Skip to content
Start here

List Access identity providers

zero_trust.identity_providers.list(IdentityProviderListParams**kwargs) -> SyncV4PagePaginationArray[IdentityProviderListResponse]
GET/{accounts_or_zones}/{account_or_zone_id}/access/identity_providers

Lists all configured identity providers.

Security
API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
Accepted Permissions (at least one required)
Access: Organizations, Identity Providers, and Groups WriteAccess: Organizations, Identity Providers, and Groups Read
ParametersExpand Collapse
account_id: Optional[str]

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

zone_id: Optional[str]

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

page: Optional[int]

Page number of results.

per_page: Optional[int]

Number of results per page.

scim_enabled: Optional[str]

Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

ReturnsExpand Collapse
One of the following:
class AzureAD:
config: Config

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

claims: Optional[List[str]]

Custom claims

client_id: Optional[str]

Your OAuth Client ID

client_secret: Optional[str]

Your OAuth Client Secret

conditional_access_enabled: Optional[bool]

Should Cloudflare try to load authentication contexts from your account

directory_id: Optional[str]

Your Azure directory uuid

email_claim_name: Optional[str]

The claim name for email in the id_token response.

prompt: Optional[Literal["login", "select_account", "none"]]

Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.

One of the following:
"login"
"select_account"
"none"
support_groups: Optional[bool]

Should Cloudflare try to load groups from your account

name: str

The name of the identity provider, shown to users on the login page.

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

One of the following:
"onetimepin"
"azureAD"
"saml"
"centrify"
"facebook"
"github"
"google-apps"
"google"
"linkedin"
"oidc"
"okta"
"onelogin"
"pingone"
"yandex"
id: Optional[str]

UUID.

maxLength36
scim_config: Optional[IdentityProviderSCIMConfig]

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: Optional[bool]

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior: Optional[Literal["automatic", "reauth", "no_action"]]

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no_action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following:
"automatic"
"reauth"
"no_action"
scim_base_url: Optional[str]

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision: Optional[bool]

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret: Optional[str]

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.

user_deprovision: Optional[bool]

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

class AccessCentrify:
config: AccessCentrifyConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

centrify_account: Optional[str]

Your centrify account url

centrify_app_id: Optional[str]

Your centrify app id

claims: Optional[List[str]]

Custom claims

client_id: Optional[str]

Your OAuth Client ID

client_secret: Optional[str]

Your OAuth Client Secret

email_claim_name: Optional[str]

The claim name for email in the id_token response.

name: str

The name of the identity provider, shown to users on the login page.

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

One of the following:
"onetimepin"
"azureAD"
"saml"
"centrify"
"facebook"
"github"
"google-apps"
"google"
"linkedin"
"oidc"
"okta"
"onelogin"
"pingone"
"yandex"
id: Optional[str]

UUID.

maxLength36
scim_config: Optional[IdentityProviderSCIMConfig]

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: Optional[bool]

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior: Optional[Literal["automatic", "reauth", "no_action"]]

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no_action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following:
"automatic"
"reauth"
"no_action"
scim_base_url: Optional[str]

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision: Optional[bool]

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret: Optional[str]

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.

user_deprovision: Optional[bool]

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

class AccessFacebook:

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

client_id: Optional[str]

Your OAuth Client ID

client_secret: Optional[str]

Your OAuth Client Secret

name: str

The name of the identity provider, shown to users on the login page.

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

One of the following:
"onetimepin"
"azureAD"
"saml"
"centrify"
"facebook"
"github"
"google-apps"
"google"
"linkedin"
"oidc"
"okta"
"onelogin"
"pingone"
"yandex"
id: Optional[str]

UUID.

maxLength36
scim_config: Optional[IdentityProviderSCIMConfig]

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: Optional[bool]

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior: Optional[Literal["automatic", "reauth", "no_action"]]

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no_action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following:
"automatic"
"reauth"
"no_action"
scim_base_url: Optional[str]

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision: Optional[bool]

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret: Optional[str]

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.

user_deprovision: Optional[bool]

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

class AccessGitHub:

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

client_id: Optional[str]

Your OAuth Client ID

client_secret: Optional[str]

Your OAuth Client Secret

name: str

The name of the identity provider, shown to users on the login page.

