{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/mongodb/main/json-schema/mongodb-federation-oidc-identity-provider-schema.json",
  "title": "FederationOidcIdentityProvider",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/mongodb-federated-authentication-api-openapi.yml#/components/schemas/FederationOidcIdentityProvider",
  "oneOf": [
    {
      "$ref": "#/$defs/FederationOidcWorkforceIdentityProvider"
    },
    {
      "$ref": "#/$defs/FederationOidcWorkloadIdentityProvider"
    }
  ],
  "properties": {
    "associatedOrgs": {
      "description": "List that contains the connected organization configurations associated with the identity provider.",
      "items": {
        "$ref": "#/$defs/ConnectedOrgConfig"
      },
      "type": "array",
      "uniqueItems": true
    },
    "audience": {
      "description": "Identifier of the intended recipient of the token.",
      "type": "string"
    },
    "authorizationType": {
      "description": "Indicates whether authorization is granted based on group membership or user ID.",
      "enum": [
        "GROUP",
        "USER"
      ],
      "type": "string"
    },
    "createdAt": {
      "description": "Date that the identity provider was created on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.",
      "format": "date-time",
      "readOnly": true,
      "type": "string"
    },
    "description": {
      "description": "The description of the identity provider.",
      "type": "string"
    },
    "displayName": {
      "description": "Human-readable label that identifies the identity provider.",
      "type": "string"
    },
    "groupsClaim": {
      "description": "Identifier of the claim which contains IdP Group IDs in the token.",
      "type": "string"
    },
    "id": {
      "description": "Unique 24-hexadecimal digit string that identifies the identity provider.",
      "pattern": "^([a-f0-9]{24})$",
      "readOnly": true,
      "type": "string"
    },
    "idpType": {
      "description": "String enum that indicates the type of the identity provider. Default is WORKFORCE.",
      "enum": [
        "WORKFORCE",
        "WORKLOAD"
      ],
      "type": "string"
    },
    "issuerUri": {
      "description": "Unique string that identifies the issuer of the SAML Assertion or OIDC metadata/discovery document URL.",
      "type": "string"
    },
    "oktaIdpId": {
      "description": "Legacy 20-hexadecimal digit string that identifies the identity provider.",
      "pattern": "^([a-f0-9]{20})$",
      "type": "string"
    },
    "protocol": {
      "description": "String enum that indicates the protocol of the identity provider. Either SAML or OIDC.",
      "enum": [
        "SAML",
        "OIDC"
      ],
      "type": "string"
    },
    "updatedAt": {
      "description": "Date that the identity provider was last updated on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.",
      "format": "date-time",
      "readOnly": true,
      "type": "string"
    },
    "userClaim": {
      "description": "Identifier of the claim which contains the user ID in the token.",
      "type": "string"
    }
  },
  "required": [
    "id",
    "oktaIdpId"
  ],
  "type": "object",
  "$defs": {
    "AuthFederationRoleMapping": {
      "description": "Mapping settings that link one IdP and MongoDB Cloud.",
      "properties": {
        "externalGroupName": {
          "description": "Unique human-readable label that identifies the identity provider group to which this role mapping applies.",
          "maxLength": 200,
          "minLength": 1,
          "type": "string"
        },
        "id": {
          "description": "Unique 24-hexadecimal digit string that identifies this role mapping.",
          "pattern": "^([a-f0-9]{24})$",
          "readOnly": true,
          "type": "string"
        },
        "roleAssignments": {
          "description": "Atlas roles and the unique identifiers of the groups and organizations associated with each role. The array must include at least one element with an Organization role and its respective `orgId`. Each element in the array can have a value for `orgId` or `groupId`, but not both.",
          "items": {
            "$ref": "#/$defs/ConnectedOrgConfigRoleAssignment"
          },
          "type": "array",
          "uniqueItems": true
        }
      },
      "required": [
        "externalGroupName",
        "roleAssignments"
      ],
      "title": "Federated Authentication Role Mapping",
      "type": "object"
    },
    "ConnectedOrgConfig": {
      "properties": {
        "dataAccessIdentityProviderIds": {
          "description": "The collection of unique ids representing the identity providers that can be used for data access in this organization.",
          "items": {
            "description": "Unique 24-hexadecimal digit string that represents the id of the identity providers that can be used for data access in this organization.",
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "domainAllowList": {
          "description": "Approved domains that restrict users who can join the organization based on their email address.",
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "domainRestrictionEnabled": {
          "description": "Value that indicates whether domain restriction is enabled for this connected organization.",
