Testlie
Menu

Reference

On this page

Identity API

Endpoints for mock identity providers, their test users, activity log and SCIM provisioning. Authentication, roles, errors and paging are described in the API overview.

The IdPs' own protocol endpoints (/idp/<slug>/...: discovery, authorize, token, userinfo, SAML SSO, the debugger) take no team authentication. They are listed in Mock identity providers, Mock social login and IdP failure modes, MFA & debugger.

Identity providers

Method and path Role Description
GET /api/idps Member Every IdP of the team, with userCount, credentials, signing certificate and URLs
POST /api/idps Admin Create one: { "name", "kind"?, "redirectUris"?, "social"? }. 201 { idp }
GET /api/idps/:id Member One IdP
PATCH /api/idps/:id Admin Change any setting below
DELETE /api/idps/:id Admin Delete the IdP, its users and its activity. 204
POST /api/idps/:id/rotate Admin { "what": "secret" } replaces the client secret; { "what": "keys" } replaces the signing key and certificate. Old values stop working at once

kind is generic (OIDC and SAML, the default) or a social login preset: google, github, apple, microsoft or uaepass. See Mock social login for the social settings.

Settings PATCH accepts:

Field Notes
name 1 to 80 characters
redirectUris, postLogoutRedirectUris Up to 30 absolute URLs each. Custom app schemes (com.example.app:/callback) are allowed; javascript:, data:, file: and similar are not
tokenTtl Token lifetime in seconds, 60 to 86,400
autoLoginUserId A test user who is signed in without the login screen, or null
requireTeamSession Only signed-in members of your team can use the IdP. Team plan and above (402 otherwise)
samlAcsUrl, samlSpEntityId Your SAML service provider's ACS URL and entity ID
samlNameIdFormat The emailAddress, persistent or unspecified NameID format URN
faults Default failure mode: { "mode": "<fault id>" | null, "skewSeconds"?, "delayMs"? }. See Failure modes
mfa off, always or on_request. See MFA and step-up
social Social preset settings, merged with the stored ones
bash
curl -X PATCH https://app.testlie.com/api/idps/$IDP_ID \
  -H "Authorization: Bearer $TESTLIE_API_KEY" -H "Content-Type: application/json" \
  -d '{ "redirectUris": ["http://localhost:3000/api/auth/callback/testlie"], "mfa": "on_request",
        "faults": { "mode": "expired_id_token" } }'
json
{
  "idp": {
    "id": "cm4d2…",
    "name": "Staging SSO",
    "slug": "staging-sso-4f2a",
    "kind": "generic",
    "clientId": "…",
    "clientSecret": "…",
    "redirectUris": ["http://localhost:3000/api/auth/callback/testlie"],
    "postLogoutRedirectUris": [],
    "tokenTtl": 3600,
    "autoLoginUserId": null,
    "requireTeamSession": false,
    "faults": { "mode": "expired_id_token", "skewSeconds": 300, "delayMs": 10000 },
    "mfa": "on_request",
    "saml": { "spEntityId": null, "acsUrl": null, "nameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" },
    "certificate": "-----BEGIN CERTIFICATE-----…",
    "urls": { "issuer": "https://app.testlie.com/idp/staging-sso-4f2a", "…": "…" },
    "social": null,
    "createdAt": "2026-10-23T10:30:00.000Z"
  }
}

The response is abridged here. Creating more IdPs than the plan allows answers 402.

Test users

Method and path Role Description
GET /api/idps/:id/users Member The IdP's test users, in creation order
POST /api/idps/:id/users Admin Add a user (fields below). 201 { user }. 409 if another user has the same subject
PATCH /api/idps/:id/users/:userId Admin Change any field below
DELETE /api/idps/:id/users/:userId Admin Remove the user. 204
DELETE /api/idps/:id/users/:userId/consent Admin Social presets only: revoke the user's consent and tokens. 204
Field Notes
email Required
name Required, 1 to 120 characters
subject The sub claim and SAML NameID. Generated when left out
groups Up to 50 group names, sent as the groups claim and SAML attribute
claims Extra claims, any JSON values. sub, iss, aud, exp, iat, nonce and auth_time cannot be overridden
profile Provider-specific fields for social presets

A user in a response also has id, scimId (its ID in your app after SCIM provisioning) and createdAt.

Activity log

Method and path Role Description
GET /api/idps/:id/events Member Every request and answer, newest first: after (ISO time, only newer events, for polling), limit (default 100, max 500). { events }
DELETE /api/idps/:id/events Admin Clear the log. 204

Events of a sign-in with a failure mode carry details.fault.

SCIM provisioning

SCIM provisioning is included from the Team plan. On other plans, setting a target or starting a run answers 402 with "code": "feature_unavailable". How runs work and how answers are graded is described in SCIM provisioning.

Method and path Role Description
GET /api/idps/:id/scim Member { available, scim }: whether the plan includes SCIM, and the target { baseUrl, hasToken, groupIds, provisionedUsers, updatedAt } or null. The token is never returned
PUT /api/idps/:id/scim Admin Set the target: { "baseUrl", "token"? }. The token (8 characters or more) is required the first time. A new baseUrl forgets the remote IDs of the old target
DELETE /api/idps/:id/scim Admin Remove the target and forget every remote ID. 204
POST /api/idps/:id/scim/runs Admin Queue a run: { "action", "userId"? }. 202 { run }
GET /api/idps/:id/scim/runs Member The latest 50 runs, newest first
GET /api/idps/:id/scim/runs/:runId Member One run with its steps: every request and response (token redacted), status, durationMs, error and graded checks

action is push_all, push_user, update_patch, update_put, deactivate, delete, push_groups or compliance. The per-user actions (push_user, update_patch, update_put, deactivate, delete) need a userId.

bash
curl -X POST https://app.testlie.com/api/idps/$IDP_ID/scim/runs \
  -H "Authorization: Bearer $TESTLIE_API_KEY" -H "Content-Type: application/json" \
  -d '{ "action": "compliance" }'
json
{ "run": { "id": "cm4e9…", "idpId": "cm4d2…", "action": "compliance", "userId": null, "status": "queued",
           "summary": null, "passed": 0, "failed": 0, "createdBy": "API key CI", "startedAt": null, "finishedAt": null,
           "createdAt": "2026-10-23T10:31:00.000Z" } }

Poll GET /api/idps/:id/scim/runs/:runId until status is passed, failed or error (the run could not complete, for example because the target or the user was removed meanwhile). passed and failed count the steps; summary describes the result in one line. Starting a run without a target answers 400, and while another run of the same IdP is queued or running, 409.