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

One of the following:
"onetimepin"
"azureAD"
"saml"
"centrify"
"facebook"
"github"
"google-apps"
"google"
"linkedin"
"oidc"
"okta"
"onelogin"
"pingone"
"yandex"
id: Optional[str]

UUID.

maxLength36
scim_config: Optional[IdentityProviderSCIMConfig]

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: Optional[bool]

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior: Optional[Literal["automatic", "reauth", "no_action"]]

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no_action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following:
"automatic"
"reauth"
"no_action"
scim_base_url: Optional[str]

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision: Optional[bool]

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret: Optional[str]

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.

user_deprovision: Optional[bool]

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

class AccessGoogle:
config: AccessGoogleConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

claims: Optional[List[str]]

Custom claims

client_id: Optional[str]

Your OAuth Client ID

client_secret: Optional[str]

Your OAuth Client Secret

email_claim_name: Optional[str]

The claim name for email in the id_token response.

name: str

The name of the identity provider, shown to users on the login page.

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

One of the following:
"onetimepin"
"azureAD"
"saml"
"centrify"
"facebook"
"github"
"google-apps"
"google"
"linkedin"
"oidc"
"okta"
"onelogin"
"pingone"
"yandex"
id: Optional[str]

UUID.

maxLength36
scim_config: Optional[IdentityProviderSCIMConfig]

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: Optional[bool]

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior: Optional[Literal["automatic", "reauth", "no_action"]]

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no_action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following:
"automatic"
"reauth"
"no_action"
scim_base_url: Optional[str]

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision: Optional[bool]

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret: Optional[str]

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.

user_deprovision: Optional[bool]

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

class AccessGoogleApps:
config: AccessGoogleAppsConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

apps_domain: Optional[str]

Your companies TLD

claims: Optional[List[str]]

Custom claims

client_id: Optional[str]

Your OAuth Client ID

client_secret: Optional[str]

Your OAuth Client Secret

email_claim_name: Optional[str]

The claim name for email in the id_token response.

name: str

The name of the identity provider, shown to users on the login page.

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

One of the following:
"onetimepin"
"azureAD"
"saml"
"centrify"
"facebook"
"github"
"google-apps"
"google"
"linkedin"
"oidc"
"okta"
"onelogin"
"pingone"
"yandex"
id: Optional[str]

UUID.

maxLength36
scim_config: Optional[IdentityProviderSCIMConfig]

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: Optional[bool]

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior: Optional[Literal["automatic", "reauth", "no_action"]]

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no_action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following:
"automatic"
"reauth"
"no_action"
scim_base_url: Optional[str]

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision: Optional[bool]

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret: Optional[str]

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.

user_deprovision: Optional[bool]

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

class AccessLinkedin:

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

client_id: Optional[str]

Your OAuth Client ID

client_secret: Optional[str]

Your OAuth Client Secret

name: str

The name of the identity provider, shown to users on the login page.

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

One of the following:
"onetimepin"
"azureAD"
"saml"
"centrify"
"facebook"
"github"
"google-apps"
"google"
"linkedin"
"oidc"
"okta"
"onelogin"
"pingone"
"yandex"
id: Optional[str]

UUID.

maxLength36
scim_config: Optional[IdentityProviderSCIMConfig]

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: Optional[bool]

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior: Optional[Literal["automatic", "reauth", "no_action"]]

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no_action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following:
"automatic"
"reauth"
"no_action"
scim_base_url: Optional[str]

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision: Optional[bool]

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret: Optional[str]

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.

user_deprovision: Optional[bool]

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

class AccessOIDC:
config: AccessOIDCConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

auth_url: Optional[str]

The authorization_endpoint URL of your IdP

certs_url: Optional[str]

The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens

claims: Optional[List[str]]

Custom claims

client_id: Optional[str]

Your OAuth Client ID

client_secret: Optional[str]

Your OAuth Client Secret

email_claim_name: Optional[str]

The claim name for email in the id_token response.

pkce_enabled: Optional[bool]

Enable Proof Key for Code Exchange (PKCE)

scopes: Optional[List[str]]

OAuth scopes

token_url: Optional[str]

The token_endpoint URL of your IdP

name: str

The name of the identity provider, shown to users on the login page.

