> ## Documentation Index > Fetch the complete documentation index at: https://support.appgate.com/llms.txt > Use this file to discover all available pages before exploring further. # List all Identity Providers > List all Identity Providers visible to current user. ## OpenAPI ````json GET /identity-providers { "openapi": "3.0.0", "info": { "title": "AppGate SDP Controller REST API", "version": "API version 24.0", "license": { "name": "Proprietary", "url": "https://www.appgate.com" }, "description": "# About\n This specification documents the REST API calls for the AppGate SDP Controller.\n\n Please refer to the REST API chapter in the manual or contact AppGate support with any questions about\n this functionality.\n# Getting Started\n Requirements for API scripting:\n - Access to the Admin/API TLS Connection (default port 8443) of a Controller appliance.\n (https://support.appgate.com/docs/adminapi-tls-connection-v6-6)\n - An API user with relevant permissions.\n (https://support.appgate.com/docs/configure-admin-roles-v6-6)\n - In order to use the simple login API, Admin MFA must be disabled or the API user must be excluded.\n (https://support.appgate.com/docs/mfa-for-admins-v6-6)\n# Base path\n HTTPS requests must be sent to the Admin Interface hostname and port, with **/admin** path.\n\n For example: **https://appgate.company.com:8443/admin**\n\n All requests must have the **Accept** header as:\n\n **application/vnd.appgate.peer-v24+json**\n\n An exception is made for the **/admin/version** endpoint which instead expects an **application/json** Accept header.\n# API Conventions\n API conventions are important to understand and follow strictly.\n\n - While updating objects (via PUT), entire object must be sent with all fields.\n - For example, in order to add a remedy method to the condition below:\n ```\n {\n \"id\": \"12699e27-b584-464a-81ee-5b4784b6d425\",\n \"name\": \"Test\",\n \"notes\": \"Making a point\",\n \"tags\": [\"test\", \"tag\"],\n \"expression\": \"return true;\",\n \"remedyMethods\": []\n }\n ```\n - send the entire object with updated and non-updated fields:\n ```\n {\n \"id\": \"12699e27-b584-464a-81ee-5b4784b6d425\",\n \"name\": \"Test\",\n \"notes\": \"Making a point\",\n \"tags\": [\"test\", \"tag\"],\n \"expression\": \"return true;\",\n \"remedyMethods\": [{\"type\": \"DisplayMessage\", \"message\": \"test message\"}]\n }\n ```\n\n - In case Controller returns an error (non-2xx HTTP status code), response body is JSON.\n The \"message\" field contains information about the error.\n HTTP 422 \"Unprocessable Entity\" has extra `errors` field to list all the issues with specific fields.\n\n - Empty string (\"\") is considered a different value than \"null\" or field being omitted from JSON.\n Omitting the field is recommended if no value is intended.\n Empty string (\"\") will be almost always rejected as invalid value.\n\n - There are common pattern between many objects:\n - **Configuration Objects**: There are many objects with common fields, namely \"id\", \"name\", \"notes\", \"created\"\n and \"updated\". These entities are listed, queried, created, updated and deleted in a similar fashion.\n - **Distinguished Name**: Users and Devices are identified with what is called Distinguished Names, as used in\n LDAP. The distinguished format that identifies a device and a user combination is\n \"CN=\\,CN=\\,OU=\\\". Some objects have the\n \"userDistinguishedName\" field, which does not include the CN for Device ID.\n This identifies a user on every device.", "x-logo": { "url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAdcAAADMCAYAAAAh4uktAAAa1UlEQVR4nO3debgkVXmA8fcOAzOAwOAgIpHFQQbcARGXCEhEE0MkGkAF0RDF3UQTjRuKC0lcYtRozKIIAaNRk6CgUYkbAY0LsqmDIMKAuAEDjMAA4yydP75pvNPTt+ur6lPdfe+8v+ep55Gx69RXfavrVJ3lOyBJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJUrumxh3AHHQ8cGTFZ94BXDyCWLR52wp4ILAvsDewI7AI2BZYs2FbAfwMWA58b8P/1vCOAJ4KvB24bsyxSLPeFHAV0KnYPjKuADXnHQi8EfgqcBfV12LvdgPwSeBEYOcRxz6XPJ34PlcDHwL2HGs00ix3KLkb2O3AvcYUo+aeXYDXA5dTvzIdtK0FzgWOAeaP7Gzmhm7l2t1+DZwKLBlnUNJsdQb5G9fzxhSj5o49gH+g2Rtq3e064OVEU7Oq9Vau3W0NcDrRXC8pYQdgFfmb1dfHE6bmgG2JvrzVtF+p9m7LgaPaP8VZb6bKdXole/LYopNmkRdR/0a171gi1Wz2FOBaRl+p9m6fBe7X7qnOalWVawc4Z2zRSbPIt6l/g3rXWCLVbLQlcb2sZ/wVa3e7Efj9Nk96FrNylQp4KM1uTr8gbprSIIuBCxh/ZdpvWwf8ZXunPmtZuW7m5o07gDni+Q332wWf/DXYbsD5wOPHHcgM5hFv1B/EefPSPRxeP7ytiMQRTT0fOLtQLJpb9iAq1t2HKOMO4FvAD4k52LcSo4u3JBJK7AQ8DHgksNcQx3nphjK7Yw8kaShHM1yz2hocGKJN7QRcQbNragXwAeJtt84D9C7AnxIj2Zv27TqOINgsLA3p8wzfb/XakUetSbaQZgPklgMv2bD/sB4B/BfNKtkXFTj+bGflKg3h/kQWm2Er1yuxv0q/8UHqXT93EnMmS1SqvQ4ALqkZz91EGsbNmZXrZs4+1+GcAGxRoJylRBPeBQXKatNuwIOJeHclkhksIJJn3Elk8bmSSAC/cjwhpi0gRnkvJZLab0v0Qa4HfkX0TV5F9FVeueHfR+EYov8y63LgGcCydsLhYuAg4CQiZ3Hmel8AfIJ4+13VUly97k30He9DXKf3ArYhKvpVwE+Jv+My4JcFj7s98Kw+/75fYt89gBf2+febiVaDNmwFPIT4nvYmvqdFxKjv24Bb+M11/yNGd91L95gCrqb66fR84mZd9bnTRxt+yhbA7xI5Ua8h/+ayjrgpv4vcTWZUdgVeDXyZeBjIns/NwFnEw9R2Lca3GLipRlxnExXIqBxJDJDKxveeluN5JPBu4FLimsvG9UOideAQhm8xemCN42a3S4aMqdd9gVcQeaLr/P1WAP8JPBdzoWuEDiN3gT4T+OfE5+6g3Rt3HTsCbyKWHytxs7gM+GPGN6f3EOBzlGnCX0U8bCxtIc4P1YjjDMbT8vQo4u0mE+Nayj9cbUXk5f5BMoaq7Rrgz4mWiyYmuXJ9DPBpYtDksDHdAXwYcyJrBD5K9QV5M9FEdlDisx1ima9xWkA0/d1G+RtGhxhwc/TIziZu7OcXPofuto6o4HYpFOsB5N++zqJMd0RTB5NfLOALBY97LNH10Mbf80bgZdT/Xiexcn0Q8Zbaxve0FjgNlyNUSxaRa1Z8/7R9vpf4/DdHEn1/jyP6pNr4QfZu5wK/1eK5LAD+jjJP7FXbSvr3m9V1VvJ4F9HOwKW6jiE/kvjgIY+1O9GUP4pr87tEX3zWJFWu84FTGM2CDrfgyl5qwUvIXYD7Tdvnlcl9HjyC+KebAl7DaCqi6dtNRBL60vYibpCjPJcOscD49g1jfgi5t9ZfMVnNctlm7GGSpPwB0fc3yr/lKvIVx6RUrrsR85NHfd3/G/bHqqALqb7ovtuzz07EyMWq/d7dfvj3mE8MpBr1D7K7raXsnMhHEc174zqfS2jWTJzpk+8QCR4myXZEU39V3OuIkal1vZx6A5VKb++gesDTJFSuD6Xc+Igm24XYTKwCHkHugus3neJTif1uYDQDf7YEPpOIZxRbiSQahwC3T8C5XE3Mf85aSG6A0KWMt591Jg8imoirtrqpFU9i/H/LDvF2PqiCHXfleiD5AWZtbj/CTHMa0t9TfaHdRYy47fW7iX07wB+1egZxszgzGcsotvXAC4Y4n/2Ivs9xn0d3W0bMu8w4Jllm29fEJMl2u4xqe+eAWMdZuS5lvC01vdtlxHgUYVaguhYQzS+LKz73ceDZff59HtGMVpWI/b+Jvqa2nAy8teG+1wNfIvLeriCG6O9IzCF9KDF4pUkT0TrgScDXau63M3Ez2rXBMdcA/0sMErqOqKDnE+ezlBjlfQDN3hi/CjyZOK9BzgSeU/GZK4m++M1hQv+TiRHGTVbsWk0kYvk+0QJ0K7ADcB/iDftx5B96ep0IfKTPvy+m/5J7S4ksTYP8mP7JIn5BPMQPsgNx3TZZbGE1kV7zm0RCjRXENb4TkdjiccQDa5Pr/lxipa/N4VpVQc8g9wT3xAFlvDWx/1raG017GPXne94OvJ2oaKpMAYcSTeB189L+nJjwnjWPZlMOvk5M61iUOMZ9iAn41zc4TuYBJlPu5pJ7eleiUqzzHa8nujeOpnpgzTyi++BM6v8G7iQyQGW1nf7wP2rG3wG+ARxHbrT5jsCf0WzxiJOGOC9tpjI38msY/NS9J7lBGm9oIf5tgGsTx+5uvyZWV2k6WOFA6k+h+FSN8l9cs+xlRJahJrYmRlXfWuN4a4H9B5S5d6KM9cRI0M3B2dT7e55HJEpo4iFE5VbneBeRf5trs3I9tmbcVxNdUk1MEW/tdfp111DvQUSbud3JVYonJ8r6UqKcqyjfbP/2xHG7203EG+iwpoDXUW/UZ+ZGsDP1fvBnUmZ+6BKi2TF73G8y88NWpr/18gIxzwZPJf+drqPc2/wJ5Ebxd7fsiO22KtftiRaebLz/SpkUmfclulCyx70Aux2VdDK5H31mYevsk2eJyq1rV/JZdZYBDyh4bIib56rk8S+m+of5nmRZHeKNs6TtiHSK2ePPNBjpjYl9/6lw7JNoHvEQkfkubweOKHz8x5Jvjl5Bbl5nW5XrW5Jxdoh7VskKbgHw7zWO/7SCx9Yc1R2IVHUxfTFZ3kIiNWJVeWcUO4PIWJT5QfyS3ANCE0eT74cddAO9D/kE5H/TwnlANBNn11y9iP43uUwKzZe1FP8kOYrc97iO9gb6HUT+4fNVifLaqFy3I3ff6BC/9zbMJ+5zmRgubCkGzSFPJHcxPaNGmR9IlLeKGBU4rG3IrcxzF/EU36ZMC0CHwQ8qr0uW8WmajTrNuh+xlFkmlt/us3/mJvWkFuOfFNnmxle3HMdx5B7+rqX6umqjcn1poswOMdq6zTnROxDzWpte99I9Pk71RbSCaDbJ2i9RZocyGYyOSx7rrwocq8o8otm3Kpa1zDy9JtOEuJKYWtC2pyVi6QD/0mffbyT2GzQgai5YQq5CO39E8XwsEUuHGHU/SBuV67cSZa4iptO07fBELB0i+5jU147kmouq5qX1c1Gi3G8PFz6Qy8R0I81z49aV/WH2axJ9WHLf17d6Bhu7IBHPCjZ927kssd8k5RJuw2up/g7WA48eUTwPIDfAqaovvHTlumeivA7w5hplDiuz2ES/636zMI71IGeb7Lyw0xqU/RGq544eRCRn+EGD8iGahw5NfO5dxFJzo/BlIllE1dP/E4lFrXv/rcpNwPvqh9XYSUTT5iCLidSZl0z7t05rEeU9jJj0PyqfZeMR0Jm/5zmUecjMWE6kPKwaFZyJu6TfSXzm18A/th3INO+lOlHGYqL15aL2w9Fsk3m7bNpxv4jc0nXvbRx9VN6ZN4O2BjHN5IWJuFb02S/ztHxqy7H3miLX9/rKnv0yb7xtNwt/IhFDye0Ppx17PrkR5HXGMpTw6ERMHQYnein95npGorw6c8RL+WEirr8YQ1xjt1m+rtewP7msRE3eWiH6Bc9KfO54YKuGx3hI4jMXAz9pWH5T51CdIm0xm64yk1lrc5glzproJI/Z+7e4PbHPfeqHk7aY0U+XuHHa/15C9RzM1eRH4ZdyITGXtEqddV+HlTlWNk91yW3fQrHPOVaug2XWdLyLmPvVVL98pb12onlmoX0Snzm3YdnD+CXR51hlevxbUT3/dh3R7Dxqme+w92/xiwb7lHQ89QbhlXDDtP+dObdvMLruiq71NPt7tmWKyFU8W2Uq4DnHynVmC4n+1ipnEW+gTZ1HpEyskl28uVdmGagfNix7WJnsQ9PfXHeiepzAtcQDz6hlvsPet/ArE/u0+dTf9Jpqai2x8EVXZrGFcWWoWpb4TJPFIprYntm9IPmovqeJ4oCmmT2d3Aoa05uE9yRW9ahrOdFENsiTiXVCf1qz7MyP8qaaZZZyY/VHNhrBvF2hMttwQ/VHNon/isQ+T6gfSsqjgIe3VPZMriCaebsy1+YvW4qlxHFHNbo+c91PstkefyNWrjPLPNVfw8ZLpL2GWIuyDVsQeVDrzkXN5BW9u3Y0ZWTeMKeP1M6cy+rqj7Qi8x1u3fPfFyf2WUo0hS+vHdFgzy9cXkZvN0Dv99HPuK7NOxOf2bb1KELme5pkJXIbzzo2C/e3J7mh76cTnfoQP4Bj2wpogz+hfq7QzOdHdZPolXlzWTXtf2fOZVw/5Mx3eEfPf/+U3Ntrv7WBh7EN8KzCZWZ8o+e/MxXYuCqWzN9zVInpM9/TJJvt8Tdi5drfCVR/N+vYOPfvUeTWBx3GEtppJmxr7dgq9098pu5glkyZbWh6Ll9J7HcCZdPZHU2ZtJp1faHnv3sfNvoZV3/dJPUTZkaVT7Jbxx3AONgsvKl5xM2sypeIha67RtXM9nw2boouYdR9b3WOW3eK0P2IgU/95si2KXMu1/f5t89QnZx/L2Ku5zCj0qdbSeRnLmE+8CaqRx1fTgw2m67f99FrXOuCTtJ6pLcRucHH8UBUQukujVnBynVTh5PLzTl9INMDKbs83CB/RLwhryxY5hHk16ksZR9yqf0yI2qnmyLOp+SKQhmZ1Vr6nctXiQeIqiQeJwP/RWThGdY5NF+ou9fLyU3n6fdgkPnbPoYYWHhLnaCGtAXNFxdvy5VEtrZB7mY8I+WrfH/cAWgyZDLW3MTGN5S/TuxTcqszaCq77ugjapRZQianbO8TbybbVIdcYo6StiIedqrimql145TEvh3KLRBeyr3JLYG2hv5dD1uQW63pOW2eRB8HJ2LqAGcOKKN0hqZTE+WNOtmGlLaYXNLu903bZz4xd2+UlWuddIvZyvU9Ncoc1jwiV3JVTKf37JetXO9k0zmlbXpGMq6Zplvdj9ziEKuYrGw32YWzPz2gjM8m9h91kpMPJWIadeV6fKK8dVQnWZHG4k/J/aim98f8QXKf0tsjkueUrVzvYjRLVUH0aWdi6k3ika1cO1SvWlLKluTWtry6opz3J8roEMkqJmHe4CvIxbseOHBAOa9MlpMZvV/CPsSbdiamUVauuxKVZ1WZLvE2Iexz3VhmUNKFbNyHsCXwzsJxvIzqaSrPI25wpSwk5tC23QS3DfC2xOdWMVy/4InEMoCZqS7DeBGwd+JzVYOR3kVcf1VTifYl3gSPYHxzep8E/G3ys2cD3x3w/38KeDfVo6HfSSTUr8pHPay3U+a+uDbxmTqpJ39OrLxUtZLUC4iUqk0XE5GKeyS5p9UXjyCWjyTiyC7Onn1z7W7PLXgevabILTzfAT7aZ/86b64dImlBm2nj9iemk2Te3jJ5aDP90N3tbHJLIZb2++SasDtEF8uDEmV+