Aha, so you're saying I could do this via the API?
The wiki article isn't very clear on how to setup authentication realms - it seems to imply you need to setup a /etc/pve/domains.cfg file. I'm searching, but the documentation on this is rather sparse - happy to contribute to the wiki...