1. Packages
  2. Cloudflare Provider
  3. API Docs
  4. getZeroTrustAccessIdentityProviders
Cloudflare v6.10.1 published on Wednesday, Oct 22, 2025 by Pulumi
pulumi/pulumi-cloudflare

cloudflare.getZeroTrustAccessIdentityProviders

Get Started
cloudflare logo
Cloudflare v6.10.1 published on Wednesday, Oct 22, 2025 by Pulumi
pulumi/pulumi-cloudflare

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const exampleZeroTrustAccessIdentityProviders = cloudflare.getZeroTrustAccessIdentityProviders({
    accountId: "account_id",
    zoneId: "zone_id",
    scimEnabled: "scim_enabled",
});

    import pulumi
import pulumi_cloudflare as cloudflare

example_zero_trust_access_identity_providers = cloudflare.get_zero_trust_access_identity_providers(account_id="account_id",
    zone_id="zone_id",
    scim_enabled="scim_enabled")

    package main

import (
	"github.com/pulumi/pulumi-cloudflare/sdk/v6/go/cloudflare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudflare.LookupZeroTrustAccessIdentityProviders(ctx, &cloudflare.LookupZeroTrustAccessIdentityProvidersArgs{
			AccountId:   pulumi.StringRef("account_id"),
			ZoneId:      pulumi.StringRef("zone_id"),
			ScimEnabled: pulumi.StringRef("scim_enabled"),
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

return await Deployment.RunAsync(() => 
{
    var exampleZeroTrustAccessIdentityProviders = Cloudflare.GetZeroTrustAccessIdentityProviders.Invoke(new()
    {
        AccountId = "account_id",
        ZoneId = "zone_id",
        ScimEnabled = "scim_enabled",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudflare.CloudflareFunctions;
import com.pulumi.cloudflare.inputs.GetZeroTrustAccessIdentityProvidersArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var exampleZeroTrustAccessIdentityProviders = CloudflareFunctions.getZeroTrustAccessIdentityProviders(GetZeroTrustAccessIdentityProvidersArgs.builder()
            .accountId("account_id")
            .zoneId("zone_id")
            .scimEnabled("scim_enabled")
            .build());

    }
}

    variables:
  exampleZeroTrustAccessIdentityProviders:
    fn::invoke:
      function: cloudflare:getZeroTrustAccessIdentityProviders
      arguments:
        accountId: account_id
        zoneId: zone_id
        scimEnabled: scim_enabled

    Using getZeroTrustAccessIdentityProviders

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getZeroTrustAccessIdentityProviders(args: GetZeroTrustAccessIdentityProvidersArgs, opts?: InvokeOptions): Promise<GetZeroTrustAccessIdentityProvidersResult>
function getZeroTrustAccessIdentityProvidersOutput(args: GetZeroTrustAccessIdentityProvidersOutputArgs, opts?: InvokeOptions): Output<GetZeroTrustAccessIdentityProvidersResult>
    def get_zero_trust_access_identity_providers(account_id: Optional[str] = None,
                                             max_items: Optional[int] = None,
                                             scim_enabled: Optional[str] = None,
                                             zone_id: Optional[str] = None,
                                             opts: Optional[InvokeOptions] = None) -> GetZeroTrustAccessIdentityProvidersResult
def get_zero_trust_access_identity_providers_output(account_id: Optional[pulumi.Input[str]] = None,
                                             max_items: Optional[pulumi.Input[int]] = None,
                                             scim_enabled: Optional[pulumi.Input[str]] = None,
                                             zone_id: Optional[pulumi.Input[str]] = None,
                                             opts: Optional[InvokeOptions] = None) -> Output[GetZeroTrustAccessIdentityProvidersResult]
    func LookupZeroTrustAccessIdentityProviders(ctx *Context, args *LookupZeroTrustAccessIdentityProvidersArgs, opts ...InvokeOption) (*LookupZeroTrustAccessIdentityProvidersResult, error)
func LookupZeroTrustAccessIdentityProvidersOutput(ctx *Context, args *LookupZeroTrustAccessIdentityProvidersOutputArgs, opts ...InvokeOption) LookupZeroTrustAccessIdentityProvidersResultOutput

