Skip to main content
PUT
Configure SSO
string
required
Your Organisation UUID.
saml | oidc
required
SSO protocol to configure.
boolean
Enable or disable SSO. Default false.
SAML-specific fields:
string
IdP Entity ID from the IdP metadata (e.g. https://sts.windows.net/{tenant-id}/).
string
IdP SSO URL from the app’s SAML settings (e.g. https://login.microsoftonline.com/{tenant}/saml2).
string
Base64-encoded X.509 certificate from the IdP (no PEM headers). Download from your IdP’s SAML signing certificate.
boolean
Sign outgoing AuthnRequests with the SP private key. Default false.
object
Map IdP attribute URIs to VG fields. Example: {"email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", "name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"}
string[]
Email domains that must authenticate via SSO. Example: ["apollo.com", "apollogroup.io"]
boolean
Auto-create user accounts on first SSO login. Default true.
string[]
Roles assigned to JIT-provisioned users. Default ["member"].
OIDC federation fields:
string
External OIDC IdP issuer URL (e.g. https://login.microsoftonline.com/{tenant}/v2.0).
string
Client ID registered with the external IdP.
string
Client secret (write-only — never returned).
string
Space-separated scopes. Default openid profile email.
string
SSO configuration saved