Get identity provider

Retrieves the basic information, option specification, and current values for the specified identity provider configuration. Values for keys marked as protected are masked in the response.

Required Permissions

Requires the ADMIN role or higher.

HTTP Request

GET /api/sonar/id-providers/:code

cURL Example

curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/id-providers/saml

Request Parameters

Key	Required	Type	Description	Notes
code	Yes	String	Identity provider code	-
locale	No	String	Locale	-

Success Response

{
  "code": "saml",
  "name": "SAML",
  "path": "/sso/saml",
  "icon": "iVBORw0KGgoAAAANSUhEUgAA...",
  "enabled": true,
  "description": "Corporate SAML IdP integration",
  "created": "2026-04-01 10:00:00+0900",
  "updated": "2026-04-15 09:00:00+0900",
  "configs": [
    {
      "name": "identifier",
      "protected": false,
      "value": "email",
      "type": "string",
      "subtype": null,
      "required": true,
      "display_name": "Identifier",
      "description": "Account match identifier (login or email)",
      "default_value": null,
      "min": null,
      "max": null
    },
    {
      "name": "create_user",
      "protected": false,
      "value": true,
      "type": "boolean",
      "subtype": null,
      "required": true,
      "display_name": "Create user",
      "description": "Automatically create a account if there is no matching account",
      "default_value": null,
      "min": null,
      "max": null
    },
    {
      "name": "idp_url",
      "protected": false,
      "value": "https://idp.example.com/saml",
      "type": "string",
      "subtype": null,
      "required": true,
      "display_name": "IdP URL",
      "description": "SAML IdP endpoint",
      "default_value": null,
      "min": null,
      "max": null
    },
    {
      "name": "client_secret",
      "protected": true,
      "value": "",
      "type": "string",
      "subtype": null,
      "required": true,
      "display_name": "Client Secret",
      "description": "",
      "default_value": null,
      "min": null,
      "max": null
    }
  ]
}

code (String): Identity provider code
name (String): Localized display name
path (String): SSO login entry path. This is a relative path based on the web console, not an absolute URL. It always follows the /sso/<code> format
icon (String): Standard Base64-encoded icon image string. It does not have a data: URI prefix. null if no icon is set. The image format (MIME type) is not included in the response
enabled (Boolean): Whether the provider is enabled
description (String): User-supplied description. null if no description is set
created (String): Creation time, in yyyy-MM-dd HH:mm:ssZ format
updated (String): Last update time, in yyyy-MM-dd HH:mm:ssZ format. On installations that use SQLite as the configuration store, this value is not updated and remains fixed at the creation time
configs (Array): Identity provider option specification and current values
- name (String): Option key
- protected (Boolean): Whether the option is protected. When true, the returned value is masked
- value (Object): Current configured value. null if no value is stored
- type (String): Data type. One of string, integer, or boolean
- subtype (String): UI-specific extension component type. null if not specified
- required (Boolean): Whether the option is required
- display_name (String): Localized display name shown in the UI
- description (String): Localized description shown in the UI
- default_value (String): Default value. null if subtype is enum
- selectable (String): List of selectable values. Included only when subtype is enum
- min (Number): Minimum value constraint. null if there is no constraint
- max (Number): Maximum value constraint. null if there is no constraint

identifier and create_user at the front of the option list are required options that Sonar adds in common, regardless of the identity provider type. See Get Identity Provider Factory Configurations for what these two options mean.

A protected option's value is masked as an empty string in the response when a value is stored, and returned as null when no value is stored. The actual stored value is never included in the response under any circumstances. Because Update Identity Provider treats configs as a full replacement rather than a partial merge, sending this retrieval response back unchanged as an update request overwrites the stored protected value with an empty string.

Note

To preserve a protected option's value, resend the actual value in the update request. Sending back the masked value from the retrieval response overwrites the stored value with an empty string.

Retrieving an identity provider that is registered but has no stored configuration is not an error. The response returns enabled as false, description, created, and updated as null, and value as null for each option.

Error Responses

Provider does not exist

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "provider not found: saml"
}

Permission denied

HTTP status code 500

{
  "error_code": "illegal-state",
  "error_msg": "no-permission"
}

The identity provider lookup is performed before the permission check, so an account without the SSO view permission receives the provider not found error first when requesting an unregistered code, rather than a permission error.