required

            OAuth 2.0 Authorization Endpoint

          • introspection_endpoint string

            The introspection endpoint is an OAuth 2.0 endpoint that takes a parameter representing an OAuth 2.0 token and returns a JSON [RFC7159] document representing the meta information.
        • blockOfflineAccessScope boolean

          If true, the offline_access scope will not be requested from the IdP, where applicable.

        • emailVerifiedAlwaysTrue boolean

          Determines if email_verified should be always true. This field is only used in ADFS and AzureAD IdPs.
    • IDPSAML object

      A SAML-compliant identity provider.

      Show IDPSAML properties
      • id string

        The unique identifier for the IdP.

      • meta object
      • active boolean

        Indicates whether the IdP is available for use.

      • created string

        The timestamp for when the IdP was created.

        format = "date-time"

      • protocol string

        The protocol to be used for communicating with the identity provider. Valid values are OIDC, SAML, jwtAuth, and qsefw-local-bearer-token.

        Can be one of: "OIDC""SAML""jwtAuth""qsefw-local-bearer-token"

      • provider string

        The identity provider to be used. If protocol is OIDC, the valid values are auth0, okta, generic, salesforce, keycloak, adfs, and azureAD. If protocol is jwtAuth, the valid value is external.

        Can be one of: "auth0""okta""qlik""generic""salesforce""keycloak""adfs""external""azureAD"

      • tenantIds array of strings

        The tenant identifiers associated with the given IdP.

      • description string
      • interactive boolean

        Indicates the type of connection with the IdP, either interactive login or a machine to machine connection.

      • lastUpdated string

        The timestamp for when the IdP was last updated.

        format = "date-time"

      • clockToleranceSec integer
      • createNewUsersOnLogin boolean

        When the flag is true, new users should be created when logging in for the first time.

      • postLogoutRedirectUri string

        Direct the user on logout to a specific URI.

      • options object
        Show options properties
        • entityId string

          The entity URL for the SAML IdP.

        • signOnUrl string

          The sign on URL for the SAML IdP.

        • signingKeys array of objects

          Set of certificates used to sign SAMLRequest payloads. Not present in pendingOptions.

          Show signingKeys properties
          • refId string

            The reference ID for choosing this key pair.

          • certificate string

            The certificate to be uploaded to the identity provider for verifying SAML requests.
        • certificates array of objects

          The certificates used for validating signed responses.

          Show certificates properties
          • name string

            Given name for this certificate.

          • signature boolean

            Indicates whether the certificate is used for the signature.

            default = true

          • encryption boolean

            Indicates whether the certificate is used for encryption.

            default = false

          • certificate string
            Required

            The X.509 certificate for validating signed SAML responses.
        • nameIdFormat string

          The name identifier format that will be requested from the identity provider.

          Can be one of: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress""urn:oasis:names:tc:SAML:2.0:nameid-format:persistent""urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

        • claimsMapping object

          Mappings from claim name to an array of SAML attribute names that point to locations in the claims from the IdP to retrieve the value from.

          Show claimsMapping properties
          • sub array of strings
            Required

            A list of SAML attributes used to map the user's subject.

          • name array of strings
            Required

            A list of SAML attributes used to map the user's name.

          • email array of strings
            Required

            A list of SAML attributes used to map the user's email.

          • groups array of strings
            Required

            A list of SAML attributes used to map the user's groups.

          • picture array of strings
            Required

            A list of SAML attributes used to map the user's picture.
        • allowIdpInitiatedLogin boolean

          Toggle to allow IdP initated login by the SAML IdP.

        • signingKeySelectedRefId string

          The reference ID of the chosen signing key pair.
      • pendingState string

        The state of pendingOptions. This represents the latest IdP test result.

        Can be one of: "verified""pending""error"

      • pendingResult object
        Show pendingResult properties
        • error string

          A unique readable error message based on the error that has occurred.

        • status string
          Required

          The status of the IdP configuration being tested.

          Can be one of: "success""pending""error""claimsError""callbackError""tokenError""protocolError""networkError""configChangedDuringTestError"

        • started string

          The timestamp for when the test was started for an IdP configuration. This field is only available during lifespan of the test.

          format = "date-time"

        • protocol string

          The protocol used to communicate with the IdP during the test flow.

          Can be one of: "OIDC""SAML"

        • idpClaims object

          The claims retrieved from the external IdP.

        • oauth2Error object
          Show oauth2Error properties
          • error string
            Required

            An error code to identity the authentication error.

          • errorURI string

            An optional URI that includes additional information about the given error.

          • errorDescription string

            An optional human-readable description for the given error code.
        • resultantClaims object

          The resultant claims based on the claims received from the external IdP.
      • pendingOptions object
        Show pendingOptions properties
        • entityId string

          The entity URL for the SAML IdP.

