# describeIDPFederation `GET /apis/cra.diagrid.io/v1beta1/idp-federations/{idpFederationName}` describe an existing IDPFederation ## Request ### Path parameters | Name | Type | Required | Description | | --- | --- | --- | --- | | `idpFederationName` | string | Yes | Name of the IDPFederation. Used as the path identifier on the org-scoped idp-federations collection. | ## Responses ### 200 — [OK](https://jsonapi.org/format/#fetching-resources-responses-200) `application/json` - `apiVersion` (string) - `kind` (string) - `metadata` (object) - `name` (string) - `uid` (string) - `resourceVersion` (integer) - `createdAt` (string) - `updatedAt` (string) - `deletedAt` (string) - `labels` (object) - `annotations` (object) - `spec` (object) — Spec describes an external identity provider federation. - `name` (string) — Required. Name is a human friendly name for this federation. - `type` (string) — Type identifies the external identity provider. On SaaS only "auth0" is accepted; dedicated and self-hosted deployments accept all supported types. Defaults to "auth0" when omitted. One of: `auth0`, `entra`, `google`, `oidc`. - `issuer` (string) — Required. Issuer is the OpenID Connect issuer identifier. It is matched against the "iss" claim of inbound JWTs. - `jwksUri` (string) — JWKSURI optionally overrides the JSON Web Key Set endpoint used to fetch the issuer's signing keys. When empty it is derived from the issuer's OpenID Connect discovery document. - `audience` (string[]) — Required. Audience is the set of accepted values for the "aud" claim of inbound JWTs. - `requiredScopes` (string[]) — RequiredScopes lists scopes that must all be present on an inbound token for it to be accepted. - `acceptAlgorithms` (string[]) — AcceptAlgorithms lists the JWS signing algorithms accepted for inbound tokens. Defaults to ["RS256"] when omitted. - `claimMappings` (object) — ClaimMappings maps inbound token claims onto the platform's identity model. Subject, Tenant and Scopes are the claims the platform itself reasons about, so each gets a typed field and its own normalization rule. Everything else a federation wants to carry through goes in Attributes, which needs no schema change per attribute. - `subject` (string) — Subject names the claim that carries the subject identifier. - `tenant` (string) — Tenant names the claim that carries the tenant identifier. - `scopes` (string) — Scopes names the claim that carries the granted scopes. - `scopeFormat` (string) — ScopeFormat describes how the scopes claim is encoded, either as a space-delimited string or as an array. One of: `space_delimited`, `array`. - `attributes` (object) — Attributes maps a canonical attribute name to the upstream claim that carries it, for attributes the platform forwards but does not interpret. Values are copied with their upstream JSON type into the minted token's "https://diagrid.io/attributes" container claim, so {"team": "roles"} against Microsoft Entra yields {"https://diagrid.io/attributes": {"team": ["platform"]}}. Mapping normalizes provider differences: Entra spells it "roles" and Auth0 "https://example.com/team", but a consumer only reads "team". An attribute the token does not carry is omitted rather than rejected. Unlike Subject and Tenant, attributes are descriptive: nothing on the platform requires one to be present, and RequiredScopes cannot make one mandatory — it constrains the scopes claim only. So an absent attribute is indistinguishable from one never mapped, and authorization that consumes these must deny when the attribute it needs is missing. Write allow-lists over them ("permit when team is platform"), never deny-lists ("refuse when team is contractor"), which a token carrying no team at all would slip straight through. - `status` (object) — IDPFederationStatus is the public status of an IDPFederation. - `status` (string) — Status is the current processing status of the resource. - `updatedAt` (string) — UpdatedAt is the time of the last status update. - `messages` (object[]) — Messages contains any status messages, such as error details. - `message` (string) - `processedSpecVersion` (integer (int64)) — ProcessedSpecVersion is the spec version last processed by the consuming controller. `application/vnd.api+json` - `data` (object) - `apiVersion` (string) - `kind` (string) - `metadata` (object) - `name` (string) - `uid` (string) - `resourceVersion` (integer) - `createdAt` (string) - `updatedAt` (string) - `deletedAt` (string) - `labels` (object) - `annotations` (object) - `spec` (object) — Spec describes an external identity provider federation. - `name` (string) — Required. Name is a human friendly name for this federation. - `type` (string) — Type identifies the external identity provider. On SaaS only "auth0" is accepted; dedicated and self-hosted deployments accept all supported types. Defaults to "auth0" when omitted. One of: `auth0`, `entra`, `google`, `oidc`. - `issuer` (string) — Required. Issuer is the OpenID Connect issuer identifier. It is matched against the "iss" claim of inbound JWTs. - `jwksUri` (string) — JWKSURI optionally overrides the JSON Web Key Set endpoint used to fetch the issuer's signing keys. When empty it is derived from the issuer's OpenID Connect discovery document. - `audience` (string[]) — Required. Audience is the set of accepted values for the "aud" claim of inbound JWTs. - `requiredScopes` (string[]) — RequiredScopes lists scopes that must all be present on an inbound token for it to be accepted. - `acceptAlgorithms` (string[]) — AcceptAlgorithms lists the JWS signing algorithms accepted for inbound tokens. Defaults to ["RS256"] when omitted. - `claimMappings` (object) — ClaimMappings maps inbound token claims onto the platform's identity model. Subject, Tenant and