{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Updates a configured identity provider.","properties":{"path":{"type":"object","properties":{"identity_provider_id":{"$ref":"#/definitions/access_uuid"},"account_id":{"$ref":"#/definitions/access_identifier"}},"required":["identity_provider_id","account_id"],"additionalProperties":false},"body":{"$ref":"#/definitions/access_identity-providers"}},"required":["path","body"],"additionalProperties":false,"definitions":{"access_uuid":{"description":"UUID.","type":"string","maxLength":36,"examples":["f174e90a-fafe-4643-bbbc-4a0ed4fc8415"]},"access_identifier":{"description":"Identifier.","type":"string","maxLength":32,"examples":["023e105f4ecef8ad9ca31a8372d0c353"]},"access_identity-providers":{"type":"object","anyOf":[{"$ref":"#/definitions/access_azureAD"},{"$ref":"#/definitions/access_centrify"},{"$ref":"#/definitions/access_facebook"},{"$ref":"#/definitions/access_github"},{"$ref":"#/definitions/access_google"},{"$ref":"#/definitions/access_google-apps"},{"$ref":"#/definitions/access_linkedin"},{"$ref":"#/definitions/access_oidc"},{"$ref":"#/definitions/access_duo"},{"$ref":"#/definitions/access_okta"},{"$ref":"#/definitions/access_onelogin"},{"$ref":"#/definitions/access_pingone"},{"$ref":"#/definitions/access_saml"},{"$ref":"#/definitions/access_yandex"},{"$ref":"#/definitions/access_onetimepin"},{"$ref":"#/definitions/access_cloudflare"},{"$ref":"#/definitions/access_passkeys"}]},"access_azureAD":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"type":"object","allOf":[{"$ref":"#/definitions/access_generic-oauth-config"},{"$ref":"#/definitions/access_custom-claims-support"},{"properties":{"conditional_access_enabled":{"description":"Should Cloudflare try to load authentication contexts from your account","type":"boolean"},"directory_id":{"description":"Your Azure directory uuid","type":"string","examples":["<your azure directory uuid>"]},"prompt":{"description":"Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.","type":"string","enum":["login","select_account","none"]},"support_groups":{"description":"Should Cloudflare try to load groups from your account","type":"boolean"}},"type":"object"}]}},"type":"object"}],"title":"Azure AD"},"access_centrify":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"allOf":[{"$ref":"#/definitions/access_generic-oauth-config"},{"$ref":"#/definitions/access_custom-claims-support"},{"properties":{"centrify_account":{"description":"Your centrify account url","type":"string","examples":["https://abc123.my.centrify.com/"]},"centrify_app_id":{"description":"Your centrify app id","type":"string","examples":["exampleapp"]}},"type":"object"}]}},"type":"object"}],"title":"Centrify"},"access_facebook":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"$ref":"#/definitions/access_generic-oauth-config"}},"type":"object"}],"title":"Facebook"},"access_github":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"$ref":"#/definitions/access_generic-oauth-config"}},"type":"object"}],"title":"GitHub"},"access_google":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"allOf":[{"$ref":"#/definitions/access_generic-oauth-config"},{"$ref":"#/definitions/access_custom-claims-support"}]}},"type":"object"}],"title":"Google"},"access_google-apps":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"allOf":[{"$ref":"#/definitions/access_generic-oauth-config"},{"$ref":"#/definitions/access_custom-claims-support"},{"properties":{"apps_domain":{"description":"Your companies TLD","type":"string","examples":["mycompany.com"]},"prompt":{"description":"Configures the prompt behavior for Google authentication.","type":"string","enum":["none","consent","select_account"],"examples":["select_account"]},"use_login_hint":{"description":"Whether to use a previously authenticated Access email as a Google login hint when exactly one email matches the Workspace domain.","type":"boolean","examples":[true]}},"type":"object"}]}},"type":"object"}],"title":"Google Workspace"},"access_linkedin":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"$ref":"#/definitions/access_generic-oauth-config"}},"type":"object"}],"title":"LinkedIn"},"access_oidc":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"allOf":[{"$ref":"#/definitions/access_generic-oauth-config"},{"$ref":"#/definitions/access_custom-claims-support"},{"properties":{"auth_url":{"description":"The authorization_endpoint URL of your IdP","type":"string","examples":["https://accounts.google.com/o/oauth2/auth"]},"certs_url":{"description":"The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens","type":"string","examples":["https://www.googleapis.com/oauth2/v3/certs"]},"pkce_enabled":{"description":"Enable