Get the OIDC configuration of a connection

GET /v1/connections/{connection_id}/oidc · permission connections:read

Returns the relying-party configuration of an enterprise OIDC connection: the redirect_uri to register at the identity provider, the issuer, the client_id, the client authentication method and the provider profile. The client secret is never returned: the response only says whether one is stored (client_secret_configured) and when it expires, if you gave a date. The ETag header carries the version of the configuration; send it as If-Match when you update it. Reads are not audited.

Request

Field	Type	Required	Description
`connection_id`	path	yes	Enterprise connection ID (`conn_…`).

Response

200 OK with the configuration and an ETag.

{
  "redirect_uri": "https://acme.eu1.keenauth.app/sso/conn_01j9xp6q0r1s5t7v9w1x3y5z7b/callback",
  "issuer": "https://idp.example.com",
  "client_id": "keenauth-acme",
  "client_auth_method": "client_secret_basic",
  "provider_profile": "generic",
  "client_secret_configured": true,
  "client_secret_expires_at": "2027-04-01T00:00:00Z"
}

Field	Description
`redirect_uri`	The callback to register at the identity provider. It is fixed when the configuration is first written.
`issuer`	The identity provider's issuer URL.
`client_id`	The client ID registered at the identity provider.
`client_auth_method`	`private_key_jwt`, `client_secret_basic` or `client_secret_post`.
`provider_profile`	`entra`, `okta`, `google`, `keycloak`, `ping`, `onelogin`, `jumpcloud` or `generic`.
`client_secret_configured`	Whether a client secret is stored. Its value is never returned.
`client_secret_expires_at`	When the identity provider expires the secret; `null` when not given.

Errors

HTTP	code	When
404	`not_found`	The connection does not exist in this environment, is not an enterprise OIDC connection, or has no OIDC configuration yet.
401	`unauthenticated`	The credential is missing, invalid or revoked.
403	`insufficient_permissions`	The credential lacks the required permission.
429	`rate_limited`	The rate limit was exceeded; retry after the `Retry-After` period.
503	`service_unavailable`	A dependency is temporarily unavailable; retry after the `Retry-After` period.

Example

curl -i "https://api.eu.keenauth.com/v1/connections/conn_01j9xp6q0r1s5t7v9w1x3y5z7b/oidc" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"

keenauth connections oidc get conn_01j9xp6q0r1s5t7v9w1x3y5z7b