> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create Idp Connection > Create a new IdP connection for the organization. Creates a new OIDC Identity Provider and links it to the organization. This enables SSO for the organization. Required fields: - display_name: Human-readable name for the IdP - issuer: OIDC issuer URL - client_id: OAuth client ID from your IdP - client_secret: OAuth client secret from your IdP - authorization_url: OIDC authorization endpoint - token_url: OIDC token endpoint - jwks_url: OIDC JWKS endpoint Only admins can create an IdP connection. Returns 409 if an IdP already exists for this organization. ## OpenAPI ````yaml /api-reference/openapi.yaml post /api/identity/public/v1/idp/connection openapi: 3.1.0 info: title: Barndoor.ai Public API description: Unified public API specification for Barndoor.ai platform version: 2.18.0 servers: - url: https://{host} description: Barndoor public API variables: host: default: platform.barndoor.ai description: >- The host serving your Barndoor deployment. Defaults to production; override it for another environment or a dedicated deployment. security: - ApiKey: [] - OAuth2: - openid - profile - email tags: - name: dlp x-group: Data Control Center - name: identity x-group: Identity - name: llm-gateway x-group: LLM Gateway - name: notification x-group: Notifications - name: policy x-group: Policies - name: registry x-group: MCP Gateway - name: system-management x-group: Log Exports paths: /api/identity/public/v1/idp/connection: post: tags: - identity summary: Create Idp Connection description: |- Create a new IdP connection for the organization. Creates a new OIDC Identity Provider and links it to the organization. This enables SSO for the organization. Required fields: - display_name: Human-readable name for the IdP - issuer: OIDC issuer URL - client_id: OAuth client ID from your IdP - client_secret: OAuth client secret from your IdP - authorization_url: OIDC authorization endpoint - token_url: OIDC token endpoint - jwks_url: OIDC JWKS endpoint Only admins can create an IdP connection. Returns 409 if an IdP already exists for this organization. operationId: create_idp_connection requestBody: content: application/json: schema: $ref: '#/components/schemas/IdpConnectionConfig' required: true responses: '201': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/IdpConnectionResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' components: schemas: IdpConnectionConfig: properties: display_name: type: string title: Display Name issuer: type: string title: Issuer client_id: anyOf: - type: string - type: 'null' title: Client Id client_secret: anyOf: - type: string - type: 'null' title: Client Secret authorization_url: type: string title: Authorization Url token_url: type: string title: Token Url userinfo_url: anyOf: - type: string - type: 'null' title: Userinfo Url jwks_url: type: string title: Jwks Url logout_url: anyOf: - type: string - type: 'null' title: Logout Url scopes: type: string title: Scopes default: openid profile email prompt: type: string enum: - '' - none - login - consent - select_account title: Prompt default: '' use_discovery: type: boolean title: Use Discovery default: false domain: anyOf: - type: string - type: 'null' title: Domain type: object required: - display_name - issuer - authorization_url - token_url - jwks_url title: IdpConnectionConfig description: Configuration for creating/updating an IdP connection. IdpConnectionResponse: properties: configured: type: boolean title: Configured default: false alias: anyOf: - type: string - type: 'null' title: Alias expected_alias: anyOf: - type: string - type: 'null' title: Expected Alias display_name: anyOf: - type: string - type: 'null' title: Display Name issuer: anyOf: - type: string - type: 'null' title: Issuer authorization_url: anyOf: - type: string - type: 'null' title: Authorization Url token_url: anyOf: - type: string - type: 'null' title: Token Url userinfo_url: anyOf: - type: string - type: 'null' title: Userinfo Url jwks_url: anyOf: - type: string - type: 'null' title: Jwks Url logout_url: anyOf: - type: string - type: 'null' title: Logout Url scopes: anyOf: - type: string - type: 'null' title: Scopes prompt: type: string title: Prompt default: '' client_id_configured: type: boolean title: Client Id Configured default: false client_secret_configured: type: boolean title: Client Secret Configured default: false domain: anyOf: - type: string - type: 'null' title: Domain domains: items: type: string type: array title: Domains default: [] type: object title: IdpConnectionResponse description: Response containing current IdP connection configuration. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError securitySchemes: ApiKey: type: http scheme: bearer description: >- A Barndoor API key, sent as `Authorization: Bearer `. Keys are prefixed `bdai_` and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token. OAuth2: type: oauth2 x-issuer: https://auth.barndoor.ai/realms/barndoor description: >- An OAuth 2.0 access token from Barndoor's identity provider, sent as `Authorization: Bearer `. Public clients must use PKCE. Interchangeable with an API key. flows: authorizationCode: authorizationUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/auth tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. clientCredentials: tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.