Skip to content

Configure Saml Sso

PUT
/org/sso/saml

Configure SAML sign-in. Does NOT switch it on - see /activate.

Configuring and activating are separate calls in the app and stay separate here, so a half-finished configuration cannot lock anyone out.

Authorizations

Parameters

Header Parameters

X-Target-Org-Id
Any of:
string

Request Body required

SAML sign-in configuration.

The certificate and URLs come from the identity provider. Nothing here is guessable, which is why every one of the first four fields is required — a half-configured SSO that then gets activated is how an org locks itself out.

object
allowed_domains
Any of:
Array<string>
idp_certificate
required

X.509 certificate from the IdP, PEM format.

string
idp_entity_id
required

Identity Provider Entity ID.

string
idp_sso_url
required

SSO URL from the IdP.

string
provider_name
required

IdP name: okta, azure, google, onelogin, custom.

string
require_sso

Make SSO the ONLY way in. False here and set it later with PUT /org/sso/enforcement once you have signed in through SSO yourself — that ordering is what stops a lockout.

boolean

Responses

200

Successful Response

object
data
required

An open envelope for a settings object.

Open because an ontology concept and an SSO config both grow fields as the product does, and on a settings read a dropped field reads as “not configured” rather than “we did not tell you”.

object
key
additional properties
any
pagination
Any of:
object
has_next
required

Whether there are more pages

boolean
limit
required

Items per page

integer
next_cursor
Any of:
string
notes
Any of:
Array<string>
page
required

Current page number (1-indexed)

integer
total
required

Total number of items

integer
total_available
Any of:
integer
total_is_lower_bound
Any of:
boolean

422

Validation Error

object
detail
Array<object>
object
loc
required
Array
msg
required
string
type
required
string