          "type": "boolean"
        },
        "identityProviderId": {
          "description": "Legacy 20-hexadecimal digit string that identifies the UI access identity provider that this connected organization configuration is associated with. This id can be found within the Federation Management Console > Identity Providers tab by clicking the info icon in the IdP ID row of a configured identity provider.",
          "pattern": "^([a-f0-9]{20})$",
          "type": "string"
        },
        "orgId": {
          "description": "Unique 24-hexadecimal digit string that identifies the connected organization configuration.",
          "pattern": "^([a-f0-9]{24})$",
          "readOnly": true,
          "type": "string"
        },
        "postAuthRoleGrants": {
          "description": "Atlas roles that are granted to a user in this organization after authenticating. Roles are a human-readable label that identifies the collection of privileges that MongoDB Cloud grants a specific MongoDB Cloud user. These roles can only be organization specific roles.",
          "items": {
            "enum": [
              "ORG_OWNER",
              "ORG_MEMBER",
              "ORG_GROUP_CREATOR",
              "ORG_BILLING_ADMIN",
              "ORG_BILLING_READ_ONLY",
              "ORG_STREAM_PROCESSING_ADMIN",
              "ORG_READ_ONLY"
            ],
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "roleMappings": {
          "description": "Role mappings that are configured in this organization.",
          "items": {
            "$ref": "#/$defs/AuthFederationRoleMapping"
          },
          "type": "array",
          "uniqueItems": true
        },
        "userConflicts": {
          "description": "List that contains the users who have an email address that doesn't match any domain on the allowed list.",
          "items": {
            "$ref": "#/$defs/FederatedUser"
          },
          "type": "array"
        }
      },
      "required": [
        "domainRestrictionEnabled",
        "orgId"
      ],
      "type": "object"
    },
    "ConnectedOrgConfigRoleAssignment": {
      "properties": {
        "groupId": {
          "description": "Unique 24-hexadecimal digit string that identifies the project to which this role belongs. Each element within `roleAssignments` can have a value for `groupId` or `orgId`, but not both.",
          "pattern": "^([a-f0-9]{24})$",
          "type": "string"
        },
        "orgId": {
          "description": "Unique 24-hexadecimal digit string that identifies the organization to which this role belongs. Each element within `roleAssignments` can have a value for `orgId` or `groupId`, but not both.",
          "pattern": "^([a-f0-9]{24})$",
          "type": "string"
        },
        "role": {
          "description": "Human-readable label that identifies the collection of privileges that MongoDB Cloud grants a specific API key, MongoDB Cloud user, or MongoDB Cloud team. These roles include organization- and project-level roles.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "FederatedUser": {
      "description": "MongoDB Cloud user linked to this federated authentication.",
      "properties": {
        "emailAddress": {
          "description": "Email address of the MongoDB Cloud user linked to the federated organization.",
          "format": "email",
          "type": "string"
        },
        "federationSettingsId": {
          "description": "Unique 24-hexadecimal digit string that identifies the federation to which this MongoDB Cloud user belongs.",
          "pattern": "^([a-f0-9]{24})$",
          "type": "string"
        },
        "firstName": {
          "description": "First or given name that belongs to the MongoDB Cloud user.",
          "type": "string"
        },
        "lastName": {
          "description": "Last name, family name, or surname that belongs to the MongoDB Cloud user.",
          "type": "string"
        },
        "userId": {
          "description": "Unique 24-hexadecimal digit string that identifies this user.",
          "pattern": "^([a-f0-9]{24})$",
          "readOnly": true,
          "type": "string"
        }
      },
      "required": [
        "emailAddress",
        "federationSettingsId",
        "firstName",
        "lastName"
      ],
      "title": "Federated User",
      "type": "object"
    },
    "FederationOidcWorkforceIdentityProvider": {
      "properties": {
        "associatedDomains": {
          "description": "List that contains the domains associated with the identity provider.",
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "associatedOrgs": {
          "description": "List that contains the connected organization configurations associated with the identity provider.",
          "items": {
            "$ref": "#/$defs/ConnectedOrgConfig"
          },
          "type": "array",
          "uniqueItems": true
        },
        "audience": {
          "description": "Identifier of the intended recipient of the token.",
          "type": "string"
        },
        "authorizationType": {
          "description": "Indicates whether authorization is granted based on group membership or user ID.",
          "enum": [
            "GROUP",
            "USER"
          ],
          "type": "string"
        },
        "clientId": {