MVneKQXPo58Tk3Fk3lwPS+z/vZrxnZCM6/tMRuuGBMS6oVUX7Z2MZjj84xOxdMgtxVW3cr0beGy5U9nI65MxrKf/akR1K9cO8ZbXxnzu+wLXJWP4XLLMLYkbY/bcziemHY3KccTbcja+NyfLfXKyvPXAM8ucyiYOpt65VVWueyf2XwvsXCPGhcQbbCa2/6bs3Oiu7Ym34xcmtlE15WuCbU1MdK66YPu9TbVhihh6XxVPZqBH3cq1Q4wALfnDmCLmVWb6jLo3hn6aVK4d4m25ZKafJeQGZHW3Og8r+5N/M+wQc0UPHvaEKmwDfLhGTB3iIaFOs+d3kuXeSfkK9jByo57rVK7zya3V/Iaasb6qRnxnUTZj2b2JReuzx2+SZ11zzLPJXSxV/R0lvS4Rzzqq50c2qVw7xHzKlxY4j62Bj9U87kxr0DatXDvEzbtEJqrDiCb57HE/2eAYmYXke6+Dfya30ERdR5BbEHv69ivqLzN2MPFmmil/PdFvXyL94EuIa67JNTWocoVY+rCqjJXUG+G7EPhxjRi/VbP8mexPDMrLHvc/CxxTc8BXqL5YfszocolCjA7MjFo8uaKcppVrdzuPGEhS1zxicNS1NY83aKDMMJVr96Z/Es2e5vcgbqbZt+8OkVmnaYWemdfYu91K9EsOu8D6FNFycX6DGNYTiU6aOKPmsb5D83Sg+wP/U/N4vVtV5fqKZDk/oF66xafUjHMV0SXTpPVmR2IwWZ0HkNuB3RocS3PMEnJPzCeNIbZMxbicwX2Kw1au3RvmOcRcux0rYt6LaLq6rMFxLmXwIJ1hK9fu9jNiZPSBDH5gWkgM4DmVek213e34AWVXmU+kRmxyfqs37Pss8n1684nv9xTimmr63f55w/OFyDx2TYNjfoHoD15UUf42xBSZT1LvIWmmrapy3ZncvPnuNflM8g/w/9Qg3hVERflwBt8z5hHZoN5HLjlK7/ai5DnMaaN8E5tUbyNyow6yjlgpp+5aqsM6ilzzypOIJqh+Pkc07ZWylhjmfznxY72TGJG7O/GjzYwO7ec24gc9KCXeAcBFDcufyc+J87maGPk7n7hJLyVS7zUdbXwqMfBjGAuJJAuHD1FGh/hOLyfO8Wbiu96GaEbeifibPZLh++feCrxlyDIOIt6Y6/TXdq0hVt75AfFbvYP4++1MJN84mLJ97x+lenT9vxDN/FnXEg8Ly4mWlq5T2Xga0kLg/4g38CZuJpqMbyDWrp1HDFbam/idLW5Y7oepd76ao7Yg8rpWPYl9fkzxbUUs/l0V38cHlFHizbXt7W5yA6hKvbm2vZ1L/O1KWEAuJec4t/XEWsalHE08xI37vKq2qjdXiG6B2wocq9/1tCvDtTKU3r4+Q5zaDP0euYvm6HEFCLx3QFzd7S5mbq6d9Mp1NfGGnjEbKtcLKD+3dh7RF50d8DPK7S7amR5zIpNfwWYqV4iBgcMea6ZKaykxYnzc38X5zN5Ve9SCT1F90dzEeJ/GHjZDXL3bTMuWTXLlejvRpJ016ZXrObS7uPcf0mzKSFvbMtpdrvBo8n2W49iylSsM3/ow6B60O9HsP67v4fOUnfKjWW4ncpPGR5nQfiYXUh3nxTPsm6lc30ezgQvDbJcz85SbmWQq10uISm6U57KOGAjUxqT9XruP4fx6t7XAB2j3QaLrIEbf9HkruSxpdSrXheRmJcy0VT3gLyLmtY76un8nkfxEuscryV1Ak7AKyUvIxdpvcEOmcj2EGDX91eRxhv1BfhDYtsH3kKlczyMG6r2M3HJmw25XM9yAo6aOpN68w1Lb+cB+7Z/eRnYkKrJRNIufSwxePDLx2TqVK0T/+WkN48q0nk0R94qVhb+Tftv1mIFJM/ge1RfQt8cW3cYWkcv28oE++2YrV4gf57NpNh0ie2MetEJKlWzl2rUrMXeyjb67XxHp/Ubx9jaTLYl8s5lsXsNuXyPGKIzTocQiAG2c3xXAMdOO1Ubl2vUX1E+1WKdrahdiucbs6j51tpXE3HpzF6uvR5G7kCZpvlYmy9HNbDpPtE7l2rUl8CfkmqOrtrUbYnjCkOcP9SvXrqXEvMASozavJyrVqvm+o7QFMR/3EzSbjzvTdgPxwDbMA1EbnkIkgCgxV/UC4Fg2bdLPLCXZtHKFyGB1Dvm38SbjPpYA/0iZN9lrialWbWQB0xySmYC9iska/XY4uR/BsT37Nalcp3s4UZl8k/zT9m0bjvtnlF20vGnl2nUvYrGDjxHzILM3lmVEJXM47SwCUNIORIakfyD6teu8td9FVDZvI9I8TvqSlPcn3gI/TwyOy5zjKuIaeS2DVyqaIgaQDUqGMkzl2vVwYsxD1ZTAYQZVLiSu+38lv9jEGiKpyweJ+4M5EWraXL+w11Ndcf6I6B+ZFPOICfpVP7JLiTeYrkwSiUOJJtsqC4k+6CVEerNtiVGCK4mb20+I5rXl5NazrCuTROJ/yb8l70a8QTyAeBPdgUjzdgcxSvxHRJPrLQ1inRQLiDf3fYi3jkXEQ8ZqoqK5g/i7XUXceNteL7Ut84m/475Epbs98fe8jXhouI7o7ug+cGRNEaOW38ymA/AySSTq2IuobB9ANLtO73I4iXhTL2EXfnPdLyauhzXEdX4LcT1cRnRFSZrBsG+uk2TYN1epqXlEn+wVlH1z1Rw16U1ckjQJ1gP/ATyYaGK9arzhaNJNep+KJE2SbiX7GerP09ZmxDdXSaqvO+BH6svKVZKkwqxcJUkqzMpVkqTCrFwlSSrMylWSpMKsXCVJKszKVZKkwqxcJUkqzMpVkqTCrFwlSSrMylWSpMKsXCVJKszKVZKkwqxc5767xx1AQauJJb8kaaJZuc59xwF/DFw+7kAKWAYsBd7P3HpokCTNUvOApwL/B3R6tkPGGFdT9wXeAtzKxudy3vhCkiRtzh4PfJZoYp2tlWvX9sArgJ9h5SpJmgD7Af8OPG7McZSwNfBS4LRxByJJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiRJkiS17f8B39C5qj6jPb0AAAAASUVORK5CYII=", "href": "#" }, "contact": { "name": "AppGate SDP Support", "url": "https://support.appgate.com/docs", "email": "appgatesdp.support@appgate.com" } }, "servers": [ { "url": "https://appgate.company.com:8443/admin" } ], "security": [ { "BearerAuth": [] } ], "x-tagGroups": [ { "name": "Authentication & Authorization", "tags": [ "Version", "Login" ] }, { "name": "Dashboard", "tags": [ "Top Entitlements", "User Logins Per Hour", "Devices On-Boarded Per Hour" ] }, { "name": "Admin Messages", "tags": [ "Admin Messages" ] }, { "name": "Access", "tags": [ "Policies", "Conditions", "Entitlements", "Risk Model", "Ringfence Rules", "Admin Roles", "Criteria Scripts", "Entitlement Scripts" ] }, { "name": "Identity", "tags": [ "Client Profiles", "Identity Providers", "IP Pools", "MFA Providers", "Device Claim Scripts", "User Claim Scripts", "Local Users", "Service Users" ] }, { "name": "System", "tags": [ "Appliances", "Replication Targets", "Sites", "Tags", "Appliance Customizations", "Trusted Certificates", "Secrets Manager", "Client Auto-Update", "Certificate Authority", "Appliance Change", "Appliance Upgrade", "Appliance Backup", "Appliance Metrics" ] }, { "name": "Usage", "tags": [ "Active Sessions", "Client Logs", "Discovered Apps", "Health", "Registered Devices", "Blacklisted Users", "Licensed Users", "Default Time-Based OTP Provider Seeds", "FIDO2 Devices", "Issued Certificates" ] }, { "name": "Settings", "tags": [ "Global Settings", "MFA for Admins", "License", "ZTP", "Replication Source" ] }, { "name": "Other", "tags": [ "Admin Preferences" ] } ], "paths": { "/identity-providers": { "get": { "summary": "List all Identity Providers.", "description": "List all Identity Providers visible to current user.", "tags": [ "Identity Providers" ], "parameters": [ { "$ref": "#/components/parameters/query" }, { "$ref": "#/components/parameters/range" }, { "$ref": "#/components/parameters/orderBy" }, { "$ref": "#/components/parameters/descending" }, { "$ref": "#/components/parameters/filterBy" } ], "responses": { "200": { "description": "List of Identity Providers.