        • signOnUrl string

          The sign on URL for the SAML IdP.

        • signingKeys array of objects

          Set of certificates used to sign SAMLRequest payloads. Not present in pendingOptions.

          Show signingKeys properties
          • refId string

            The reference ID for choosing this key pair.

          • certificate string

            The certificate to be uploaded to the identity provider for verifying SAML requests.
        • certificates array of objects

          The certificates used for validating signed responses.

          Show certificates properties
          • name string

            Given name for this certificate.

          • signature boolean

            Indicates whether the certificate is used for the signature.

            default = true

          • encryption boolean

            Indicates whether the certificate is used for encryption.

            default = false

          • certificate string
            Required

            The X.509 certificate for validating signed SAML responses.
        • nameIdFormat string

          The name identifier format that will be requested from the identity provider.

          Can be one of: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress""urn:oasis:names:tc:SAML:2.0:nameid-format:persistent""urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

        • claimsMapping object

          Mappings from claim name to an array of SAML attribute names that point to locations in the claims from the IdP to retrieve the value from.

          Show claimsMapping properties
          • sub array of strings
            Required

            A list of SAML attributes used to map the user's subject.

          • name array of strings
            Required

            A list of SAML attributes used to map the user's name.

          • email array of strings
            Required

            A list of SAML attributes used to map the user's email.

          • groups array of strings
            Required

            A list of SAML attributes used to map the user's groups.

          • picture array of strings
            Required

            A list of SAML attributes used to map the user's picture.
        • allowIdpInitiatedLogin boolean

          Toggle to allow IdP initated login by the SAML IdP.

        • signingKeySelectedRefId string

          The reference ID of the chosen signing key pair.
    • IDPJWTAuth object

      An identity provider for JWT authentication.

      Show IDPJWTAuth properties
      • id string

        The unique identifier for the IdP.

      • meta object
      • active boolean

        Indicates whether the IdP is available for use.

      • created string

        The timestamp for when the IdP was created.

        format = "date-time"

      • protocol string

        The protocol to be used for communicating with the identity provider. Valid values are OIDC, SAML, jwtAuth, and qsefw-local-bearer-token.

        Can be one of: "OIDC""SAML""jwtAuth""qsefw-local-bearer-token"

      • provider string

        The identity provider to be used. If protocol is OIDC, the valid values are auth0, okta, generic, salesforce, keycloak, adfs, and azureAD. If protocol is jwtAuth, the valid value is external.

        Can be one of: "auth0""okta""qlik""generic""salesforce""keycloak""adfs""external""azureAD"

      • tenantIds array of strings

        The tenant identifiers associated with the given IdP.

      • description string
      • interactive boolean

        Indicates the type of connection with the IdP, either interactive login or a machine to machine connection.

      • lastUpdated string

        The timestamp for when the IdP was last updated.

        format = "date-time"

      • clockToleranceSec integer
      • createNewUsersOnLogin boolean

        When the flag is true, new users should be created when logging in for the first time.

      • postLogoutRedirectUri string

        Direct the user on logout to a specific URI.

      • options object
        Show options properties
        • issuer string

          The expected JWT issuer

        • staticKeys array of objects
          Show staticKeys properties
          • kid string

            Key ID used to sign the JWTs.

          • pem string

            Pem-encoded public key for verifying the JWTs.

401

Unauthorized

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.

404

Not Found

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.
GET /api/v1/identity-providers/{id} 
import { createQlikApi } from '@qlik/api'


const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})


await qlik.identityProviders.getIdp('string')
qlik identity-provider get 'string'
curl "https://{tenant}.{region}.qlikcloud.com/api/v1/identity-providers/{id}" \
-H "Authorization: Bearer <access_token>"