Proof Key for Code Exchange (PKCE)","type":"boolean"},"scopes":{"description":"OAuth scopes","type":"array","items":{"type":"string"},"examples":[["openid","email","profile"]]},"token_url":{"description":"The token_endpoint URL of your IdP","type":"string","examples":["https://accounts.google.com/o/oauth2/token"]}},"type":"object"}]}},"type":"object"}],"title":"Generic OAuth"},"access_duo":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"type":"object","properties":{"client_id":{"description":"The client ID from the Duo Generic OIDC Relying Party metadata.","type":"string","examples":["DIABC123678901234567"]},"client_secret":{"description":"The client secret from the Duo Generic OIDC Relying Party metadata.","type":"string","examples":["<your client secret>"]},"issuer_url":{"description":"The issuer URL from the Duo Generic OIDC Relying Party metadata.","type":"string","format":"uri","examples":["https://sso-abc1def2.sso.duosecurity.com/oidc/DIABC123678901234567"]}}},"type":{"type":"string","enum":["duo"]}},"type":"object"}],"title":"Duo"},"access_okta":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"allOf":[{"$ref":"#/definitions/access_generic-oauth-config"},{"$ref":"#/definitions/access_custom-claims-support"},{"properties":{"authorization_server_id":{"description":"Your okta authorization server id","type":"string","examples":["aus9o8wzkhckw9TLa0h7z"]},"okta_account":{"description":"Your okta account url","type":"string","examples":["https://dev-abc123.oktapreview.com"]}},"type":"object"}]}},"type":"object"}],"title":"Okta"},"access_onelogin":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"allOf":[{"$ref":"#/definitions/access_generic-oauth-config"},{"$ref":"#/definitions/access_custom-claims-support"},{"properties":{"onelogin_account":{"description":"Your OneLogin account url","type":"string","examples":["https://mycompany.onelogin.com"]}},"type":"object"}]}},"type":"object"}],"title":"OneLogin"},"access_pingone":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"allOf":[{"$ref":"#/definitions/access_generic-oauth-config"},{"$ref":"#/definitions/access_custom-claims-support"},{"properties":{"ping_env_id":{"description":"Your PingOne environment identifier","type":"string","examples":["342b5660-0c32-4936-a5a4-ce21fae57b0a"]}},"type":"object"}]}},"type":"object"}],"title":"PingOne"},"access_saml":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"type":"object","properties":{"attributes":{"description":"A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.","type":"array","items":{"type":"string"},"examples":[["group","department_code","divison"]]},"email_attribute_name":{"description":"The attribute name for email in the SAML response.","type":"string","examples":["Email"]},"enable_encryption":{"description":"Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt \nSAML assertions using the certificate from the assigned certificate set.\n\nTo enable encryption:\n1. Create a certificate set via POST to `/identity_providers/{id}/saml_certificate`\n2. Set this field to `true` and include `saml_certificate_set_id` in the PUT request\n3. Configure the public certificate in your external Identity Provider\n\nNote: Requires `saml_certificate_set_id` to be set when `true`.\n","type":"boolean","default":false},"force_authn":{"description":"Asks the IdP to reauthenticate the user for each SAML authentication request.","type":"boolean","default":false},"header_attributes":{"description":"Add a list of attribute names that will be returned in the response header from the Access callback.","type":"array","items":{"properties":{"attribute_name":{"description":"attribute name from the IDP","type":"string"},"header_name":{"description":"header that will be added on the request to the origin","type":"string"}},"type":"object"}},"idp_public_certs":{"description":"X509 certificate to verify the signature in the SAML authentication response","type":"array","items":{"type":"string"}},"issuer_url":{"description":"IdP Entity ID or Issuer URL","type":"string","examples":["https://whoami.com"]},"max_sso_url_length":{"description":"The maximum URL length the IdP accepts for the SSO redirect URL.\nWhen the constructed SSO URL would exceed this length, the RelayState\nis stored server-side and a short nonce is passed to the IdP instead.\nSet this if your IdP enforces a URL length limit.