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

One of the following:
"onetimepin"
"azureAD"
"saml"
"centrify"
"facebook"
"github"
"google-apps"
"google"
"linkedin"
"oidc"
"okta"
"onelogin"
"pingone"
"yandex"
id: Optional[str]

UUID.

maxLength36
scim_config: Optional[IdentityProviderSCIMConfig]

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: Optional[bool]

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior: Optional[Literal["automatic", "reauth", "no_action"]]

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no_action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following:
"automatic"
"reauth"
"no_action"
scim_base_url: Optional[str]

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision: Optional[bool]

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret: Optional[str]

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.

user_deprovision: Optional[bool]

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

class AccessOkta:
config: AccessOktaConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

authorization_server_id: Optional[str]

Your okta authorization server id

claims: Optional[List[str]]

Custom claims

client_id: Optional[str]

Your OAuth Client ID

client_secret: Optional[str]

Your OAuth Client Secret

email_claim_name: Optional[str]

The claim name for email in the id_token response.

okta_account: Optional[str]

Your okta account url

name: str

The name of the identity provider, shown to users on the login page.

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

One of the following:
"onetimepin"
"azureAD"
"saml"
"centrify"
"facebook"
"github"
"google-apps"
"google"
"linkedin"
"oidc"
"okta"
"onelogin"
"pingone"
"yandex"
id: Optional[str]

UUID.

maxLength36
scim_config: Optional[IdentityProviderSCIMConfig]

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: Optional[bool]

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior: Optional[Literal["automatic", "reauth", "no_action"]]

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no_action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following:
"automatic"
"reauth"
"no_action"
scim_base_url: Optional[str]

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision: Optional[bool]

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret: Optional[str]

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.

user_deprovision: Optional[bool]

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

class AccessOnelogin:
config: AccessOneloginConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

claims: Optional[List[str]]

Custom claims

client_id: Optional[str]

Your OAuth Client ID

client_secret: Optional[str]

Your OAuth Client Secret

email_claim_name: Optional[str]

The claim name for email in the id_token response.

onelogin_account: Optional[str]

Your OneLogin account url

name: str

The name of the identity provider, shown to users on the login page.

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

One of the following:
"onetimepin"
"azureAD"
"saml"
"centrify"
"facebook"
"github"
"google-apps"
"google"
"linkedin"
"oidc"
"okta"
"onelogin"
"pingone"
"yandex"
id: Optional[str]

UUID.

maxLength36
scim_config: Optional[IdentityProviderSCIMConfig]

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: Optional[bool]

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior: Optional[Literal["automatic", "reauth", "no_action"]]

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no_action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following:
"automatic"
"reauth"
"no_action"
scim_base_url: Optional[str]

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision: Optional[bool]

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret: Optional[str]

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.

user_deprovision: Optional[bool]

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

class AccessPingone:
config: AccessPingoneConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

claims: Optional[List[str]]

Custom claims

client_id: Optional[str]

Your OAuth Client ID

client_secret: Optional[str]

Your OAuth Client Secret

email_claim_name: Optional[str]

The claim name for email in the id_token response.

ping_env_id: Optional[str]

Your PingOne environment identifier

name: str

The name of the identity provider, shown to users on the login page.

