Start flow with an identity provider

Start a flow with an identity provider, for external login, registration or linking

application/json

application/grpc

application/grpc-web+proto

Request Body required

idpId string

Possible values: non-empty and <= 200 characters

ID for existing identity provider

urls object

successUrl string

Possible values: non-empty and <= 200 characters

URL on which the user will be redirected after a successful login

failureUrl string

Possible values: non-empty and <= 200 characters

URL on which the user will be redirected after a failed login

ldap object

username string

Possible values: non-empty and <= 200 characters

Username used to login through LDAP

password string

Possible values: non-empty and <= 200 characters

Password used to login through LDAP

Request Body required

idpId string

Possible values: non-empty and <= 200 characters

ID for existing identity provider

urls object

successUrl string

Possible values: non-empty and <= 200 characters

URL on which the user will be redirected after a successful login

failureUrl string

Possible values: non-empty and <= 200 characters

URL on which the user will be redirected after a failed login

ldap object

username string

Possible values: non-empty and <= 200 characters

Username used to login through LDAP

password string

Possible values: non-empty and <= 200 characters

Password used to login through LDAP

Request Body required

idpId string

Possible values: non-empty and <= 200 characters

ID for existing identity provider

urls object

successUrl string

Possible values: non-empty and <= 200 characters

URL on which the user will be redirected after a successful login

failureUrl string

Possible values: non-empty and <= 200 characters

URL on which the user will be redirected after a failed login

ldap object

username string

Possible values: non-empty and <= 200 characters

Username used to login through LDAP

password string

Possible values: non-empty and <= 200 characters

Password used to login through LDAP

Responses

• 200
• 403
• 404
• default

---

OK

application/json

application/grpc

application/grpc-web+proto

Schema

Example (from schema)

---

Schema

details object
sequence uint64
on read: the sequence of the last event reduced by the projection
on manipulation: the timestamp of the event(s) added by the manipulation
changeDate date-time
on read: the timestamp of the last event reduced by the projection
on manipulation: the timestamp of the event(s) added by the manipulation
resourceOwner resource_owner is the organization or instance_id an object belongs to
authUrl string

URL to which the client should redirect

idpIntent object

IDP Intent information

idpIntentId string

Possible values: non-empty and <= 200 characters

ID of the IDP intent

idpIntentToken string

Possible values: non-empty and <= 200 characters

token of the IDP intent

userId string

Possible values: <= 200 characters

ID of the ZITADEL user if external user already linked

postForm byte

POST call information

{
  "details": {
    "sequence": "2",
    "changeDate": "2024-01-15T17:30:58.374Z",
    "resourceOwner": "69629023906488334"
  },
  "authUrl": "https://accounts.google.com/o/oauth2/v2/auth?client_id=clientID&callback=https%3A%2F%2Fzitadel.cloud%2Fidps%2Fcallback",
  "idpIntent": {
    "idpIntentId": "163840776835432705",
    "idpIntentToken": "SJKL3ioIDpo342ioqw98fjp3sdf32wahb=",
    "userId": "163840776835432345"
  },
  "postForm": "string"
}

Schema

Example (from schema)

---

Schema

details object
sequence uint64
on read: the sequence of the last event reduced by the projection
on manipulation: the timestamp of the event(s) added by the manipulation
changeDate date-time
on read: the timestamp of the last event reduced by the projection
on manipulation: the timestamp of the event(s) added by the manipulation
resourceOwner resource_owner is the organization or instance_id an object belongs to
authUrl string