    > Note: This function is named LookupZeroTrustAccessIdentityProviders in the Go SDK.

    public static class GetZeroTrustAccessIdentityProviders 
{
    public static Task<GetZeroTrustAccessIdentityProvidersResult> InvokeAsync(GetZeroTrustAccessIdentityProvidersArgs args, InvokeOptions? opts = null)
    public static Output<GetZeroTrustAccessIdentityProvidersResult> Invoke(GetZeroTrustAccessIdentityProvidersInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetZeroTrustAccessIdentityProvidersResult> getZeroTrustAccessIdentityProviders(GetZeroTrustAccessIdentityProvidersArgs args, InvokeOptions options)
public static Output<GetZeroTrustAccessIdentityProvidersResult> getZeroTrustAccessIdentityProviders(GetZeroTrustAccessIdentityProvidersArgs args, InvokeOptions options)

    fn::invoke:
  function: cloudflare:index/getZeroTrustAccessIdentityProviders:getZeroTrustAccessIdentityProviders
  arguments:
    # arguments dictionary

    The following arguments are supported:

    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    MaxItems int
    Max items to fetch, default: 1000
    ScimEnabled string
    Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    MaxItems int
    Max items to fetch, default: 1000
    ScimEnabled string
    Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    maxItems Integer
    Max items to fetch, default: 1000
    scimEnabled String
    Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    maxItems number
    Max items to fetch, default: 1000
    scimEnabled string
    Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
    zoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    account_id str
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    max_items int
    Max items to fetch, default: 1000
    scim_enabled str
    Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
    zone_id str
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    maxItems Number
    Max items to fetch, default: 1000
    scimEnabled String
    Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

    getZeroTrustAccessIdentityProviders Result

    The following output properties are available:

    Id string
    The provider-assigned unique ID for this managed resource.
    Results List<GetZeroTrustAccessIdentityProvidersResult>
    The items returned by the data source
    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    MaxItems int
    Max items to fetch, default: 1000
    ScimEnabled string
    Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    Id string
    The provider-assigned unique ID for this managed resource.
    Results []GetZeroTrustAccessIdentityProvidersResult
    The items returned by the data source
    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    MaxItems int
    Max items to fetch, default: 1000
    ScimEnabled string
    Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    id String
    The provider-assigned unique ID for this managed resource.
    results List<GetZeroTrustAccessIdentityProvidersResult>
    The items returned by the data source
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    maxItems Integer
    Max items to fetch, default: 1000
    scimEnabled String
    Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    id string
    The provider-assigned unique ID for this managed resource.
    results GetZeroTrustAccessIdentityProvidersResult[]
    The items returned by the data source
    accountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    maxItems number
    Max items to fetch, default: 1000
    scimEnabled string
    Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
    zoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    id str
    The provider-assigned unique ID for this managed resource.
    results Sequence[GetZeroTrustAccessIdentityProvidersResult]
    The items returned by the data source
    account_id str
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    max_items int
    Max items to fetch, default: 1000
    scim_enabled str
    Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
    zone_id str
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    id String
    The provider-assigned unique ID for this managed resource.
    results List<Property Map>
    The items returned by the data source
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    maxItems Number
    Max items to fetch, default: 1000
    scimEnabled String
    Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

