Querying a Specified SAML Provider

Function

This API is used to query details about SAML 2.0 IdPs.

Authorization Information

Each account root user has all the permissions required to call all APIs, but IAM users must be assigned the following required identity policy-based permissions. For details about the required permissions, see Permissions Policies and Supported Actions.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
iam:samlProviders:getV5	Read	samlProvider *	g:ResourceTag/<tag-key>	-	-

URI

GET /v5/saml-providers/{provider_id}

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
provider_id	Yes	String	Definition Provider ID. Constraints N/A Range The value must contain 1 to 64 characters, including only letters, digits, and hyphens (-). Default Value N/A

Request Parameters

None

Response Parameters

Status code: 200

**Table 2** Response body parameters
Parameter	Type	Description
saml_provider	saml_provider object	Definition SAML provider. Range N/A

**Table 3** saml_provider
Parameter	Type	Description
provider_id	String	Definition ID of the SAML identity provider. Range The value must contain 1 to 64 characters, including only letters, digits, and hyphens (-).
name	String	Definition Name of the SAML identity provider. Range The value must contain 1 to 64 characters, including only letters, digits, underscores (_), and hyphens (-).
description	String	Definition Description of an identity provider. Range The value can contain 0 to 255 characters and cannot contain the following special characters: @#%&<>$^*.
urn	String	Definition Uniform resource name. Range The value must contain 16 to 1,500 characters, including letters, digits, slashes (/), equal signs (=), underscores (_), colons (:), and hyphens (-).
saml_metadata_document	String	Definition XML document of an IdP that supports SAML 2.0. Range Length range: 1,000 to 512,000.
assertion_encryption_mode	String	Definition Encryption settings of the SAML identity provider. Range The value can be "Required" or "Allowed".
private_keys	Array of private_keys objects	Definition Private key used to decrypt SAML assertions. Range N/A
tags	Array of tags objects	Definition List of custom tags. Range The array length is not involved.
created_at	String	Definition Time when the SAML identity provider was created. Range N/A
expires_at	String	Definition Time when the SAML identity provider expires. Range N/A

**Table 4** private_keys
Parameter	Type	Description
key_id	String	Definition ID of the private key for decrypting SAML assertions. Range N/A
timestamp	String	Definition Time when the private key for decrypting SAML assertions was uploaded. The value must comply with the ISO 8601 format. Range N/A

**Table 5** tags
Parameter	Type	Description
tag_key	String	Definition Tag key. Range The value can contain 1 to 64 characters, including letters, digits, spaces, and the following special characters: _.:=+-@. The value cannot start or end with a space or start with *sys*.
tag_value	String	Definition Tag value. Range The value can contain 0 to 128 characters, including letters, digits, spaces, and the following special characters: _.:/=+-@. It can also be an empty string.

Status code: 403

**Table 6** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A
encoded_authorization_message	String	Definition : Encrypted details returned when the authentication fails, which are used to locate authentication problems. The STS5 decryption API can be used for decryption. For details, see API link. Range: N/A.

Status code: 404

**Table 7** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Example Requests

None

Example Responses

Status code: 200

Request succeeded.

{
  "saml_provider" : {
    "provider_id" : "string",
    "name" : "string",
    "urn" : "iam::accountid:user:name",
    "saml_metadata_document" : "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<md:EntityDescriptor entityID=\"http://***.***.com/****************************\"\n                     xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\">\n\t<md:IDPSSODescriptor WantAuthnRequestsSigned=\"false\"\n\t                     protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\">\n\t\t<md:KeyDescriptor use=\"signing\">\n\t\t\t<ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n\t\t\t\t<ds:X509Data>\n\t\t\t\t\t<ds:X509Certificate>example************************************************************************************************************************************************************************************************************************************************************************************************************************************************example</ds:X509Certificate>\n\t\t\t\t</ds:X509Data>\n\t\t\t</ds:KeyInfo>\n\t\t</md:KeyDescriptor>\n\t\t<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>\n\t\t<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>\n\t\t<md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\"\n\t\t                        Location=\"https://***************.okta.com/app/***************_oktaaws_1/****************************/sso/saml\"/>\n\t\t<md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\"\n\t\t                        Location=\"https://***************.okta.com/app/***************_oktaaws_1/****************************/sso/saml\"/>\n\t</md:IDPSSODescriptor>\n</md:EntityDescriptor>",
    "description" : "",
    "assertion_encryption_mode" : "Allowed",
    "private_keys" : [ ],
    "tags" : [ ],
    "created_at" : "2026-06-29T11:30:04.948Z",
    "expires_at" : "2126-06-05T11:30:04.9Z"
  }
}