URL to which the client should redirect

idpIntent object

IDP Intent information

idpIntentId string

Possible values: non-empty and <= 200 characters

ID of the IDP intent

idpIntentToken string

Possible values: non-empty and <= 200 characters

token of the IDP intent

userId string

Possible values: <= 200 characters

ID of the ZITADEL user if external user already linked

postForm byte

POST call information

{
  "details": {
    "sequence": "2",
    "changeDate": "2024-01-15T17:30:58.374Z",
    "resourceOwner": "69629023906488334"
  },
  "authUrl": "https://accounts.google.com/o/oauth2/v2/auth?client_id=clientID&callback=https%3A%2F%2Fzitadel.cloud%2Fidps%2Fcallback",
  "idpIntent": {
    "idpIntentId": "163840776835432705",
    "idpIntentToken": "SJKL3ioIDpo342ioqw98fjp3sdf32wahb=",
    "userId": "163840776835432345"
  },
  "postForm": "string"
}

Schema

Example (from schema)

---

Schema

details object
sequence uint64
on read: the sequence of the last event reduced by the projection
on manipulation: the timestamp of the event(s) added by the manipulation
changeDate date-time
on read: the timestamp of the last event reduced by the projection
on manipulation: the timestamp of the event(s) added by the manipulation
resourceOwner resource_owner is the organization or instance_id an object belongs to
authUrl string

URL to which the client should redirect

idpIntent object

IDP Intent information

idpIntentId string

Possible values: non-empty and <= 200 characters

ID of the IDP intent

idpIntentToken string

Possible values: non-empty and <= 200 characters

token of the IDP intent

userId string

Possible values: <= 200 characters

ID of the ZITADEL user if external user already linked

postForm byte

POST call information

{
  "details": {
    "sequence": "2",
    "changeDate": "2024-01-15T17:30:58.374Z",
    "resourceOwner": "69629023906488334"
  },
  "authUrl": "https://accounts.google.com/o/oauth2/v2/auth?client_id=clientID&callback=https%3A%2F%2Fzitadel.cloud%2Fidps%2Fcallback",
  "idpIntent": {
    "idpIntentId": "163840776835432705",
    "idpIntentToken": "SJKL3ioIDpo342ioqw98fjp3sdf32wahb=",
    "userId": "163840776835432345"
  },
  "postForm": "string"
}

Returned when the user does not have permission to access the resource.

application/json

application/grpc

application/grpc-web+proto

Schema

Example (from schema)

---

Schema

code int32
message string
details object[]
Array [
@type string
]

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

Schema

Example (from schema)

---

Schema

code int32
message string
details object[]
Array [
@type string
]

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

Schema

Example (from schema)

---

Schema

code int32
message string
details object[]
Array [
@type string
]

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

Returned when the resource does not exist.

application/json

application/grpc

application/grpc-web+proto

Schema

Example (from schema)

---

Schema

code int32
message string
details object[]
Array [
@type string
]

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

Schema

Example (from schema)

---

Schema

code int32
message string
details object[]
Array [
@type string
]

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

Schema

Example (from schema)

---

Schema

code int32
message string
details object[]
Array [
@type string
]

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

An unexpected error response.

application/json

application/grpc

application/grpc-web+proto

Schema

Example (from schema)

---

Schema

code int32
message string
details object[]
Array [
@type string
]

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

Schema

Example (from schema)

---

Schema

code int32
message string
details object[]
Array [
@type string
]

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

Schema

Example (from schema)

---

Schema

code int32
message string
details object[]
Array [
@type string
]

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

POST /v2beta/idp_intents

Authorization

name: OAuth2type: oauth2scopes: openid,urn:zitadel:iam:org:project:id:zitadel:audflows: {
  "authorizationCode": {
    "authorizationUrl": "$CUSTOM-DOMAIN/oauth/v2/authorize",
    "tokenUrl": "$CUSTOM-DOMAIN/oauth/v2/token",
    "scopes": {
      "openid": "openid",
      "urn:zitadel:iam:org:project:id:zitadel:aud": "urn:zitadel:iam:org:project:id:zitadel:aud"
    }
  }
}

Request

Base URL

https://$CUSTOM-DOMAIN

Bearer Token

Content-Type

application/jsonapplication/grpcapplication/grpc-web+proto

Body required

{
  "idpId": "163840776835432705",
  "urls": {
    "successUrl": "https://custom.com/login/idp/success",
    "failureUrl": "https://custom.com/login/idp/fail"
  },
  "ldap": {
    "username": "username",
    "password": "Password1!"
  }
}