          "description": "Client identifier that is assigned to an application by the Identity Provider.",
          "type": "string"
        },
        "createdAt": {
          "description": "Date that the identity provider was created on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "description": {
          "description": "The description of the identity provider.",
          "type": "string"
        },
        "displayName": {
          "description": "Human-readable label that identifies the identity provider.",
          "type": "string"
        },
        "groupsClaim": {
          "description": "Identifier of the claim which contains IdP Group IDs in the token.",
          "type": "string"
        },
        "id": {
          "description": "Unique 24-hexadecimal digit string that identifies the identity provider.",
          "pattern": "^([a-f0-9]{24})$",
          "readOnly": true,
          "type": "string"
        },
        "idpType": {
          "description": "String enum that indicates the type of the identity provider. Default is WORKFORCE.",
          "enum": [
            "WORKFORCE",
            "WORKLOAD"
          ],
          "type": "string"
        },
        "issuerUri": {
          "description": "Unique string that identifies the issuer of the SAML Assertion or OIDC metadata/discovery document URL.",
          "type": "string"
        },
        "oktaIdpId": {
          "description": "Legacy 20-hexadecimal digit string that identifies the identity provider.",
          "pattern": "^([a-f0-9]{20})$",
          "type": "string"
        },
        "protocol": {
          "description": "String enum that indicates the protocol of the identity provider. Either SAML or OIDC.",
          "enum": [
            "SAML",
            "OIDC"
          ],
          "type": "string"
        },
        "requestedScopes": {
          "description": "Scopes that MongoDB applications will request from the authorization endpoint.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "updatedAt": {
          "description": "Date that the identity provider was last updated on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "userClaim": {
          "description": "Identifier of the claim which contains the user ID in the token.",
          "type": "string"
        }
      },
      "required": [
        "id",
        "oktaIdpId"
      ],
      "title": "OIDC WORKFORCE",
      "type": "object"
    },
    "FederationOidcWorkloadIdentityProvider": {
      "properties": {
        "associatedOrgs": {
          "description": "List that contains the connected organization configurations associated with the identity provider.",
          "items": {
            "$ref": "#/$defs/ConnectedOrgConfig"
          },
          "type": "array",
          "uniqueItems": true
        },
        "audience": {
          "description": "Identifier of the intended recipient of the token.",
          "type": "string"
        },
        "authorizationType": {
          "description": "Indicates whether authorization is granted based on group membership or user ID.",
          "enum": [
            "GROUP",
            "USER"
          ],
          "type": "string"
        },
        "createdAt": {
          "description": "Date that the identity provider was created on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "description": {
          "description": "The description of the identity provider.",
          "type": "string"
        },
        "displayName": {
          "description": "Human-readable label that identifies the identity provider.",
          "type": "string"
        },
        "groupsClaim": {
          "description": "Identifier of the claim which contains IdP Group IDs in the token.",
          "type": "string"
        },
        "id": {
          "description": "Unique 24-hexadecimal digit string that identifies the identity provider.",
          "pattern": "^([a-f0-9]{24})$",
          "readOnly": true,
          "type": "string"
        },
        "idpType": {
          "description": "String enum that indicates the type of the identity provider. Default is WORKFORCE.",
          "enum": [
            "WORKFORCE",
            "WORKLOAD"
          ],
          "type": "string"
        },
        "issuerUri": {
          "description": "Unique string that identifies the issuer of the SAML Assertion or OIDC metadata/discovery document URL.",
          "type": "string"
        },
        "oktaIdpId": {
          "description": "Legacy 20-hexadecimal digit string that identifies the identity provider.",
          "pattern": "^([a-f0-9]{20})$",
          "type": "string"
        },
        "protocol": {
          "description": "String enum that indicates the protocol of the identity provider. Either SAML or OIDC.",
          "enum": [
            "SAML",
            "OIDC"
          ],
          "type": "string"
        },
        "updatedAt": {
          "description": "Date that the identity provider was last updated on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "userClaim": {
          "description": "Identifier of the claim which contains the user ID in the token.",
          "type": "string"
        }
      },
      "required": [
        "id",
        "oktaIdpId"
      ],
      "title": "OIDC WORKLOAD",
      "type": "object"
    }
  }
}