--- title: Create a Custom OIDC provider description: Register an OIDC issuer, signing-key discovery configuration, and accepted audiences. breadcrumbs: Docs > API > Create a Custom OIDC provider --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Create a Custom OIDC provider ## v2 (latest) {% alert level="warning" %} **Note**: This endpoint is in preview and is subject to change. Custom OIDC authentication must be enabled for your organization. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help.md). {% /alert %} | Datadog site | API endpoint | | ----------------- | ----------------------------------------------------------- | | app.datadoghq.com | POST https://api.datadoghq.com/api/v2/wif/oidc/provider | | us3.datadoghq.com | POST https://api.us3.datadoghq.com/api/v2/wif/oidc/provider | | us5.datadoghq.com | POST https://api.us5.datadoghq.com/api/v2/wif/oidc/provider | | app.datadoghq.eu | POST https://api.datadoghq.eu/api/v2/wif/oidc/provider | | ap1.datadoghq.com | POST https://api.ap1.datadoghq.com/api/v2/wif/oidc/provider | | ap2.datadoghq.com | POST https://api.ap2.datadoghq.com/api/v2/wif/oidc/provider | | uk1.datadoghq.com | POST https://api.uk1.datadoghq.com/api/v2/wif/oidc/provider | | app.ddog-gov.com | POST https://api.ddog-gov.com/api/v2/wif/oidc/provider | | us2.ddog-gov.com | POST https://api.us2.ddog-gov.com/api/v2/wif/oidc/provider | ### Overview Register an OIDC issuer, signing-key discovery configuration, and accepted audiences. Provider names and issuer URLs must be unique within the organization. This endpoint requires the `workload_identity_federation_write` permission. OAuth apps require the `workload_identity_federation_write` authorization [scope](https://docs.datadoghq.com/api/latest/scopes.md#cloud-authentication) to access this endpoint. ### Request #### Body Data (required) {% tabs %} {% tab label="Model" %} | Parent field | Field | Type | Description | | --------------- | --------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | data [*required*] | object | Custom OIDC provider creation data. | | data | attributes [*required*] | object | Attributes for creating a Custom OIDC provider. | | attributes | audiences [*required*] | [string] | Expected token audiences. At least one audience is required. When `org_uuid_source` is `aud`, include datadog/{org_uuid} for the organization creating the provider. | | attributes | discovery_type [*required*] | enum | How the signing keys are discovered. Allowed enum values: `oidc_discovery`, `direct_jwks`. | | attributes | identity_claim_name | string | Claim used by legacy identity_pattern mappings and in identity logs. Default: `sub`. | | attributes | issuer_url [*required*] | string | HTTPS issuer URL that must match the token issuer. For oidc_discovery, signing keys are located through the issuer discovery document. | | attributes | jwks_url | string | HTTPS JSON Web Key Set URL. Required when `discovery_type` is `direct_jwks`. | | attributes | org_uuid_claim_name | string | Optional name of the token claim containing the Datadog organization UUID. | | attributes | org_uuid_source | enum | Source of the organization UUID in the signed token. The `aud` source accepts a datadog/{org_uuid} audience. Allowed enum values: `dd_org_uuid`, `aud`. Default: `dd_org_uuid`. | | attributes | provider_name [*required*] | string | Name identifying the provider within the organization. | | attributes | required_claims | [object] | Claim matchers required for every token from this provider, in addition to the persona mapping matchers. Shared issuers can require an exact tenant claim. | | required_claims | claim [*required*] | string | Name of the token claim. | | required_claims | mode | enum | Case-sensitive matching mode. Exact compares strings. Glob matches the entire value: * matches any number of characters, including /, and ? matches one character. Other characters are literal; escaping is not supported. Allowed enum values: `exact`, `glob`. Default: `exact`. | | required_claims | values [*required*] | [string] | Accepted values for this claim. Each value is limited to 500 UTF-8 bytes when creating the resource. | | data | type [*required*] | enum | Resource type. Allowed enum values: `custom_oidc_provider_config`. Default: `custom_oidc_provider_config`. | {% /tab %} {% tab label="Example" %} ```json { "data": { "type": "custom_oidc_provider_config", "attributes": { "provider_name": "oidc-de20b7e944abfac3", "issuer_url": "https://oidc-de20b7e944abfac3.example.com", "discovery_type": "oidc_discovery", "audiences": [ "sdk-test" ] } } } ``` {% /tab %} {% /tabs %} ### Response {% tabs %} {% tab label="201" %} Created {% tabs %} {% tab label="Model" %} Custom OIDC provider response. | Parent field | Field | Type | Description | | --------------- | ----------------------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | data [*required*] | object | Custom OIDC provider resource. | | data | attributes [*required*] | object | Stored Custom OIDC provider attributes. | | attributes | audiences | [string] | Expected token audiences. At least one audience is required. When `org_uuid_source` is `aud`, include datadog/{org_uuid} for the organization creating the provider. | | attributes | created_at | date-time | Time the configuration was created. Read-only. | | attributes | created_by | uuid | UUID of the user who created the configuration. Read-only. | | attributes | discovery_type | enum | How the signing keys are discovered. Allowed enum values: `oidc_discovery`, `direct_jwks`. | | attributes | identity_claim_name | string | Claim used by legacy identity_pattern mappings and in identity logs. Default: `sub`. | | attributes | issuer_url | string | HTTPS issuer URL that must match the token issuer. For oidc_discovery, signing keys are located through the issuer discovery document. | | attributes | jwks_url | string | HTTPS JSON Web Key Set URL. Required when `discovery_type` is `direct_jwks`. | | attributes | org_uuid_claim_name | string | Optional name of the token claim containing the Datadog organization UUID. | | attributes | org_uuid_source | enum | Source of the organization UUID in the signed token. The `aud` source accepts a datadog/{org_uuid} audience. Allowed enum values: `dd_org_uuid`, `aud`. Default: `dd_org_uuid`. | | attributes | provider_name | string | Name identifying the provider within the organization. | | attributes | required_claims | [object] | Claim matchers required for every token from this provider, in addition to the persona mapping matchers. Shared issuers can require an exact tenant claim. | | required_claims | claim [*required*] | string | Name of the token claim. | | required_claims | mode | enum | Case-sensitive matching mode. Exact compares strings. Glob matches the entire value: * matches any number of characters, including /, and ? matches one character. Other characters are literal; escaping is not supported. Allowed enum values: `exact`, `glob`. Default: `exact`. | | required_claims | values [*required*] | [string] | Accepted values for this claim. | | data | id [*required*] | uuid | Unique resource identifier. | | data | type [*required*] | enum | Resource type. Allowed enum values: `custom_oidc_provider_config`. Default: `custom_oidc_provider_config`. | {% /tab %} {% tab label="Example" %} ```json { "data": { "attributes": { "audiences": [ "datadog/00000000-0000-0000-0000-000000000001" ], "created_at": "2019-09-19T10:00:00.000Z", "created_by": "string", "discovery_type": "oidc_discovery", "identity_claim_name": "sub", "issuer_url": "https://issuer.example.com", "jwks_url": "https://issuer.example.com/keys", "org_uuid_claim_name": "dd_org_uuid", "org_uuid_source": "dd_org_uuid", "provider_name": "example-cluster", "required_claims": [ { "claim": "sub", "mode": "exact", "values": [ "system:serviceaccount:controllers:example-controller" ] } ] }, "id": "00000000-0000-0000-0000-000000000004", "type": "custom_oidc_provider_config" } } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="400" %} Bad Request {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="403" %} Forbidden {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="409" %} Conflict {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="429" %} Too many requests {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% /tabs %} ### Code Example {% tabs %} {% tab label="Curl" %} ```bash # Set your Datadog site and credentials export DD_SITE="datadoghq.com" # Or us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, ap1.datadoghq.com, ap2.datadoghq.com, uk1.datadoghq.com, ddog-gov.com, us2.ddog-gov.com # Use a Personal Access Token or Service Access Token export DD_BEARER_TOKEN="" curl -X POST "https://api.${DD_SITE}/api/v2/wif/oidc/provider" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ -d @- << EOF { "data": { "type": "custom_oidc_provider_config", "attributes": { "provider_name": "oidc-de20b7e944abfac3", "issuer_url": "https://oidc-de20b7e944abfac3.example.com", "discovery_type": "oidc_discovery", "audiences": [ "sdk-test" ] } } } EOF ``` {% /tab %} {% /tabs %}