Depot portalidp

Registers the routes on the portal admin mux.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/clients/{clientID}/portal/idp-connections

GETclientportal:managemsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

listPortalIdps lists the client’s portal sign-in connections.

Secrets are never returned.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PagedResultIdpConnectionView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:manage.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
itemsrequired	array of IdpConnectionView
items[].allowedPurposesrequired	array of string
items[].autoCreateNamedUserrequired	boolean
items[].clientIdrequired	string
items[].displayNamerequired	string
items[].hasClientSecretrequired	boolean
items[].hostedDomain	string or null
items[].identifierClaimrequired	string
items[].issuerrequired	string
items[].providerrequired	string
items[].publicIdrequired	string
items[].rowVersionrequired	integer	int64.
items[].scopesrequired	array of string
items[].secretExpiresAt	string (date-time) or null
items[].staterequired	string
items[].tenantHint	string or null
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/clients/{clientID}/portal/idp-connections

POSTclientportal:managemsp facemsp

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

createPortalIdp adds the client’s own identity provider for portal sign-in.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
clientIdrequired	string
clientSecretrequired	string
displayNamerequired	string
hostedDomainrequired	string
identifierClaimrequired	string
issuerrequired	string
providerrequired	string
scopesrequired	array of string
secretExpiresAt	string (date-time) or null
tenantHintrequired	string

Responses

Status	Body	Description
201	application/json, IdpConnectionView	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:manage.
404	application/problem+json, ProblemDetails	No client matches that id.
409	application/problem+json, ProblemDetails	The identity provider could not be saved.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

201 response body

Field	Type	Description
allowedPurposesrequired	array of string
autoCreateNamedUserrequired	boolean
clientIdrequired	string
displayNamerequired	string
hasClientSecretrequired	boolean
hostedDomain	string or null
identifierClaimrequired	string
issuerrequired	string
providerrequired	string
publicIdrequired	string
rowVersionrequired	integer	int64.
scopesrequired	array of string
secretExpiresAt	string (date-time) or null
staterequired	string
tenantHint	string or null

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "clientId": "string",
  "clientSecret": "string",
  "displayName": "string",
  "hostedDomain": "string",
  "identifierClaim": "string",
  "issuer": "string",
  "provider": "string",
  "scopes": [
    "string"
  ],
  "secretExpiresAt": "2026-01-01T00:00:00Z",
  "tenantHint": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "clientId": "string",
  "clientSecret": "string",
  "displayName": "string",
  "hostedDomain": "string",
  "identifierClaim": "string",
  "issuer": "string",
  "provider": "string",
  "scopes": [
    "string"
  ],
  "secretExpiresAt": "2026-01-01T00:00:00Z",
  "tenantHint": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "clientId": "string",
    "clientSecret": "string",
    "displayName": "string",
    "hostedDomain": "string",
    "identifierClaim": "string",
    "issuer": "string",
    "provider": "string",
    "scopes": [
        "string",
    ],
    "secretExpiresAt": "2026-01-01T00:00:00Z",
    "tenantHint": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "clientId": "string",
  "clientSecret": "string",
  "displayName": "string",
  "hostedDomain": "string",
  "identifierClaim": "string",
  "issuer": "string",
  "provider": "string",
  "scopes": [
    "string"
  ],
  "secretExpiresAt": "2026-01-01T00:00:00Z",
  "tenantHint": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "clientId": "string",
    "clientSecret": "string",
    "displayName": "string",
    "hostedDomain": "string",
    "identifierClaim": "string",
    "issuer": "string",
    "provider": "string",
    "scopes": [
      "string"
    ],
    "secretExpiresAt": "2026-01-01T00:00:00Z",
    "tenantHint": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "clientId": "string",
  "clientSecret": "string",
  "displayName": "string",
  "hostedDomain": "string",
  "identifierClaim": "string",
  "issuer": "string",
  "provider": "string",
  "scopes": [
    "string"
  ],
  "secretExpiresAt": "2026-01-01T00:00:00Z",
  "tenantHint": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH /api/v1/clients/{clientID}/portal/idp-connections/{id}

PATCHclientportal:managemsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

patchPortalIdp changes a portal sign-in connection.

