Creates an identity provider connection and assigns it to the domains and products named in the request, in a single call. Returns the created connection as GET /connections/{connectionId} would.

connectionType selects which provider settings are expected in connection; connection.region selects the region the connection is created in. domains must all be verified — see POST /domains/{domainId}/actions/verify. enabledProducts names the products, and the tenants of those products, the connection signs users in to; use enabledEnvironments instead for products scoped by environment.

Creation and assignment are applied together: if the connection is created but cannot be assigned, it is deleted again rather than left behind for you to find. Only OIDC, WAAD, OKTA, and GOOGLE_APPS connections can be created.