# Get the OIDC configuration of a connection

`GET /v1/connections/{connection_id}/oidc` · permission `connections:read`

Returns the relying-party configuration of an enterprise OIDC connection: the `redirect_uri` to register at the identity provider, the `issuer`, the `client_id`, the client authentication method and the provider profile. The client secret is never returned: the response only says whether one is stored (`client_secret_configured`) and when it expires, if you gave a date. The `ETag` header carries the version of the configuration; send it as `If-Match` when you update it. Reads are not audited.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `connection_id` | path | yes | Enterprise connection ID (`conn_…`). |

## Response

`200 OK` with the configuration and an `ETag`.

```json
{
  "redirect_uri": "https://acme.eu1.keenauth.app/sso/conn_01j9xp6q0r1s5t7v9w1x3y5z7b/callback",
  "issuer": "https://idp.example.com",
  "client_id": "keenauth-acme",
  "client_auth_method": "client_secret_basic",
  "provider_profile": "generic",
  "client_secret_configured": true,
  "client_secret_expires_at": "2027-04-01T00:00:00Z"
}
```

| Field | Description |
|---|---|
| `redirect_uri` | The callback to register at the identity provider. It is fixed when the configuration is first written. |
| `issuer` | The identity provider's issuer URL. |
| `client_id` | The client ID registered at the identity provider. |
| `client_auth_method` | `private_key_jwt`, `client_secret_basic` or `client_secret_post`. |
| `provider_profile` | `entra`, `okta`, `google`, `keycloak`, `ping`, `onelogin`, `jumpcloud` or `generic`. |
| `client_secret_configured` | Whether a client secret is stored. Its value is never returned. |
| `client_secret_expires_at` | When the identity provider expires the secret; `null` when not given. |

## Errors

| HTTP | code | When |
|---|---|---|
| 404 | `not_found` | The connection does not exist in this environment, is not an enterprise OIDC connection, or has no OIDC configuration yet. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl -i "https://api.eu.keenauth.com/v1/connections/conn_01j9xp6q0r1s5t7v9w1x3y5z7b/oidc" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

```bash
keenauth connections oidc get conn_01j9xp6q0r1s5t7v9w1x3y5z7b
```