Scopes are the claims the platform itself reasons about, so each gets a typed field and its own normalization rule. Everything else a federation wants to carry through goes in Attributes, which needs no schema change per attribute. - `subject` (string) — Subject names the claim that carries the subject identifier. - `tenant` (string) — Tenant names the claim that carries the tenant identifier. - `scopes` (string) — Scopes names the claim that carries the granted scopes. - `scopeFormat` (string) — ScopeFormat describes how the scopes claim is encoded, either as a space-delimited string or as an array. One of: `space_delimited`, `array`. - `attributes` (object) — Attributes maps a canonical attribute name to the upstream claim that carries it, for attributes the platform forwards but does not interpret. Values are copied with their upstream JSON type into the minted token's "https://diagrid.io/attributes" container claim, so {"team": "roles"} against Microsoft Entra yields {"https://diagrid.io/attributes": {"team": ["platform"]}}. Mapping normalizes provider differences: Entra spells it "roles" and Auth0 "https://example.com/team", but a consumer only reads "team". An attribute the token does not carry is omitted rather than rejected. Unlike Subject and Tenant, attributes are descriptive: nothing on the platform requires one to be present, and RequiredScopes cannot make one mandatory — it constrains the scopes claim only. So an absent attribute is indistinguishable from one never mapped, and authorization that consumes these must deny when the attribute it needs is missing. Write allow-lists over them ("permit when team is platform"), never deny-lists ("refuse when team is contractor"), which a token carrying no team at all would slip straight through. - `status` (object) — IDPFederationStatus is the public status of an IDPFederation. - `status` (string) — Status is the current processing status of the resource. - `updatedAt` (string) — UpdatedAt is the time of the last status update. - `messages` (object[]) — Messages contains any status messages, such as error details. - `message` (string) - `processedSpecVersion` (integer (int64)) — ProcessedSpecVersion is the spec version last processed by the consuming controller. ### 404 — [Not found](https://jsonapi.org/format/#fetching-resources-responses-404) `application/json` In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object. - `code` (string) — Required. This is the same as the HTTP status of the response. - `message` (string) — Required. A short description of the error. - `status` (object) — Required. A status code that indicates the error type. - `details` (object) — Additional details about the errors. - `@type` (string) — The type of error. - `reason` (string) — A reason for the error. - `domain` (string) — The domain in which the error occurred. - `metadata` (object) — Additional metadata about the error. `application/vnd.api+json` JSONAPI.org specification error response wrapper for UI. - `error` (object) — In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object. - `code` (string) — Required. This is the same as the HTTP status of the response. - `message` (string) — Required. A short description of the error. - `status` (object) — Required. A status code that indicates the error type. - `details` (object) — Additional details about the errors. - `@type` (string) — The type of error. - `reason` (string) — A reason for the error. - `domain` (string) — The domain in which the error occurred. - `metadata` (object) — Additional metadata about the error. - `meta` (object) — Link members related to the primary data. - One of: - **string (uri-reference)** — A string containing the link's URL. - **object** - `href` (string (uri-reference)) — Required. A string containing the link's URL. - `meta` (object) — Non-standard meta-information that can not be represented as an attribute or relationship. - `links` (object) — Non-standard meta-information that can not be represented as an attribute or relationship. ### default — get IDPFederation response `application/json` In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object. - `code` (string) — Required. This is the same as the HTTP status of the response. - `message` (string) — Required. A short description of the error. - `status` (object) — Required. A status code that indicates the error type. - `details` (object) — Additional details about the errors. - `@type` (string) — The type of error. - `reason` (string) — A reason for the error. - `domain` (string) — The domain in which the error occurred. - `metadata` (object) — Additional metadata about the error. `application/vnd.api+json` JSONAPI.org specification error response wrapper for UI. - `error` (object) — In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object. - `code` (string) — Required. This is the same as the HTTP status of the response. - `message` (string) — Required. A short description of the error. - `status` (object) — Required. A status code that indicates the error type. - `details` (object) — Additional details about the errors. - `@type` (string) — The type of error. - `reason` (string) — A reason for the error. - `domain` (string) — The domain in which the error occurred. - `metadata` (object) — Additional metadata about the error. - `meta` (object) — Link members related to the primary data. - One of: - **string (uri-reference)** — A string containing the link's URL. - **object** - `href` (string (uri-reference)) — Required. A string containing the link's URL. - `meta` (object) — Non-standard meta-information that can not be represented as an attribute or relationship. - `links` (object) — Non-standard meta-information that can not be represented as an attribute or relationship.