\n","type":"integer","maximum":100000,"minimum":512,"examples":[8192]},"sign_request":{"description":"Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.","type":"boolean","default":false},"sso_target_url":{"description":"URL to send the SAML authentication requests to","type":"string","examples":["https://edgeaccess.org/idp/saml/login"]}}}},"type":"object"}],"title":"Generic SAML"},"access_yandex":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"$ref":"#/definitions/access_generic-oauth-config"}},"type":"object"}],"title":"Yandex"},"access_onetimepin":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"type":"object","properties":{}},"type":{"type":"string","enum":["onetimepin"]}},"type":"object"}],"title":"One Time Pin"},"access_cloudflare":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"type":"object","properties":{"restrict_to_account_members":{"description":"When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.","type":"boolean","default":false}}},"type":{"type":"string","enum":["cloudflare"]}},"type":"object"}],"title":"Cloudflare"},"access_passkeys":{"type":"object","allOf":[{"$ref":"#/definitions/access_identity-provider"},{"properties":{"config":{"type":"object","properties":{"login_page_auto_prompt":{"description":"When enabled, the Access login page automatically prompts the user to authenticate with a passkey.","type":"boolean","default":false}}},"type":{"type":"string","enum":["passkeys"]}},"type":"object"}],"title":"Passkeys"},"access_identity-provider":{"type":"object","properties":{"config":{"description":"The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).","type":"object"},"id":{"$ref":"#/definitions/access_uuid"},"name":{"$ref":"#/definitions/access_name-3"},"saml_certificate_set_id":{"description":"The UID of the SAML encryption certificate set assigned to this Identity Provider.\nOnly present for SAML identity providers with encryption configured.\nCreate a certificate set via POST to `/identity_providers/{id}/saml_certificate`.\n","type":"string","format":"uuid","examples":["c409ef44-e72c-41c8-8c0b-278c8a6f4fd8"]},"scim_config":{"description":"The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.","type":"object","properties":{"enabled":{"description":"A flag to enable or disable SCIM for the identity provider.","type":"boolean","default":false},"identity_update_behavior":{"description":"Indicates how a SCIM event updates a user identity used for policy evaluation. Use \"automatic\" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use \"reauth\" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With \"reauth\" identities will not contain fields from the SCIM user resource. With \"no_action\" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.","type":"string","default":"no_action","enum":["automatic","reauth","no_action"]},"seat_deprovision":{"description":"A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider.  This cannot be enabled unless user_deprovision is also enabled.","type":"boolean","default":false},"user_deprovision":{"description":"A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.","type":"boolean","default":false}}},"type":{"description":"The type of identity provider. To determine the value for a specific provider, refer to our [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).","type":"string","enum":["onetimepin","azureAD","saml","centrify","facebook","github","google-apps","google","linkedin","oidc","duo","okta","onelogin","pingone","yandex","cloudflare","passkeys"],"examples":["onetimepin"]}},"required":["name","type","config"]},"access_generic-oauth-config":{"type":"object","properties":{"client_id":{"description":"Your OAuth Client ID","type":"string","examples":["<your client id>"]},"client_secret":{"description":"Your OAuth Client Secret","type":"string","examples":["<your client secret>"]}}},"access_custom-claims-support":{"type":"object","properties":{"claims":{"description":"Custom claims","type":"array","items":{"type":"string"},"examples":[["email_verified","preferred_username","custom_claim_name"]]},"email_claim_name":{"description":"The claim name for email in the id_token response.","type":"string","examples":["custom_claim_name"]}}},"access_name-3":{"description":"The name of the identity provider, shown to users on the login page.","type":"string","examples":["Widget Corps IDP"]}}},"name":"Update an Access identity provider","id":"cloudflare.access-identity-providers-update-an-access-identity-provider","example":{"path":{"identity_provider_id":"f174e90a-fafe-4643-bbbc-4a0ed4fc8415","account_id":"023e105f4ecef8ad9ca31a8372d0c353"},"body":{"name":"Widget Corps IDP","type":"onetimepin","config":{}}},"maxRequests":1,"summary":false}}