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityProviderList" } } } }, "401": { "$ref": "#/components/responses/TokenError" }, "403": { "$ref": "#/components/responses/PermissionError" }, "406": { "$ref": "#/components/responses/responses-NotAcceptableError" }, "500": { "$ref": "#/components/responses/UnexpectedError" } } } } }, "components": { "parameters": { "query": { "name": "query", "in": "query", "description": "Query string to filter the result list. It's used for various fields depending on the object type. Send multiple query parameters to make the queries more specific.", "schema": { "type": "string" } }, "range": { "name": "range", "in": "query", "description": "'Range string to limit the result list. Format: -. 3-10 means the items between the (including) 3rd and the 10th\n will be returned. Defaults to all objects.'", "schema": { "type": "string", "example": "0-10" } }, "orderBy": { "name": "orderBy", "in": "query", "description": "The field name to sort the result list. Supported fields vary from object to object. Defaults to certain field depending on the object type.", "schema": { "type": "string", "example": "name" } }, "descending": { "name": "descending", "in": "query", "description": "Whether the sorting is applied descending or ascending. Defaults to certain field depending on the object type.", "schema": { "type": "string" } }, "filterBy": { "name": "filterBy", "in": "query", "description": "Filters the result list by the given field and value. Supported fields vary from API to API. The filters can be combined with each other as well as the generic query parameter. The given value is checked for inclusion.", "schema": { "type": "object", "additionalProperties": { "type": "string" } }, "style": "form", "explode": true, "allowEmptyValue": true, "example": { "name": "us-east", "tags": "aws" } } }, "schemas": { "IdentityProviderList": { "allOf": [ { "$ref": "#/components/schemas/ResultList" }, { "type": "object", "description": "Represents a list of Identity Providers.", "properties": { "data": { "type": "array", "description": "List of Identity Providers.", "items": { "$ref": "#/components/schemas/IdentityProvider" } } } } ] }, "ResultList": { "allOf": [ { "$ref": "#/components/schemas/ResultListBase" }, { "type": "object", "properties": { "queries": { "type": "array", "description": "The queries applied to the list.", "items": { "type": "string" } }, "totalCount": { "type": "integer", "description": "The total readable count of entities. Not influenced by the query.", "example": 328 }, "filterBy": { "type": "array", "description": "The filters applied to the list.", "items": { "$ref": "#/components/schemas/FilterBy" } } } } ] }, "IdentityProvider": { "type": "object", "discriminator": { "propertyName": "type", "mapping": { "Saml": "#/components/schemas/SamlProvider", "Oidc": "#/components/schemas/OidcProvider", "Radius": "#/components/schemas/RadiusProvider", "Ldap": "#/components/schemas/LdapProvider", "LdapCertificate": "#/components/schemas/LdapCertificateProvider", "LocalDatabase": "#/components/schemas/LocalDatabaseProvider", "ServiceDatabase": "#/components/schemas/ServiceDatabaseProvider", "Connector": "#/components/schemas/ConnectorProvider" } }, "required": [ "type" ] }, "Error": { "type": "object", "description": "Generic HTTP error.", "properties": { "id": { "type": "string", "description": "Machine readable error code." }, "message": { "type": "string", "description": "Human readable error details." } } }, "ResultListBase": { "type": "object", "properties": { "range": { "type": "string", "description": "The range applied to the list. Format: -/. 