Accept

application/jsonapplication/grpcapplication/grpc-web+proto

curl / cURL

curl -L -X POST 'https://$CUSTOM-DOMAIN/v2beta/idp_intents' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
--data-raw '{
  "idpId": "163840776835432705",
  "urls": {
    "successUrl": "https://custom.com/login/idp/success",
    "failureUrl": "https://custom.com/login/idp/fail"
  },
  "ldap": {
    "username": "username",
    "password": "Password1!"
  }
}'

python / requests

curl -L -X POST 'https://$CUSTOM-DOMAIN/v2beta/idp_intents' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
--data-raw '{
  "idpId": "163840776835432705",
  "urls": {
    "successUrl": "https://custom.com/login/idp/success",
    "failureUrl": "https://custom.com/login/idp/fail"
  },
  "ldap": {
    "username": "username",
    "password": "Password1!"
  }
}'

go / native

curl -L -X POST 'https://$CUSTOM-DOMAIN/v2beta/idp_intents' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
--data-raw '{
  "idpId": "163840776835432705",
  "urls": {
    "successUrl": "https://custom.com/login/idp/success",
    "failureUrl": "https://custom.com/login/idp/fail"
  },
  "ldap": {
    "username": "username",
    "password": "Password1!"
  }
}'

nodejs / axios

curl -L -X POST 'https://$CUSTOM-DOMAIN/v2beta/idp_intents' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
--data-raw '{
  "idpId": "163840776835432705",
  "urls": {
    "successUrl": "https://custom.com/login/idp/success",
    "failureUrl": "https://custom.com/login/idp/fail"
  },
  "ldap": {
    "username": "username",
    "password": "Password1!"
  }
}'

ruby / Net::HTTP

curl -L -X POST 'https://$CUSTOM-DOMAIN/v2beta/idp_intents' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
--data-raw '{
  "idpId": "163840776835432705",
  "urls": {
    "successUrl": "https://custom.com/login/idp/success",
    "failureUrl": "https://custom.com/login/idp/fail"
  },
  "ldap": {
    "username": "username",
    "password": "Password1!"
  }
}'

csharp / RestSharp

curl -L -X POST 'https://$CUSTOM-DOMAIN/v2beta/idp_intents' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
--data-raw '{
  "idpId": "163840776835432705",
  "urls": {
    "successUrl": "https://custom.com/login/idp/success",
    "failureUrl": "https://custom.com/login/idp/fail"
  },
  "ldap": {
    "username": "username",
    "password": "Password1!"
  }
}'

php / cURL

curl -L -X POST 'https://$CUSTOM-DOMAIN/v2beta/idp_intents' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
--data-raw '{
  "idpId": "163840776835432705",
  "urls": {
    "successUrl": "https://custom.com/login/idp/success",
    "failureUrl": "https://custom.com/login/idp/fail"
  },
  "ldap": {
    "username": "username",
    "password": "Password1!"
  }
}'

java / OkHttp

curl -L -X POST 'https://$CUSTOM-DOMAIN/v2beta/idp_intents' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
--data-raw '{
  "idpId": "163840776835432705",
  "urls": {
    "successUrl": "https://custom.com/login/idp/success",
    "failureUrl": "https://custom.com/login/idp/fail"
  },
  "ldap": {
    "username": "username",
    "password": "Password1!"
  }
}'

powershell / RestMethod

curl -L -X POST 'https://$CUSTOM-DOMAIN/v2beta/idp_intents' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
--data-raw '{
  "idpId": "163840776835432705",
  "urls": {
    "successUrl": "https://custom.com/login/idp/success",
    "failureUrl": "https://custom.com/login/idp/fail"
  },
  "ldap": {
    "username": "username",
    "password": "Password1!"
  }
}'