Update OAuth Provider
PUT
/v1/endpoints/{uuid}/oauth/providers/{provider_uuid}
Edit configuration of an existing OAuth provider on an endpoint. Use this to rotate credentials, change scopes, swap auth/token URLs after the IdP migrates, or rename the provider's display label.
Pass an empty string for client_secret to keep the existing secret — anything non-empty replaces it. The handler can't tell the difference between "blank intent" and "you want me to clear the secret", so it interprets empty as "no change". To rotate, pass the new secret.
Strict JSON decoding. The provider_type can't be changed — delete and re-create with a different type.
Path parameters
The provider's
uuid. Get it from
/oauth/providers. It resolves only under the endpoint in the path.
Deprecated: the legacy integer id is still accepted in the path until the sunset, answered with Deprecation and Sunset headers. Use the uuid.
Request body
Same fields as create, minus provider_type (immutable — it's ignored if sent). All fields except client_secret update unconditionally — pass the full state you want. scopes is comma-separated; provider URLs must be https and resolve to public IPs.
See
create for full descriptions.
issuer +
jwks_url enable OIDC
id_token verification.
Pass empty string to keep the existing secret unchanged. Pass a new value to rotate. Encrypted at rest.
Response (200 OK)
The updated provider (same fields as a list entry); client_secret omitted, has_client_secret says whether one is stored.
Deprecated: until the sunset this response also carries the legacy integer id and *_id fields. Don't use them; read uuid and the *_uuid fields.
Errors
Unknown body fields (strict), invalid JSON, an integer provider id after the
sunset (
integer_id_unsupported), or a provider URL that isn't https / resolves to a private IP.
Caller lacks the endpoints:update permission in the active account.
Endpoint doesn't belong to the calling account, or provider not found / not on this endpoint.
Crypto error encrypting the new secret.
curl -X PUT "https://api.ngris.com/v1/endpoints/<uuid>/oauth/providers/019b407c-8a46-7001-897f-343e36ba8939" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{
"provider_name": "Sign in with Google",
"client_id": "1234567890-abc.apps.googleusercontent.com",
"client_secret": "GOCSPX-rotated-...",
"auth_url": "https://accounts.google.com/o/oauth2/v2/auth",
"token_url": "https://oauth2.googleapis.com/token",
"user_info_url": "https://www.googleapis.com/oauth2/v2/userinfo",
"scopes": "openid,email,profile",
"identifier_field": "email",
"enabled": true
}'
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
client.endpoint_oauth.update_provider(
"<endpoint_uuid>", "019b407c-8a46-7001-897f-343e36ba8939",
{
"provider_name": "Sign in with Google",
"client_id": "...",
"client_secret": "GOCSPX-rotated-...",
"auth_url": "https://accounts.google.com/o/oauth2/v2/auth",
"token_url": "https://oauth2.googleapis.com/token",
"user_info_url": "https://www.googleapis.com/oauth2/v2/userinfo",
"scopes": "openid,email,profile",
"identifier_field": "email",
"enabled": True,
},
)
{
"uuid": "019b407c-8a46-7001-897f-343e36ba8939",
"endpoint_uuid": "019bb1e4-e785-77d2-9966-c3cff31d0a0e",
"provider_type": "google",
"provider_name": "Sign in with Google",
"client_id": "1234567890-abc.apps.googleusercontent.com",
"auth_url": "https://accounts.google.com/o/oauth2/v2/auth",
"token_url": "https://oauth2.googleapis.com/token",
"user_info_url": "https://www.googleapis.com/oauth2/v2/userinfo",
"scopes": "openid,email,profile",
"identifier_field": "email",
"enabled": true,
"has_client_secret": true,
"created_at": "2026-04-01T00:00:00Z",
"updated_at": "2026-04-29T16:00:00Z"
}