Its purposes are not changed here.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
id	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
clearSecretExpiryrequired	boolean
clientId	string or null
clientSecret	string or null
displayName	string or null
hostedDomain	string or null
identifierClaim	string or null
issuer	string or null
rowVersionrequired	integer	int64.
scopes	array of string or null
secretExpiresAt	string (date-time) or null
state	string or null
tenantHint	string or null

Responses

Status	Body	Description
200	application/json, IdpConnectionView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:manage.
404	application/problem+json, ProblemDetails	No client matches that id.
409	application/problem+json, ProblemDetails	This identity provider changed since you loaded it. Reload and try again.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
allowedPurposesrequired	array of string
autoCreateNamedUserrequired	boolean
clientIdrequired	string
displayNamerequired	string
hasClientSecretrequired	boolean
hostedDomain	string or null
identifierClaimrequired	string
issuerrequired	string
providerrequired	string
publicIdrequired	string
rowVersionrequired	integer	int64.
scopesrequired	array of string
secretExpiresAt	string (date-time) or null
staterequired	string
tenantHint	string or null

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PATCH 'https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections/<id>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "clearSecretExpiry": false,
  "clientId": "string",
  "clientSecret": "string",
  "displayName": "string",
  "hostedDomain": "string",
  "identifierClaim": "string",
  "issuer": "string",
  "rowVersion": 0,
  "scopes": [
    "string"
  ],
  "secretExpiresAt": "2026-01-01T00:00:00Z",
  "state": "string",
  "tenantHint": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "clearSecretExpiry": false,
  "clientId": "string",
  "clientSecret": "string",
  "displayName": "string",
  "hostedDomain": "string",
  "identifierClaim": "string",
  "issuer": "string",
  "rowVersion": 0,
  "scopes": [
    "string"
  ],
  "secretExpiresAt": "2026-01-01T00:00:00Z",
  "state": "string",
  "tenantHint": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections/<id>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections/<id>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "clearSecretExpiry": False,
    "clientId": "string",
    "clientSecret": "string",
    "displayName": "string",
    "hostedDomain": "string",
    "identifierClaim": "string",
    "issuer": "string",
    "rowVersion": 0,
    "scopes": [
        "string",
    ],
    "secretExpiresAt": "2026-01-01T00:00:00Z",
    "state": "string",
    "tenantHint": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "clearSecretExpiry": false,
  "clientId": "string",
  "clientSecret": "string",
  "displayName": "string",
  "hostedDomain": "string",
  "identifierClaim": "string",
  "issuer": "string",
  "rowVersion": 0,
  "scopes": [
    "string"
  ],
  "secretExpiresAt": "2026-01-01T00:00:00Z",
  "state": "string",
  "tenantHint": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections/<id>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections/<id>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "clearSecretExpiry": false,
    "clientId": "string",
    "clientSecret": "string",
    "displayName": "string",
    "hostedDomain": "string",
    "identifierClaim": "string",
    "issuer": "string",
    "rowVersion": 0,
    "scopes": [
      "string"
    ],
    "secretExpiresAt": "2026-01-01T00:00:00Z",
    "state": "string",
    "tenantHint": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "clearSecretExpiry": false,
  "clientId": "string",
  "clientSecret": "string",
  "displayName": "string",
  "hostedDomain": "string",
  "identifierClaim": "string",
  "issuer": "string",
  "rowVersion": 0,
  "scopes": [
    "string"
  ],
  "secretExpiresAt": "2026-01-01T00:00:00Z",
  "state": "string",
  "tenantHint": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections/<id>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/v1/clients/{clientID}/portal/idp-connections/{id}

DELETEclientportal:managemsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

deletePortalIdp removes a portal sign-in connection.

One an email domain still signs in through, or one that is also used for device enrollment, is refused.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
id	path	string	Yes	A uuid.

Responses

Status	Body	Description
204	None	Success, with no body.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:manage.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections/<id>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections/<id>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections/<id>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections/<id>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections/<id>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/clients/<clientID>/portal/idp-connections/<id>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());