Example Response

{
  "id": "string",
  "meta": {},
  "active": true,
  "created": "2018-10-30T07:06:22Z",
  "protocol": "OIDC",
  "provider": "auth0",
  "tenantIds": [
    "string"
  ],
  "description": "string",
  "interactive": true,
  "lastUpdated": "2018-10-30T07:06:22Z",
  "clockToleranceSec": 42,
  "createNewUsersOnLogin": true,
  "postLogoutRedirectUri": "string",
  "options": {
    "realm": "string",
    "scope": "string",
    "issuer": "string",
    "clientId": "string",
    "clientSecret": "string",
    "discoveryUrl": "string",
    "claimsMapping": {
      "sub": [
        "string"
      ],
      "name": [
        "string"
      ],
      "email": [
        "string"
      ],
      "groups": [
        "string"
      ],
      "locale": [
        "string"
      ],
      "picture": [
        "string"
      ],
      "zoneinfo": [
        "string"
      ],
      "client_id": [
        "string"
      ],
      "email_verified": [
        "string"
      ]
    },
    "decryptingKey": {
      "jwks": "string",
      "keyId": "string",
      "keySize": 42,
      "keyType": "string",
      "createdAt": "2018-10-30T07:06:22Z",
      "createdBy": "string",
      "publicKey": "string",
      "certificate": "string"
    },
    "openid_configuration": {
      "issuer": "string",
      "jwks_uri": "string",
      "token_endpoint": "string",
      "userinfo_endpoint": "string",
      "end_session_endpoint": "string",
      "authorization_endpoint": "string",
      "introspection_endpoint": "string"
    },
    "blockOfflineAccessScope": true,
    "emailVerifiedAlwaysTrue": true
  },
  "pendingState": "verified",
  "pendingResult": {
    "error": "string",
    "status": "success",
    "started": "2018-10-30T07:06:22Z",
    "protocol": "OIDC",
    "idpClaims": {},
    "oauth2Error": {
      "error": "string",
      "errorURI": "string",
      "errorDescription": "string"
    },
    "resultantClaims": {}
  },
  "pendingOptions": {
    "realm": "string",
    "scope": "string",
    "issuer": "string",
    "clientId": "string",
    "clientSecret": "string",
    "discoveryUrl": "string",
    "claimsMapping": {
      "sub": [
        "string"
      ],
      "name": [
        "string"
      ],
      "email": [
        "string"
      ],
      "groups": [
        "string"
      ],
      "locale": [
        "string"
      ],
      "picture": [
        "string"
      ],
      "zoneinfo": [
        "string"
      ],
      "client_id": [
        "string"
      ],
      "email_verified": [
        "string"
      ]
    },
    "decryptingKey": {
      "jwks": "string",
      "keyId": "string",
      "keySize": 42,
      "keyType": "string",
      "createdAt": "2018-10-30T07:06:22Z",
      "createdBy": "string",
      "publicKey": "string",
      "certificate": "string"
    },
    "openid_configuration": {
      "issuer": "string",
      "jwks_uri": "string",
      "token_endpoint": "string",
      "userinfo_endpoint": "string",
      "end_session_endpoint": "string",
      "authorization_endpoint": "string",
      "introspection_endpoint": "string"
    },
    "blockOfflineAccessScope": true,
    "emailVerifiedAlwaysTrue": true
  }
}

Update an IdP

Updates the configuration of an IdP. Requesting user must be assigned the TenantAdmin role. Partial failure is treated as complete failure and returns an error.

Facts

Rate limit Tier 2 (100 requests per minute)

Header Parameters

  • QLIK-IDP-POPTS-MATCH string

    A unique string representing a hash that should map to an IdP's hash representation of the current configuration being tested.

    format = "uuid"

Path Parameters

  • id string
    Required

    The identity provider ID.

Request Body

Attributes that the user wants to patially update for an identity provider resource.

  • application/json array
    One of:
    • array of objects

      A patch request for an identity provider using the OIDC protocol.

      Show properties
      • op string
        Required

        The "operation" to be performed on a given IdP. Currently supports a custom operation value called "promote-options" that allows the test configuration to be promoted to the current configuration used for login.

        Can be one of: "replace""promote-options"

      • path string

        The "path" to the part of the IdP document.

        Can be one of: "/active""/description""/meta""/options""/options/realm""/options/discoveryUrl""/options/claimsMapping""/pendingOptions""/pendingOptions/realm""/pendingOptions/discoveryUrl""/pendingOptions/clientId""/pendingOptions/clientSecret""/pendingOptions/emailVerifiedAlwaysTrue""/pendingOptions/claimsMapping""/postLogoutRedirectUri""/clockToleranceSec""/pendingOptions/idTokenSignatureAlg""/pendingOptions/decryptingKey"

      • value any

        The "value" data type is dependent on the path value being used.
    • array of objects

      A patch request for an identity provider using the SAML protocol. Supports a custom operation value called promote-options that allows the test configuration (pendingOptions) to be promoted to the live configuration (options) used for login.'

      Show properties
      • op string
        Required

        The "operation" to be performed on a given IdP.

        Can be one of: "replace""promote-options"

      • path string

        The "path" to the part of the IdP document.

        Can be one of: "/active""/description""/pendingOptions""/pendingOptions/nameIdFormat""/pendingOptions/allowIdpInitiatedLogin""/pendingOptions/entityId""/pendingOptions/signOnUrl""/pendingOptions/metadata""/pendingOptions/certificates""/pendingOptions/claimsMapping""/postLogoutRedirectUri""/clockToleranceSec"

      • value any

        The "value" data type is dependent on the path value being used.
    • array of objects

      A patch request for an identity provider using the jwtAuth protocol.

      Show properties
      • op string
        Required

        The "operation" to be performed on a given IdP.

        Can be one of: "replace"

      • path string

        The "path" to the part of the IdP document.

