Creating an OIDC Provider

Function

This API is used to create an IdP that supports OpenID Connect (OIDC).

The OIDC provider you create can be used as the principal in the trust policy of a trust agency to establish a trust relationship between Huawei Cloud and the OIDC provider.

You can directly use your identity provider to create a trust agency. For more information, see the identity provider section in the IAM User Guide.

When you create an IAM OIDC provider, you need to specify the following information:

URL of the OIDC identity provider to be trusted.
A list of client IDs (also known as audiences). It is used to identify applications that are allowed to use the OIDC provider for identity authentication.
A list of tags attached to the specified IAM OIDC provider.
A list of fingerprints of one or more server certificates used by the OIDC identity provider.

Note:

IAM uses our trusted root Certificate Authorities (CAs) library to verify the TLS certificate of the JSON Web Key Set (JWKS) endpoint. This ensures secure communication with OIDC IdPs. If your OIDC IdP relies on a certificate that is not signed by one of these trusted CAs, we will use the fingerprint set in the IdP configuration to ensure secure communication.

Authorization Information

Each account root user has all the permissions required to call all APIs, but IAM users must be assigned the following required identity policy-based permissions. For details about the required permissions, see Permissions Policies and Supported Actions.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
iam:oidcProviders:createV5	Write	oidcProvider *	-	-	-

URI

POST /v5/oidc-providers

Request Parameters

**Table 1** Request body parameters
Parameter	Mandatory	Type	Description
url	Yes	String	Definition Identity provider URL. The URL must start with https:// and correspond to the iss (issuer) claim in the OpenID Connect ID token provided by the identity provider. According to the OIDC standard, the URL can contain path components but cannot contain query parameters. Typically, the URL consists of only a single host name and does not contain a port number, for example, https://www.oidc.com or https://oidc.com. Constraints Length range: 1 to 255. Range N/A Default Value N/A
name	Yes	String	Definition Name of an OIDC provider. Constraints The value must contain 1 to 64 characters, including only letters, digits, underscores (_), and hyphens (-). Range N/A Default Value N/A
client_ids	Yes	Array of strings	Definition List of client IDs, which are also called audiences. You can register multiple client IDs with the same provider. Constraints The list contains 1 to 100 elements, and each element contains 1 to 255 characters. Range N/A Default Value N/A
thumbprints	No	Array of strings	Definition List of server certificate fingerprints of an OIDC identity provider. The fingerprints in the list are SHA-1 hashes of X.509 certificates in hexadecimal encoding, each always being a 64-character string. Typically, this list contains only one fingerprint. However, IAM allows you to set up to five fingerprints for an OIDC provider. This allows you to securely rotate the identity provider's certificates. This parameter is optional. If it is not included, IAM retrieves and uses the top-level intermediate certificate authority (CA) fingerprint of the OIDC identity provider's server certificate. For more information about obtaining the OIDC provider's fingerprint, see the section about obtaining the OIDC provider's fingerprint in the IAM User Guide. Constraints The list contains 0 to 5 elements, and each element contains 64 characters. Range N/A Default Value N/A
description	No	String	Definition Description of an identity provider. Constraints Length range: 0 to 255. Range The value cannot contain the following special characters: @#%&<>$^. Default Value* N/A

Response Parameters

Status code: 201

**Table 2** Response body parameters
Parameter	Type	Description
oidc_provider	oidc_provider object	Definition OIDC provider. Range N/A

**Table 3** oidc_provider
Parameter	Type	Description
provider_id	String	Definition ID of an OIDC identity provider. Range The value must contain 1 to 64 characters, including only letters, digits, and hyphens (-).
name	String	Definition Name of an OIDC identity provider. Range The value must contain 1 to 64 characters, including only letters, digits, underscores (_), and hyphens (-).
description	String	Definition Description of an identity provider. Range The value can contain a maximum of 255 characters and cannot contain the following special characters: @#%&<>$^*.
url	String	Definition URL of an OIDC identity provider. Range The value can contain 1 to 255 characters.
urn	String	Definition Uniform resource name. Range The value can contain 16 to 1,500 characters, including only letters, digits, and the following special characters: /=_:-.
client_ids	Array of strings	Definition A list of client IDs. Range The array contains 1 to 100 elements. Each element contains 1 to 255 characters.
thumbprints	Array of strings	Definition List of server certificate fingerprints of an OIDC identity provider. Range The array contains 1 to 5 elements. Each element contains 64 characters, including letters and digits.
created_at	String	Definition Time when a provider was created. Range N/A

Status code: 400

**Table 4** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Status code: 403

**Table 5** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A
encoded_authorization_message	String	Definition : Encrypted details returned when the authentication fails, which are used to locate authentication problems. The STS5 decryption API can be used for decryption. For details, see API link. Range: N/A.

Status code: 409

**Table 6** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Example Requests

Creating an OIDC provider

POST https://{endpoint}/v5/oidc-providers

{
  "url" : "string",
  "name" : "string",
  "description" : "string",
  "client_ids" : [ "string" ],
  "thumbprints" : [ "stringstringstringstringstringstringstringstringstringstringstri" ]
}

Example Responses

Status code: 201

Request succeeded.

{
  "oidc_provider" : {
    "provider_id" : "string",
    "name" : "string",
    "url" : "string",
    "urn" : "iam::accountid:user:name",
    "client_ids" : [ "string" ],
    "thumbprints" : [ "stringstringstringstringstringstringstringstringstringstringstri" ],
    "created_at" : "2026-06-22T09:50:34.264Z",
    "description" : null
  }
}