    Supporting Types

    GetZeroTrustAccessIdentityProvidersResult

    Config GetZeroTrustAccessIdentityProvidersResultConfig
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    Id string
    UUID.
    Name string
    The name of the identity provider, shown to users on the login page.
    ScimConfig GetZeroTrustAccessIdentityProvidersResultScimConfig
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    Type string
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".
    Config GetZeroTrustAccessIdentityProvidersResultConfig
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    Id string
    UUID.
    Name string
    The name of the identity provider, shown to users on the login page.
    ScimConfig GetZeroTrustAccessIdentityProvidersResultScimConfig
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    Type string
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".
    config GetZeroTrustAccessIdentityProvidersResultConfig
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    id String
    UUID.
    name String
    The name of the identity provider, shown to users on the login page.
    scimConfig GetZeroTrustAccessIdentityProvidersResultScimConfig
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    type String
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".
    config GetZeroTrustAccessIdentityProvidersResultConfig
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    id string
    UUID.
    name string
    The name of the identity provider, shown to users on the login page.
    scimConfig GetZeroTrustAccessIdentityProvidersResultScimConfig
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    type string
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".
    config GetZeroTrustAccessIdentityProvidersResultConfig
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    id str
    UUID.
    name str
    The name of the identity provider, shown to users on the login page.
    scim_config GetZeroTrustAccessIdentityProvidersResultScimConfig
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    type str
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".
    config Property Map
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    id String
    UUID.
    name String
    The name of the identity provider, shown to users on the login page.
    scimConfig Property Map
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    type String
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".