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

One of the following:
"onetimepin"
"azureAD"
"saml"
"centrify"
"facebook"
"github"
"google-apps"
"google"
"linkedin"
"oidc"
"okta"
"onelogin"
"pingone"
"yandex"
id: Optional[str]

UUID.

maxLength36
scim_config: Optional[IdentityProviderSCIMConfig]

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: Optional[bool]

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior: Optional[Literal["automatic", "reauth", "no_action"]]

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no_action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following:
"automatic"
"reauth"
"no_action"
scim_base_url: Optional[str]

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision: Optional[bool]

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret: Optional[str]

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.

user_deprovision: Optional[bool]

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

class AccessSAML:
config: AccessSAMLConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

attributes: Optional[List[str]]

A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.

email_attribute_name: Optional[str]

The attribute name for email in the SAML response.

header_attributes: Optional[List[AccessSAMLConfigHeaderAttribute]]

Add a list of attribute names that will be returned in the response header from the Access callback.

attribute_name: Optional[str]

attribute name from the IDP

header_name: Optional[str]

header that will be added on the request to the origin

idp_public_certs: Optional[List[str]]

X509 certificate to verify the signature in the SAML authentication response

issuer_url: Optional[str]

IdP Entity ID or Issuer URL

sign_request: Optional[bool]

Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.

sso_target_url: Optional[str]

URL to send the SAML authentication requests to

name: str

The name of the identity provider, shown to users on the login page.

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

One of the following:
"onetimepin"
"azureAD"
"saml"
"centrify"
"facebook"
"github"
"google-apps"
"google"
"linkedin"
"oidc"
"okta"
"onelogin"
"pingone"
"yandex"
id: Optional[str]

UUID.

maxLength36
scim_config: Optional[IdentityProviderSCIMConfig]

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: Optional[bool]

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior: Optional[Literal["automatic", "reauth", "no_action"]]

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no_action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following:
"automatic"
"reauth"
"no_action"
scim_base_url: Optional[str]

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision: Optional[bool]

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret: Optional[str]

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.

user_deprovision: Optional[bool]

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

class AccessYandex:

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

client_id: Optional[str]

Your OAuth Client ID

client_secret: Optional[str]

Your OAuth Client Secret

name: str

The name of the identity provider, shown to users on the login page.

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.

One of the following:
"onetimepin"
"azureAD"
"saml"
"centrify"
"facebook"
"github"
"google-apps"
"google"
"linkedin"
"oidc"
"okta"
"onelogin"
"pingone"
"yandex"
id: Optional[str]

UUID.

maxLength36
scim_config: Optional[IdentityProviderSCIMConfig]

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

enabled: Optional[bool]

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior: Optional[Literal["automatic", "reauth", "no_action"]]

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no_action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.

One of the following:
"automatic"
"reauth"
"no_action"
scim_base_url: Optional[str]

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision: Optional[bool]

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret: Optional[str]

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.

user_deprovision: Optional[bool]

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

List Access identity providers

import os
from cloudflare import Cloudflare

client = Cloudflare(
    api_token=os.environ.get("CLOUDFLARE_API_TOKEN"),  # This is the default and can be omitted
)
page = client.zero_trust.identity_providers.list(
    account_id="account_id",
)
page = page.result[0]
print(page)
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "config": {
        "claims": [
          "email_verified",
          "preferred_username",
          "custom_claim_name"
        ],
        "client_id": "<your client id>",
        "client_secret": "<your client secret>",
        "conditional_access_enabled": true,
        "directory_id": "<your azure directory uuid>",
        "email_claim_name": "custom_claim_name",
        "prompt": "login",
        "support_groups": true
      },
      "name": "Widget Corps IDP",
      "type": "onetimepin",
      "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
      "scim_config": {
        "enabled": true,
        "identity_update_behavior": "automatic",
        "scim_base_url": "scim_base_url",
        "seat_deprovision": true,
        "secret": "secret",
        "user_deprovision": true
      }
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
Returns Examples
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "config": {
        "claims": [
          "email_verified",
          "preferred_username",
          "custom_claim_name"
        ],
        "client_id": "<your client id>",
        "client_secret": "<your client secret>",
        "conditional_access_enabled": true,
        "directory_id": "<your azure directory uuid>",
        "email_claim_name": "custom_claim_name",
        "prompt": "login",
        "support_groups": true
      },
      "name": "Widget Corps IDP",
      "type": "onetimepin",
      "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
      "scim_config": {
        "enabled": true,
        "identity_update_behavior": "automatic",
        "scim_base_url": "scim_base_url",
        "seat_deprovision": true,
        "secret": "secret",
        "user_deprovision": true
      }
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}