3-5/8 means, out of 8 count (query affects the total), the items between (including) the 3rd and the 5th are returned.", "example": "0-30/54" }, "orderBy": { "type": "string", "description": "The field name used to sort the list.", "example": "name" }, "descending": { "type": "boolean", "description": "Whether the sorting is applied descending or ascending." } } }, "FilterBy": { "type": "object", "properties": { "name": { "type": "string", "description": "The field name the filter is applied to.", "example": "name" }, "value": { "type": "string", "description": "The value used for comparison.", "example": "AWS" } } }, "SamlProvider": { "allOf": [ { "$ref": "#/components/schemas/ConfigurableIdentityProvider" }, { "type": "object", "description": "Represents a SAML Identity Provider.", "required": [ "redirectUrl", "issuer", "audience", "providerCertificate" ], "properties": { "redirectUrl": { "type": "string", "description": "The URL to redirect the user browsers to authenticate against the SAML Server. Also known as Single Sign-on URL. AuthNRequest will be added automatically.", "example": "https://saml.company.com" }, "issuer": { "type": "string", "description": "SAML issuer ID to make sure the sender of the Token is the expected SAML provider.", "example": "http://adfs-test.company.com/adfs/services/trust" }, "audience": { "type": "string", "description": "SAML audience to make sure the recipient of the Token is this Controller.", "example": "Company Appgate SDP" }, "providerCertificate": { "type": "string", "description": "The certificate of the SAML provider to verify the SAML tokens. In PEM format.", "example": "-----BEGIN CERTIFICATE-----\n....\n-----END CERTIFICATE-----" }, "decryptionKey": { "type": "string", "description": "The private key to decrypt encrypted assertions if there is any. In PEM format.", "writeOnly": true }, "forceAuthn": { "type": "boolean", "description": "Enables ForceAuthn flag in the SAML Request. If the SAML Provider supports this flag, it will require user to enter their credentials every time Client requires SAML authentication." } } } ] }, "OidcProvider": { "allOf": [ { "$ref": "#/components/schemas/ConfigurableIdentityProvider" }, { "type": "object", "description": "Represents an OIDC Identity Provider.", "required": [ "issuer", "audience" ], "properties": { "issuer": { "type": "string", "description": "OIDC issuer URL.", "example": "https://oidc-test.company.com/oauth2" }, "audience": { "type": "string", "description": "Audience/Client ID to make sure the recipient of the Token is this Controller.", "example": "f01e4129-6593-448f-90df-86ddb165fc08" }, "scope": { "type": "string", "description": "Scope to use for tokens.", "default": "openid profile email offline_access" }, "google": { "type": "object", "description": "Google specific OIDC settings.", "properties": { "enabled": { "type": "boolean", "description": "Whether to enable Google OIDC settings or not.", "default": false }, "clientSecret": { "type": "string", "description": "Client secret.", "writeOnly": true }, "refreshToken": { "type": "boolean", "description": "Whether to enable refresh token with Google OIDC or not." } } } } } ] }, "RadiusProvider": { "allOf": [ { "$ref": "#/components/schemas/ConfigurableIdentityProvider" }, { "type": "object", "description": "Represents a Radius Identity Provider.", "required": [ "hostnames", "sharedSecret" ], "properties": { "hostnames": { "type": "array", "description": "Hostnames/IP addresses to connect.", "items": { "type": "string" }, "example": [ "radius.company.com" ] }, "port": { "type": "integer", "description": "Port to connect.", "default": 1812 }, "sharedSecret": { "type": "string", "writeOnly": true, "description": "Radius shared secret to authenticate to the server." }, "authenticationProtocol": { "type": "string", "description": "Radius protocol to use while authenticating users.", "enum": [ "PAP", "CHAP" ], "default": "CHAP" } } } ] }, "LdapProvider": { "allOf": [ { "$ref": "#/components/schemas/ConfigurableIdentityProvider" }, { "type": "object", "description": "Represents an LDAP Identity Provider.", "required": [ "hostnames", "port", "adminDistinguishedName" ], "properties": { "hostnames": { "type": "array", "description": "Hostnames/IP addresses to connect.", "items": { "type": "string" }, "example": [ "dc.ad.company.com" ] }, "port": { "type": "integer", "description": "Port to connect.", "example": 389 }, "sslEnabled": { "type": "boolean", "description": "Whether to use LDAPS protocol or not.", "default": false }, "adminDistinguishedName": { "type": "string", "description": "The Distinguished Name to login to LDAP and query users with.", "example": "CN=admin,OU=Users,DC=company,DC=com" }, "adminPassword": { "type": "string", "description": "The password to login to LDAP and query users with. Required on creation.", "writeOnly": true, "example": "tSW3!QBv(rj{UuLY" }, "baseDn": { "type": "string", "description": "The subset of the LDAP server to search users from. If not set, root of the server is used.", "example": "OU=Users,DC=company,DC=com" }, "objectClass": { "type": "string", "deprecated": true, "description": "The object class of the users to be authenticated and queried. This field is translated to '(objectClass=value)' as user filter. Deprecated as of 6.2. Use userFilter