        Can be one of: "/description"

      • value any

        The "value" data type is dependent on the path value being used.

Responses

204

Success

400

Bad request. Invalid request body, URL, or state transition.

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.

401

Unauthorized

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.

403

Access Denied. Only the edge-auth service or TenantAdmin user request can patch an IdP.

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.

404

Not Found

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.

412

Precondition Failed. Missing QLIK-IDP-OPTS-MATCH header, or value doesn't match against IdP test configuration value.

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.

500

Internal server error, the operation failed unexpectedly

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.
PATCH /api/v1/identity-providers/{id} 
import { createQlikApi } from '@qlik/api'


const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})


await qlik.identityProviders.patchIdp('string', [
  { op: 'replace', path: '/active' },
])
qlik identity-provider patch 'string'
curl "https://{tenant}.{region}.qlikcloud.com/api/v1/identity-providers/{id}" \
-X PATCH \
-H "Content-type: application/json" \
-H "Authorization: Bearer <access_token>" \
-d '[{"op":"replace","path":"/active"}]'

Delete an IdP

Deletes an identity provider. Requesting user must be assigned the TenantAdmin role.

Facts

Rate limit Tier 2 (100 requests per minute)

Path Parameters

  • id string
    Required

    The identity provider ID.

Responses

204

Success

400

Bad request. The interactive IdP for the tenant can't be deleted.

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.

404

Not Found

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.
DELETE /api/v1/identity-providers/{id} 
import { createQlikApi } from '@qlik/api'


const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})


await qlik.identityProviders.deleteIdp('string')
qlik identity-provider rm 'string'
curl "https://{tenant}.{region}.qlikcloud.com/api/v1/identity-providers/{id}" \
-X DELETE \
-H "Authorization: Bearer <access_token>"

Return active interactive IdP metadata

Retrieves default IdP metadata when no interactive IdP is enabled.

Facts

Rate limit Tier 1 (1000 requests per minute)

Responses

200

Success

  • application/json object
    Show application/json properties
    • userPortalLink string

      A link to direct you to where you can manage your Qlik account. Only available if the default identity provider is used (no custom interactive identity providers are active).

    • upgradeSubscriptionLink string

      A link to direct you to where you can upgrade your trial or manage your subscriptions. Only available if the default identity provider is used (no custom interactive identity providers are active).

403

Forbidden

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.

404

Not Found

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.

500

Internal server error

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.
GET /api/v1/identity-providers/me/meta 
import { createQlikApi } from '@qlik/api'


const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})


await qlik.identityProviders.getMyIdpMeta()
qlik identity-provider me meta
curl "https://{tenant}.{region}.qlikcloud.com/api/v1/identity-providers/me/meta" \
-H "Authorization: Bearer <access_token>"

Example Response

{
  "userPortalLink": "string",
  "upgradeSubscriptionLink": "string"
}

List IdP statuses

Retrieves the status of all IdP configurations. Requires TenantAdmin role.

Facts

Rate limit Tier 1 (1000 requests per minute)

Responses

200

Success

  • application/json object
    Show application/json properties
    • idps_metadata array of objects

      A list of IdP metadata.

      Show idps_metadata properties
      • active boolean

        Indicates whether the IdP is available for use.

      • provider string

        The identity provider to be used. If protocol is OIDC, the valid values are auth0, okta, generic, salesforce, keycloak, adfs, and azureAD. If protocol is jwtAuth, the valid value is external.

        Can be one of: "auth0""okta""qlik""generic""salesforce""keycloak""adfs""external""azureAD"

      • interactive boolean

        Indicates whether the IdP is meant for interactive login.
    • active_interactive_idps_count number

      The number of active interactive IdPs.

403

Forbidden

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.

404

Not Found

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.

500

Internal Server Error

  • application/json object

    A representation of the errors encountered from the HTTP request.

    Show application/json properties
    • errors array of objects

      An error object.

      Show errors properties
      • code string
        Required

        The error code.

      • meta object

        Additional properties relating to the error.

      • title string
        Required

        Summary of the problem.

      • detail string

        A human-readable explanation specific to this occurrence of the problem.

      • source object

        References to the source of the error.

        Show source properties
        • pointer string

          A JSON pointer to the property that caused the error.

        • parameter string

          The URI query parameter that caused the error.
      • status number

        The HTTP status code.
GET /api/v1/identity-providers/status 
import { createQlikApi } from '@qlik/api'


const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})


await qlik.identityProviders.getIdpStatuses()
qlik identity-provider status
curl "https://{tenant}.{region}.qlikcloud.com/api/v1/identity-providers/status" \
-H "Authorization: Bearer <access_token>"

Example Response

{
  "idps_metadata": [
    {
      "active": true,
      "provider": "auth0",
      "interactive": true
    }
  ],
  "active_interactive_idps_count": 42
}