    GetZeroTrustAccessIdentityProvidersResultConfig

    AppsDomain string
    Your companies TLD
    Attributes List<string>
    A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
    AuthUrl string
    The authorization_endpoint URL of your IdP
    AuthorizationServerId string
    Your okta authorization server id
    CentrifyAccount string
    Your centrify account url
    CentrifyAppId string
    Your centrify app id
    CertsUrl string
    The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
    Claims List<string>
    Custom claims
    ClientId string
    Your OAuth Client ID
    ClientSecret string
    Your OAuth Client Secret
    ConditionalAccessEnabled bool
    Should Cloudflare try to load authentication contexts from your account
    DirectoryId string
    Your Azure directory uuid
    EmailAttributeName string
    The attribute name for email in the SAML response.
    EmailClaimName string
    The claim name for email in the id_token response.
    HeaderAttributes List<GetZeroTrustAccessIdentityProvidersResultConfigHeaderAttribute>
    Add a list of attribute names that will be returned in the response header from the Access callback.
    IdpPublicCerts List<string>
    X509 certificate to verify the signature in the SAML authentication response
    IssuerUrl string
    IdP Entity ID or Issuer URL
    OktaAccount string
    Your okta account url
    OneloginAccount string
    Your OneLogin account url
    PingEnvId string
    Your PingOne environment identifier
    PkceEnabled bool
    Enable Proof Key for Code Exchange (PKCE)
    Prompt string
    Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", <span pulumi-lang-nodejs=""selectAccount"" pulumi-lang-dotnet=""SelectAccount"" pulumi-lang-go=""selectAccount"" pulumi-lang-python=""select_account"" pulumi-lang-yaml=""selectAccount"" pulumi-lang-java=""selectAccount"">"select_account", "none".
    Scopes List<string>
    OAuth scopes
    SignRequest bool
    Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
    SsoTargetUrl string
    URL to send the SAML authentication requests to
    SupportGroups bool
    Should Cloudflare try to load groups from your account
    TokenUrl string
    The token_endpoint URL of your IdP
    AppsDomain string
    Your companies TLD
    Attributes []string
    A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
    AuthUrl string
    The authorization_endpoint URL of your IdP
    AuthorizationServerId string
    Your okta authorization server id
    CentrifyAccount string
    Your centrify account url
    CentrifyAppId string
    Your centrify app id
    CertsUrl string
    The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
    Claims []string
    Custom claims
    ClientId string
    Your OAuth Client ID
    ClientSecret string
    Your OAuth Client Secret
    ConditionalAccessEnabled bool
    Should Cloudflare try to load authentication contexts from your account
    DirectoryId string
    Your Azure directory uuid
    EmailAttributeName string
    The attribute name for email in the SAML response.
    EmailClaimName string
    The claim name for email in the id_token response.
    HeaderAttributes []GetZeroTrustAccessIdentityProvidersResultConfigHeaderAttribute
    Add a list of attribute names that will be returned in the response header from the Access callback.
    IdpPublicCerts []string
    X509 certificate to verify the signature in the SAML authentication response
    IssuerUrl string
    IdP Entity ID or Issuer URL
    OktaAccount string
    Your okta account url
    OneloginAccount string
    Your OneLogin account url
    PingEnvId string
    Your PingOne environment identifier
    PkceEnabled bool
    Enable Proof Key for Code Exchange (PKCE)
    Prompt string
    Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", <span pulumi-lang-nodejs=""selectAccount"" pulumi-lang-dotnet=""SelectAccount"" pulumi-lang-go=""selectAccount"" pulumi-lang-python=""select_account"" pulumi-lang-yaml=""selectAccount"" pulumi-lang-java=""selectAccount"">"select_account", "none".
    Scopes []string
    OAuth scopes
    SignRequest bool
    Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
    SsoTargetUrl string
    URL to send the SAML authentication requests to
    SupportGroups bool
    Should Cloudflare try to load groups from your account
    TokenUrl string
    The token_endpoint URL of your IdP
    appsDomain String
    Your companies TLD
    attributes List<String>
    A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
    authUrl String
    The authorization_endpoint URL of your IdP
    authorizationServerId String
    Your okta authorization server id
    centrifyAccount String
    Your centrify account url
    centrifyAppId String
    Your centrify app id
    certsUrl String
    The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
    claims List<String>
    Custom claims
    clientId String
    Your OAuth Client ID
    clientSecret String
    Your OAuth Client Secret
    conditionalAccessEnabled Boolean
    Should Cloudflare try to load authentication contexts from your account
    directoryId String
    Your Azure directory uuid
    emailAttributeName String
    The attribute name for email in the SAML response.
    emailClaimName String
    The claim name for email in the id_token response.
    headerAttributes List<GetZeroTrustAccessIdentityProvidersResultConfigHeaderAttribute>
    Add a list of attribute names that will be returned in the response header from the Access callback.
    idpPublicCerts List<String>
    X509 certificate to verify the signature in the SAML authentication response
    issuerUrl String
    IdP Entity ID or Issuer URL
    oktaAccount String
    Your okta account url
    oneloginAccount String
    Your OneLogin account url
    pingEnvId String
    Your PingOne environment identifier
    pkceEnabled Boolean
    Enable Proof Key for Code Exchange (PKCE)
    prompt String
    Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", <span pulumi-lang-nodejs=""selectAccount"" pulumi-lang-dotnet=""SelectAccount"" pulumi-lang-go=""selectAccount"" pulumi-lang-python=""select_account"" pulumi-lang-yaml=""selectAccount"" pulumi-lang-java=""selectAccount"">"select_account", "none".
    scopes List<String>
    OAuth scopes
    signRequest Boolean
    Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
    ssoTargetUrl String
    URL to send the SAML authentication requests to
    supportGroups Boolean
    Should Cloudflare try to load groups from your account
