Skip to main content
PUT
Create or update the tenant's SAML IdP configuration (owner/admin only)
Creates the tenant’s SAML SSO connection, or replaces it if one already exists. Each tenant has exactly one connection, so a PUT is idempotent: send the full IdP configuration every time, not a partial patch. Configure the identity provider either by pasting its full metadata document in idp_metadata_xml, or by supplying all three discrete fields — idp_entity_id, idp_sso_url and idp_certificate. When both are present, the metadata XML wins. Set enabled: true to switch on the public login and ACS endpoints for the tenant. Enabling a connection that is not fully configured is rejected, so you can save a draft with enabled: false and flip it on once the IdP side is done. The response includes the SP URLs to register with the IdP; read them back later with GET /v1/sso/connection. Only owners and admins can call this endpoint from a dashboard session; members receive 403. API-key callers act with full tenant access.

Request Body

Whitespace around every string field is trimmed before it is stored.

Example Request

Response

Fields

Errors

Errors use the standard envelope — see Errors.

Authorizations

recurso_session
string
cookie
required

Dashboard user session cookie (httpOnly) issued by POST /auth/register and POST /auth/login. v1 endpoints accept EITHER this cookie or the tenant API key (bearerAuth).

Body

application/json
idp_entity_id
string
idp_sso_url
string
idp_certificate
string
idp_metadata_xml
string
enabled
boolean

Response

The upserted connection.

data
object