instead.", "example": "user" }, "userFilter": { "type": "string", "description": "The LDAP filter to apply when searching for user during authentication.", "example": "(objectClass=user)" }, "usernameAttribute": { "type": "string", "description": "The name of the attribute to get the exact username from the LDAP server.", "default": "sAMAccountName" }, "membershipFilter": { "type": "string", "description": "The filter to use while querying users' nested groups.", "default": "(objectCategory=group)" }, "membershipBaseDn": { "type": "string", "description": "The subset of the LDAP server to search groups from. If not set, \"baseDn\" is used.", "example": "OU=Groups,DC=company,DC=com" }, "passwordWarning": { "type": "object", "description": "Password warning configuration for Active Directory. If enabled, the client will display the configured message before the password expiration.", "properties": { "enabled": { "type": "boolean", "description": "Whether to check and warn the users for password expiration." }, "thresholdDays": { "type": "integer", "description": "How many days before the password warning to be displayed to the user.", "default": 5 }, "message": { "type": "string", "description": "The given message will be displayed to the user. Use this field to guide the users on how to change their passwords. The expiration time will displayed on the client on a separate section.", "example": "Your password is about to expire. Please change it." } } } } } ] }, "LdapCertificateProvider": { "allOf": [ { "$ref": "#/components/schemas/LdapProvider" }, { "type": "object", "description": "Represents an LDAP Certificate Identity Provider.", "required": [ "caCertificates" ], "properties": { "caCertificates": { "type": "array", "description": "CA certificates to verify the Client certificates. In PEM format.", "items": { "type": "string" }, "example": [ "-----BEGIN CERTIFICATE----- .... -----END CERTIFICATE-----" ] }, "caCertificatesDetails": { "type": "array", "description": "Array of objects containing more detail about the certificates represented in caCertificates at matching index. This array is read only.", "readOnly": true, "items": { "$ref": "#/components/schemas/CertificateDetails" } }, "certificateUserAttribute": { "type": "string", "description": "The LDAP attribute to compare the Client certificate's Subject Alternative Name.", "default": "userPrincipalName" }, "certificateAttribute": { "type": "string", "description": "The LDAP attribute to compare the Client certificate binary. Leave it null to skip this comparison." }, "skipX509ExternalChecks": { "type": "boolean", "description": "By default, Controller contacts the endpoints on the certificate extensions in order to verify revocation status and pull the intermediate CA certificates. Set this flag in order to skip them." }, "certificatePriorities": { "type": "array", "description": "Client will order the available certificates according to the given priority list.", "items": { "type": "object", "required": [ "value" ], "properties": { "type": { "type": "string", "description": "Which attribute to compare.", "enum": [ "Template", "Issuer" ], "default": "Template" }, "value": { "type": "string", "description": "The value to compare to the certificate attribute.", "example": "1.3.6.1.4.1.311.21.8.3025710.4393146.2181807.13924342.9568199.8" } } } } } } ] }, "LocalDatabaseProvider": { "allOf": [ { "$ref": "#/components/schemas/ConfigurableIdentityProvider" }, { "$ref": "#/components/schemas/LocalProviderSettings" }, { "type": "object", "description": "Represents a Local Database Identity Provider." } ] }, "ServiceDatabaseProvider": { "allOf": [ { "$ref": "#/components/schemas/BaseIdentityProvider" }, { "$ref": "#/components/schemas/DnsSettings" }, { "$ref": "#/components/schemas/DeviceLimitPerUser" }, { "$ref": "#/components/schemas/LocalProviderSettings" }, { "type": "object", "description": "Represents a Service Database Identity Provider." } ] }, "ConnectorProvider": { "allOf": [ { "$ref": "#/components/schemas/BaseIdentityProvider" }, { "type": "object", "description": "Represents a Connector Identity Provider." } ] }, "ConfigurableIdentityProvider": { "allOf": [ { "$ref": "#/components/schemas/BaseIdentityProvider" }, { "$ref": "#/components/schemas/DnsSettings" }, { "$ref": "#/components/schemas/DeviceLimitPerUser" }, { "type": "object", "properties": { "adminProvider": { "type": "boolean", "description": "Whether the provider will be listed in the Admin UI or not.", "default": false }, "onBoarding2FA": { "type": "object", "description": "On-boarding two-factor authentication settings. Leave it empty keep it disabled.", "required": [ "mfaProviderId" ], "properties": { "mfaProviderId": { "type": "string", "format": "uuid", "x-uuid-ref": "MfaProvider", "description": "MFA provider ID to use for the authentication." }, "message": { "type": "string", "description": "On-boarding MFA message to be displayed on the Client UI during the second-factor authentication.", "example": "Please use your multi factor authentication device to on-board." }, "claimSuffix": { "type": "string", "description": "Upon successful on-boarding, the claim will be added as if MFA remedy action is fulfilled.", "default": "onBoarding" }, "alwaysRequired": { "type": "boolean", "description": "If enabled, MFA will be required on every authentication." } } }, "inactivityTimeoutMinutes": { "type": "integer", "description": "(Desktop) clients will sign out automatically after the user has been inactive on the device for the configured duration. Set it to 0 to disable.", "default": 0 }, "networkInactivityTimeoutEnabled": { "type": "boolean", "description": "Whether or not to take network inactivity into account when measuring client inactivity timeout.", "default": false }, "enforceWindowsNetworkProfileAsDomain": { "type": "boolean", "description": "If enabled, Windows Client will configure the network profile as \"DomainAuthenticated\"." }, "blockLocalDnsRequests": { "type": "boolean", "deprecated": true, "description": "Whether the Windows Client will block local DNS requests or not. Deprecated as of 6.6. Use DNS Policies.", "default": false }, "onDemandClaimMappings": { "$ref": "#/components/schemas/OnDemandClaimMappings" } } } ] }, "CertificateDetails": { "type": "object", "description": "X509 certificate details.", "format": "certificate", "x-certificate-source": "pem", "readOnly": true, "properties": { "version": { "type": "number", "description": "X.509 certificate version.", "example": 3 }, "serial": { "type": "string", "description": "X.509 certificate serial number.", "example": 1542962969512 }, "issuer": { "type": "string", "description": "The issuer name of the certificate.", "example": "CN=Appgate SDP CA" }, "subject": { "type": "string", "description": "The subject name of the certificate.", "example": "CN=Appgate SDP CA" }, "validFrom": { "type": "string", "format": "date-time", "description": "Since when the certificate is valid from." }, "validTo": { "type": "string", "format": "date-time", "description": "Until when the certificate is valid." }, "fingerprint": { "type": "string", "description": "SHA256 fingerprint of the certificate.", "example": "d30247cee99a056c5ecdc409549165886d02925f9c64b681dff3d2ecf653355f" }, "certificate": { "type": "string", "format": "byte", "description": "Base64 encoded binary of the certificate. Either DER or PEM formatted depending on the request." }, "subjectPublicKey": { "type": "string", "format": "byte", "description": "Base64 encoded public key of the certificate." } } }, "LocalProviderSettings": { "type": "object", "properties": { "userLockoutThreshold": { "type": "integer", "description": "After how many failed authentication attempts will a local user be locked out from authenticating again.", "default": 5 }, "userLockoutDurationMinutes": { "type": "integer", "description": "For how long lockout will last for local users.", "default": 1 }, "minPasswordLength": { "type": "integer", "description": "Minimum password length requirement for local users.", "default": 0 } } }, "BaseIdentityProvider": { "allOf": [ { "$ref": "#/components/schemas/BaseEntity" }, { "type": "object", "description": "Represents an Identity Provider.", "required": [ "type" ], "properties": { "type": { "type": "string", "description": "The type of the Identity Provider.", "enum": [ "LocalDatabase", "ServiceDatabase", "Ldap", "LdapCertificate", "Radius", "Saml", "Connector", "Oidc" ] }, "ipPoolV4": { "type": "string", "format": "uuid", "x-uuid-ref": "IpPool", "description": "The IPv4 Pool ID the users in this Identity Provider are going to use to allocate IP addresses for the tunnels." }, "ipPoolV6": { "type": "string", "format": "uuid", "x-uuid-ref": "IpPool", "description": "The IPv6 Pool ID the users in this Identity Provider are going to use to allocate IP addresses for the tunnels." }, "claimMappings": { "$ref": "#/components/schemas/ClaimMappings" }, "userScripts": { "$ref": "#/components/schemas/UserScripts" } } } ] }, "DnsSettings": { "type": "object", "properties": { "dnsServers": { "type": "array", "deprecated": true, "description": "The DNS servers to be assigned to the Clients of the users in this Identity Provider. Deprecated as of 6.6. Use either the Automatic Client DNS feature in Site DNS resolvers or DNS Policies.", "items": { "type": "string" }, "example": [ "172.17.18.19", "192.100.111.31" ] }, "dnsSearchDomains": { "type": "array", "deprecated": true, "description": "The DNS search domains to be assigned to Clients of the users in this Identity Provider. Deprecated as of 6.6. Use either the Automatic Client DNS feature in Site DNS resolvers or DNS Policies.", "items": { "type": "string" }, "example": [ "internal.company.com" ] } } }, "DeviceLimitPerUser": { "type": "object", "properties": { "deviceLimitPerUser": { "type": "integer", "description": "The device limit per user. The existing on-boarded devices will still be able to sign in even if the limit is exceeded.", "default": 100 } } }, "OnDemandClaimMappings": { "type": "array", "description": "The mapping of Identity Provider on demand attributes to claims.", "items": { "type": "object", "required": [ "command", "claimName", "platform" ], "properties": { "command": { "type": "string", "description": "The name of the command.", "enum": [ "fileSize", "fileExists", "fileCreated", "fileUpdated", "fileVersion", "fileSha512", "processRunning", "serviceRunning", "regExists", "regQuery", "runScript" ] }, "claimName": { "type": "string", "description": "The name of the device claim to be used in Appgate SDP.", "example": "antivirusRunning" }, "parameters": { "type": "object", "description": "Depending on the command type, extra parameters to pass to the on-demand claim.", "properties": { "name": { "type": "string", "description": "'Used for the following commands: \"serviceRunning\", \"processRunning\", \"runScript\". Name of the service, process or device claim script respectively.'", "example": "python3" }, "path": { "type": "string", "description": "'Used for the following commands: \"fileSize\", \"fileExists\", \"fileCreated\", \"fileUpdated\", \"fileVersion\", \"fileSha512\", \"regExists\", \"regQuery\".' Path for the file or registry.", "example": "/usr/bin/python3" }, "args": { "type": "string", "description": "Used as device claim script args/parameters for \"runScript\" command.", "example": "--list" } } }, "platform": { "type": "string", "description": "The platform(s) to run the on-demand claim.", "enum": [ "desktop.windows.all", "desktop.macos.all", "desktop.linux.all", "desktop.all", "mobile.android.all", "mobile.ios.all", "mobile.all", "all" ] } } } }, "BaseEntity": { "type": "object", "required": [ "name" ], "properties": { "id": { "type": "string", "format": "uuid", "description": "ID of the object.", "example": "4c07bc67-57ea-42dd-b702-c2d6c45419fc" }, "name": { "type": "string", "description": "Name of the object.", "example": "object" }, "notes": { "type": "string", "description": "Notes for the object. Used for documentation purposes.", "example": "This object has been created for test purposes." }, "created": { "type": "string", "format": "date-time", "description": "Create date.", "readOnly": true }, "updated": { "type": "string", "format": "date-time", "description": "Last update date.", "readOnly": true }, "readOnly": { "type": "boolean", "description": "Whether the entity is protected from manual updates and deletes.", "example": false, "readOnly": true }, "tags": { "type": "array", "description": "Array of tags.", "items": { "type": "string" }, "example": [ "developer", "api-created" ] } } }, "ClaimMappings": { "type": "array", "description": "The mapping of Identity Provider attributes to claims.", "items": { "type": "object", "required": [ "attributeName", "claimName" ], "properties": { "attributeName": { "type": "string", "description": "The name of the attribute coming from the Identity Provider.", "example": "SAMAccountName" }, "claimName": { "type": "string", "description": "The name of the user claim to be used in Appgate SDP.", "example": "username" }, "list": { "type": "boolean", "description": "Whether the claim is expected to be a list and have multiple values or not.", "default": false }, "encrypt": { "type": "boolean", "description": "Whether the claim should be encrypted or not.", "default": false } } } }, "UserScripts": { "type": "array", "description": "ID of the User Claim Scripts to run during authorization.", "items": { "type": "string", "format": "uuid" } } }, "responses": { "TokenError": { "description": "Token error. Login again.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "PermissionError": { "description": "Insufficient permissions to access this resource.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "responses-NotAcceptableError": { "description": "Invalid 'Accept' header.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "UnexpectedError": { "description": "Unexpected server side error.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "securitySchemes": { "BearerAuth": { "type": "http", "scheme": "bearer" } } } } ````