    tokenUrl String
    The token_endpoint URL of your IdP
    appsDomain string
    Your companies TLD
    attributes string[]
    A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
    authUrl string
    The authorization_endpoint URL of your IdP
    authorizationServerId string
    Your okta authorization server id
    centrifyAccount string
    Your centrify account url
    centrifyAppId string
    Your centrify app id
    certsUrl string
    The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
    claims string[]
    Custom claims
    clientId string
    Your OAuth Client ID
    clientSecret string
    Your OAuth Client Secret
    conditionalAccessEnabled boolean
    Should Cloudflare try to load authentication contexts from your account
    directoryId string
    Your Azure directory uuid
    emailAttributeName string
    The attribute name for email in the SAML response.
    emailClaimName string
    The claim name for email in the id_token response.
    headerAttributes GetZeroTrustAccessIdentityProvidersResultConfigHeaderAttribute[]
    Add a list of attribute names that will be returned in the response header from the Access callback.
    idpPublicCerts string[]
    X509 certificate to verify the signature in the SAML authentication response
    issuerUrl string
    IdP Entity ID or Issuer URL
    oktaAccount string
    Your okta account url
    oneloginAccount string
    Your OneLogin account url
    pingEnvId string
    Your PingOne environment identifier
    pkceEnabled boolean
    Enable Proof Key for Code Exchange (PKCE)
    prompt string
    Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", <span pulumi-lang-nodejs=""selectAccount"" pulumi-lang-dotnet=""SelectAccount"" pulumi-lang-go=""selectAccount"" pulumi-lang-python=""select_account"" pulumi-lang-yaml=""selectAccount"" pulumi-lang-java=""selectAccount"">"select_account", "none".
    scopes string[]
    OAuth scopes
    signRequest boolean
    Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
    ssoTargetUrl string
    URL to send the SAML authentication requests to
    supportGroups boolean
    Should Cloudflare try to load groups from your account
    tokenUrl string
    The token_endpoint URL of your IdP
    apps_domain str
    Your companies TLD
    attributes Sequence[str]
    A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
    auth_url str
    The authorization_endpoint URL of your IdP
    authorization_server_id str
    Your okta authorization server id
    centrify_account str
    Your centrify account url
    centrify_app_id str
    Your centrify app id
    certs_url str
    The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
    claims Sequence[str]
    Custom claims
    client_id str
    Your OAuth Client ID
    client_secret str
    Your OAuth Client Secret
    conditional_access_enabled bool
    Should Cloudflare try to load authentication contexts from your account
    directory_id str
    Your Azure directory uuid
    email_attribute_name str
    The attribute name for email in the SAML response.
    email_claim_name str
    The claim name for email in the id_token response.
    header_attributes Sequence[GetZeroTrustAccessIdentityProvidersResultConfigHeaderAttribute]
    Add a list of attribute names that will be returned in the response header from the Access callback.
    idp_public_certs Sequence[str]
    X509 certificate to verify the signature in the SAML authentication response
    issuer_url str
    IdP Entity ID or Issuer URL
    okta_account str
    Your okta account url
    onelogin_account str
    Your OneLogin account url
    ping_env_id str
    Your PingOne environment identifier
    pkce_enabled bool
    Enable Proof Key for Code Exchange (PKCE)
    prompt str
    Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", <span pulumi-lang-nodejs=""selectAccount"" pulumi-lang-dotnet=""SelectAccount"" pulumi-lang-go=""selectAccount"" pulumi-lang-python=""select_account"" pulumi-lang-yaml=""selectAccount"" pulumi-lang-java=""selectAccount"">"select_account", "none".
    scopes Sequence[str]
    OAuth scopes
    sign_request bool
    Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
    sso_target_url str
    URL to send the SAML authentication requests to
    support_groups bool
    Should Cloudflare try to load groups from your account
    token_url str
    The token_endpoint URL of your IdP
    appsDomain String
    Your companies TLD
    attributes List<String>
    A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
    authUrl String
    The authorization_endpoint URL of your IdP
    authorizationServerId String
    Your okta authorization server id
    centrifyAccount String
    Your centrify account url
    centrifyAppId String
    Your centrify app id
    certsUrl String
    The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
    claims List<String>
    Custom claims
    clientId String
    Your OAuth Client ID
    clientSecret String
    Your OAuth Client Secret
    conditionalAccessEnabled Boolean
    Should Cloudflare try to load authentication contexts from your account
    directoryId String
    Your Azure directory uuid
    emailAttributeName String
    The attribute name for email in the SAML response.
    emailClaimName String
    The claim name for email in the id_token response.
    headerAttributes List<Property Map>
    Add a list of attribute names that will be returned in the response header from the Access callback.
    idpPublicCerts List<String>
    X509 certificate to verify the signature in the SAML authentication response
    issuerUrl String
    IdP Entity ID or Issuer URL
    oktaAccount String
    Your okta account url
    oneloginAccount String
    Your OneLogin account url
    pingEnvId String
    Your PingOne environment identifier
    pkceEnabled Boolean
    Enable Proof Key for Code Exchange (PKCE)
    prompt String
    Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", <span pulumi-lang-nodejs=""selectAccount"" pulumi-lang-dotnet=""SelectAccount"" pulumi-lang-go=""selectAccount"" pulumi-lang-python=""select_account"" pulumi-lang-yaml=""selectAccount"" pulumi-lang-java=""selectAccount"">"select_account", "none".
    scopes List<String>
    OAuth scopes
    signRequest Boolean
    Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
    ssoTargetUrl String
    URL to send the SAML authentication requests to
    supportGroups Boolean
    Should Cloudflare try to load groups from your account
    tokenUrl String
    The token_endpoint URL of your IdP

