> ## Documentation Index > Fetch the complete documentation index at: https://docs.nvisy.com/llms.txt > Use this file to discover all available pages before exploring further. # Link a provider > Begins linking the given OpenID Connect provider to the authenticated account and returns the provider authorize URL. Requires a step-up re-authentication proof (`reauthProof`, from the reauth endpoint). On consent, the callback attaches the verified provider identity to the caller's account. ## OpenAPI ````yaml /api-reference/openapi.json post /account/identities/{provider} openapi: 3.1.0 info: title: Nvisy API summary: Document detection and redaction platform description: >- Nvisy provides intelligent detection of sensitive content in documents, redaction pipelines, and reviewer workflows. This API enables document upload, detection analysis, redaction, and collaborative review across your workspaces. termsOfService: https://nvisy.com/legal/terms-of-service contact: name: Nvisy Support url: https://nvisy.com email: hello@nvisy.com license: name: Apache-2.0 url: https://www.apache.org/licenses/LICENSE-2.0 version: 0.1.0 servers: [] security: [] tags: - name: Health description: Service health checks - name: Capabilities description: Read-only reference data describing this deployment - name: Accounts description: Account management and profile operations - name: Identities description: 'Account sign-in methods: password and linked providers' - name: Avatars description: Public avatar image serving - name: Authentication description: Login, signup, and token management - name: Workspaces description: Workspace creation and management - name: Activities description: Workspace activity log and export - name: Documents description: Document upload, download, and management - name: Analytics description: Aggregate metrics over a workspace's documents - name: Members description: Workspace member management - name: Invites description: Workspace invitation handling - name: API Tokens description: API token management - name: Connections description: External provider connections - name: Connection Syncs description: Connection synchronization runs - name: Providers description: Inference-provider configuration - name: Pipelines description: Redaction pipeline configuration - name: Detections description: Detection analysis and redaction - name: Redactions description: Redactions produced from a detection, with reviewer edits - name: Reviews description: Document reviews, the review queue, and their discussion - name: Policies description: Redaction policy configuration - name: Webhooks description: Webhook configuration - name: Notifications description: Account notification management paths: /account/identities/{provider}: post: tags: - Identities summary: Link a provider description: >- Begins linking the given OpenID Connect provider to the authenticated account and returns the provider authorize URL. Requires a step-up re-authentication proof (`reauthProof`, from the reauth endpoint). On consent, the callback attaches the verified provider identity to the caller's account. parameters: - in: path name: provider description: The identity provider to act on. required: true schema: $ref: '#/components/schemas/IdentityProvider' description: The identity provider to act on. style: simple - in: query name: reauthProof description: >- A step-up re-authentication proof. Required to start a *link* (adding a provider is a credential-adding action, so a live session alone is not enough); ignored for sign-in and reauth. schema: description: >- A step-up re-authentication proof. Required to start a *link* (adding a provider is a credential-adding action, so a live session alone is not enough); ignored for sign-in and reauth. type: string style: form - in: query name: redirectUri description: >- Frontend URL to return to once done. Carried through the flow and used to build the callback's redirect. schema: description: >- Frontend URL to return to once done. Carried through the flow and used to build the callback's redirect. type: string style: form responses: '200': description: 'The response to a successful sign-in start: where to send the user.' content: application/json: schema: $ref: '#/components/schemas/OidcStartResponse' '401': description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '503': description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - BearerAuth: [] components: schemas: IdentityProvider: description: >- How an account authenticates. Corresponds to the `IDENTITY_PROVIDER` `PostgreSQL` enum. [`Password`] is a locally-held Argon2 secret; the rest are external OIDC providers keyed by the provider's subject claim. [`Password`]: Self::Password oneOf: - description: Local password, stored as an Argon2 hash. type: string const: password - description: Google (OIDC). type: string const: google - description: Microsoft / Entra ID (OIDC). type: string const: microsoft OidcStartResponse: description: 'The response to a successful sign-in start: where to send the user.' type: object properties: authorizeUrl: description: The provider authorize URL the client should redirect the user to. type: string required: - authorizeUrl ErrorResponse: description: >- The serialized shape of an HTTP error: the inert wire/OpenAPI-schema view that [`Error`] renders to at the response boundary. It carries no builder logic — [`Error`] is the type handlers construct and thread through `Result`, and it builds an `ErrorResponse` directly in its `IntoResponse` impl. `context` and `status` are not part of the JSON body (`context` is logged, `status` sets the HTTP status line). [`Error`]: crate::response::Error type: object properties: message: description: User-friendly error message safe for client display. type: string name: description: The error name/type identifier. type: string required: - name - message ````