Summary

The oidcIdentityProvider() GraphQL query returns information on an OIDC identity provider.

API Stability Long-Term

Syntax

graphql
oidcIdentityProvider(
      id: String!
   ): OidcIdentityProvider!

Provide id (required) — the unique identifier for the OIDC identity provider. Select Show Identity Providers Query below for an example of how to retrieve an identity provider ID.

Returns a non-nullable OidcIdentityProvider object. See the Returned Values section for available fields.

Hide Query Example

Show Identity Providers Query

Example

Raw
graphql
query {
  oidcIdentityProvider(id: "1234") 
  {id, name, domains, issuer, 
   authenticationMethod{ authType }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  oidcIdentityProvider(id: \"1234\") 
  {id, name, domains, issuer, 
   authenticationMethod{ authType }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  oidcIdentityProvider(id: \"1234\") 
  {id, name, domains, issuer, 
   authenticationMethod{ authType }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  oidcIdentityProvider(id: \"1234\")  ^
  {id, name, domains, issuer,  ^
   authenticationMethod{ authType } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  oidcIdentityProvider(id: \"1234\") 
  {id, name, domains, issuer, 
   authenticationMethod{ authType }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  oidcIdentityProvider(id: \"1234\") 
  {id, name, domains, issuer, 
   authenticationMethod{ authType }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  oidcIdentityProvider(id: \"1234\") 
  {id, name, domains, issuer, 
   authenticationMethod{ authType }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  oidcIdentityProvider(id: \"1234\") 
  {id, name, domains, issuer, 
   authenticationMethod{ authType }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "oidcIdentityProvider": {
      "id": "abc123",
      "name": "The Company",
      domains: ["humio"],
      issuer: "https://my.oidc-idp.com",
      "authenticationMethod": {
        "name": "SAMLAuthentication"
      },
    }
  }
}

Returned Values

Returns a non-nullable OidcIdentityProvider object. Identity fields include id and name. OIDC configuration fields include clientId, issuer (the OIDC issuer URL), scopes, userClaim (the claim used to identify the user), and groupsClaim (nullable — the claim used to sync groups). Endpoint fields (all nullable) include userInfoEndpoint, tokenEndpoint, authorizationEndpoint, and jwksEndpoint (the JSON Web Key Set endpoint). Behavior flags include defaultIdp (whether this is the default identity provider), humioManaged (LogScale manages authentication internally), lazyCreateUsers (just-in-time user provisioning on first login), and debug. The table below lists all fields:

Table: OidcIdentityProvider Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Jun 26, 2025 
authenticationMethodAuthenticationMethodAuthyes Long-Term The authentication method used. See AuthenticationMethodAuth.
authorizationEndpointstring  Long-Term A URL to the endpoint a user should be redirected to when authorizing.
clientIdstringyes Long-Term The unique identifier for the client.
clientSecretstringyes Long-Term The password for the client.
debugbooleanyes Long-Term Whether debugging is enabled.
defaultIdpbooleanyes Long-Term Whether the identity provider is the default.
domains[string]yes Long-Term The domains authorized by the OIDC identity providers.
federatedIdpstring  Long-Term The Federated IdP.
groupsClaimstring  Long-Term The name of the claim to interpret as the groups in LogScale. The value in the claim must be an array of strings. Optional. Defaults to humio-groups.
humioManagedbooleanyes Long-Term Whether authentication is managed by LogScale.
idstringyes Long-Term The unique identifier for the OIDC identity provider.
issuerstringyes Long-Term The issuer of the OIDC authentication.
jwksEndpointstring  Long-Term A URL to the JWKS endpoint for retrieving keys for validating tokens. Required.
lazyCreateUsersbooleanyes Long-Term Whether to wait to create users until necessary.
namestringyes Long-Term The name of the OIDC identity provider.
registrationEndpointstring  Long-Term To use OIDC as a client, PUBLIC_URL must be set, LogScale must be registered as a client with your OpenID provider, and the provider must allow %PUBLIC_URL%/auth/oidc as a valid redirect endpoint for the client.
scopeClaimstring  Long-Term The scope claim.
scopes[string]yes Long-Term Comma-separated list of scopes to add in addition to the default requested scopes (openid, email, and profile).
tokenEndpointstring  Long-Term A URL to the token endpoint used to exchange a authentication code to an access token. Required for clients.
tokenEndpointAuthMethodstringyes Long-Term A URL to the token endpoint used to exchange a authentication code to an access token. Required for clients.
userClaimstringyes Long-Term The name of the claim to interpret as username in LogScale. The value in the claim must be a string. Defaults to humio-user. Can be set to email if using emails as usernames.
userInfoEndpointstring  Long-Term A URL to the user info endpoint used to retrieve user information from an access token.