    GetZeroTrustAccessIdentityProvidersResultConfigHeaderAttribute

    AttributeName string
    attribute name from the IDP
    HeaderName string
    header that will be added on the request to the origin
    AttributeName string
    attribute name from the IDP
    HeaderName string
    header that will be added on the request to the origin
    attributeName String
    attribute name from the IDP
    headerName String
    header that will be added on the request to the origin
    attributeName string
    attribute name from the IDP
    headerName string
    header that will be added on the request to the origin
    attribute_name str
    attribute name from the IDP
    header_name str
    header that will be added on the request to the origin
    attributeName String
    attribute name from the IDP
    headerName String
    header that will be added on the request to the origin

    GetZeroTrustAccessIdentityProvidersResultScimConfig

    Enabled bool
    A flag to enable or disable SCIM for the identity provider.
    IdentityUpdateBehavior string
    Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
    ScimBaseUrl string
    The base URL of Cloudflare's SCIM V2.0 API endpoint.
    SeatDeprovision bool
    A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
    Secret string
    A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
    UserDeprovision bool
    A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
    Enabled bool
    A flag to enable or disable SCIM for the identity provider.
    IdentityUpdateBehavior string
    Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
    ScimBaseUrl string
    The base URL of Cloudflare's SCIM V2.0 API endpoint.
    SeatDeprovision bool
    A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
    Secret string
    A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
    UserDeprovision bool
    A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
    enabled Boolean
    A flag to enable or disable SCIM for the identity provider.
    identityUpdateBehavior String
    Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
    scimBaseUrl String
    The base URL of Cloudflare's SCIM V2.0 API endpoint.
    seatDeprovision Boolean
    A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
    secret String
    A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
    userDeprovision Boolean
    A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
    enabled boolean
    A flag to enable or disable SCIM for the identity provider.
    identityUpdateBehavior string
    Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
    scimBaseUrl string
    The base URL of Cloudflare's SCIM V2.0 API endpoint.
    seatDeprovision boolean
    A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
    secret string
    A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
    userDeprovision boolean
    A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
    enabled bool
    A flag to enable or disable SCIM for the identity provider.
    identity_update_behavior str
    Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
    scim_base_url str
    The base URL of Cloudflare's SCIM V2.0 API endpoint.
    seat_deprovision bool
    A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
    secret str
    A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
    user_deprovision bool
    A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
    enabled Boolean
    A flag to enable or disable SCIM for the identity provider.
    identityUpdateBehavior String
    Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
    scimBaseUrl String
    The base URL of Cloudflare's SCIM V2.0 API endpoint.
    seatDeprovision Boolean
    A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
    secret String
    A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
    userDeprovision Boolean
    A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

    Package Details

    Repository
    Cloudflare pulumi/pulumi-cloudflare
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the cloudflare Terraform Provider.
    cloudflare logo
    Cloudflare v6.10.1 published on Wednesday, Oct 22, 2025 by Pulumi
    pulumi/pulumi-cloudflare
      Meet Neo: Your AI Platform Teammate