# Update SSO connection

<Heading
  as={"h1"}
  className={"openapi__heading"}
  children={"Update SSO connection"}
>
</Heading>

<MethodEndpoint
  method={"put"}
  path={"/api/v1/organization/{organization_id}/sso-connections/{sso_connection_id}"}
  context={"endpoint"}
>
  
</MethodEndpoint>

Updates an SSO connection. Omitted optional fields keep their stored values; secrets are only replaced when a new value is supplied.

<Heading
  id={"request"}
  as={"h2"}
  className={"openapi-tabs__heading"}
  children={"Request"}
>
</Heading>

<ParamsDetails
  parameters={[{"description":"Unique identifier of the organization that owns the SSO connection.","in":"path","name":"organization_id","required":true,"schema":{"description":"Unique identifier of the organization that owns the SSO connection.","format":"uuid","title":"Organization Id","type":"string"}},{"description":"Unique identifier of the SSO connection.","in":"path","name":"sso_connection_id","required":true,"schema":{"description":"Unique identifier of the SSO connection.","format":"uuid","title":"Sso Connection Id","type":"string"}}]}
>
  
</ParamsDetails>

<RequestSchema
  title={"Body"}
  body={{"content":{"application/json":{"schema":{"properties":{"binding_type":{"anyOf":[{"enum":["REDIRECT","POST","POST_AUTO"],"type":"string"},{"type":"null"}],"description":"SAML binding used for the authentication request: 'REDIRECT', 'POST', or 'POST_AUTO'. Omit to keep the current binding.","title":"SAML Binding"},"client_id":{"anyOf":[{"minLength":1,"type":"string"},{"type":"null"}],"description":"OIDC client ID (consumer key) issued by the identity provider. Omit to keep the existing one.","title":"OIDC Client ID"},"client_secret":{"anyOf":[{"minLength":1,"type":"string"},{"type":"null"}],"description":"OIDC client secret. Stored encrypted and never returned. Omit to keep the existing one.","title":"OIDC Client Secret"},"display_name":{"description":"Human-readable name for the SSO connection. Must be unique within the organization.","minLength":1,"title":"Display Name","type":"string"},"domains":{"anyOf":[{"items":{"type":"string"},"maxItems":50,"type":"array"},{"type":"null"}],"description":"Email domains routed to this connection at login. Public/free email providers (for example 'gmail.com') are rejected, and each domain may be claimed by only one connection. Omit to keep the current domains.","title":"Email Domains"},"enabled":{"anyOf":[{"type":"boolean"},{"type":"null"}],"description":"Whether the connection accepts logins. Omit to keep the current enabled state.","title":"Enabled"},"idp_signing_certificate":{"anyOf":[{"minLength":1,"type":"string"},{"type":"null"}],"description":"New PEM-encoded X.509 IdP signing certificate. Omit to keep the existing one.","title":"IdP Signing Certificate"},"issuer":{"anyOf":[{"minLength":1,"type":"string"},{"type":"null"}],"description":"SAML identity-provider issuer / entity ID. Omit to keep the existing one.","title":"SAML Issuer"},"oidc_well_known_url":{"anyOf":[{"minLength":1,"type":"string"},{"type":"null"}],"description":"OIDC discovery (.well-known/openid-configuration) URL of the identity provider. Omit to keep the existing one.","title":"OIDC Discovery URL"},"sign_requests":{"anyOf":[{"type":"boolean"},{"type":"null"}],"description":"Whether to sign outbound SAML authentication requests. Most identity providers do not require this. Omit to keep the current setting.","title":"Sign SAML Requests"},"slo_url":{"anyOf":[{"minLength":1,"type":"string"},{"type":"null"}],"description":"SAML identity-provider single logout URL. Omit to keep the existing one.","title":"SAML SLO URL"},"sso_url":{"anyOf":[{"minLength":1,"type":"string"},{"type":"null"}],"description":"SAML identity-provider single sign-on (login) URL. Omit to keep the existing one.","title":"SAML SSO URL"},"vendor":{"anyOf":[{"description":"Predefined OIDC IdP vendors. Map to Authentik's dedicated OAuth provider types;\nanything else (or unset) falls back to generic ``openidconnect``. Not applicable to SAML.","enum":["GOOGLE_WORKSPACE","MICROSOFT_ENTRA_ID","OKTA","AUTH0"],"title":"SSOConnectionVendor","type":"string"},{"type":"null"}],"description":"Predefined OIDC identity-provider vendor (uses Authentik's dedicated provider type). Omit for a generic OIDC IdP. Ignored for SAML. Omit to keep the current vendor.","title":"OIDC Vendor"}},"required":["display_name"],"title":"SSOConnectionUpdateRequest","type":"object"}}},"required":true}}
>
  
</RequestSchema>

<StatusCodes
  id={undefined}
  label={undefined}
  responses={{"200":{"content":{"application/json":{"schema":{"properties":{"callback_url":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Redirect/callback URL the admin must register at the OIDC identity provider. Unique per connection and populated only after creation. Null for SAML connections.","title":"Callback URL"},"config":{"additionalProperties":true,"description":"Non-secret protocol configuration echoed back for the UI (discovered/echoed URLs, issuer, binding, and the callback/ACS URL).","title":"Protocol Configuration","type":"object"},"created_at":{"description":"Timestamp when the connection was created, in ISO 8601 format.","format":"date-time","title":"Created At","type":"string"},"display_name":{"description":"Human-readable name for the SSO connection. Must be unique within the organization.","title":"Display Name","type":"string"},"domains":{"description":"Email domains routed to this connection at login. Public/free email providers (for example 'gmail.com') are rejected, and each domain may be claimed by only one connection.","items":{"type":"string"},"title":"Email Domains","type":"array"},"enabled":{"description":"Whether the connection accepts logins. Disabled connections are configured but not active.","title":"Enabled","type":"boolean"},"organization_id":{"description":"Unique identifier of the organization that owns the SSO connection.","format":"uuid","title":"Organization ID","type":"string"},"provider_type":{"description":"SSO protocol the connection uses: 'OIDC' or 'SAML'.","title":"Provider Type","type":"string"},"sso_connection_id":{"description":"Unique identifier of the SSO connection.","format":"uuid","title":"SSO Connection ID","type":"string"},"vendor":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Predefined OIDC identity-provider vendor (uses Authentik's dedicated provider type). Omit for a generic OIDC IdP. Ignored for SAML.","title":"OIDC Vendor"}},"required":["sso_connection_id","organization_id","display_name","provider_type","enabled","domains","config","created_at"],"title":"SSOConnectionResponse","type":"object"}}},"description":"Successful Response"},"422":{"content":{"application/json":{"schema":{"properties":{"detail":{"items":{"properties":{"ctx":{"title":"Context","type":"object"},"input":{"title":"Input"},"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"title":"Location","type":"array"},"msg":{"title":"Message","type":"string"},"type":{"title":"Error Type","type":"string"}},"required":["loc","msg","type"],"title":"ValidationError","type":"object"},"title":"Detail","type":"array"}},"title":"HTTPValidationError","type":"object"}}},"description":"Validation Error"}}}
>
  
</StatusCodes>