Save the connection: OpenID Connect (issuer, client id and secret, token method) or SAML 2.0 (the identity provider's metadata), and where new people join.

Organization admins only (403 organization_admin_required), on a browser session with a fresh proof in the x-50h-reauth header (401 reauth_required). It needs a person: API keys, connected apps and service accounts get 403 session_required. Every change is written to the organization's audit. 201 the first time. OIDC (protocol left out or oidc): the issuer's discovery document is read before saving (400 sso_discovery_failed); the secret is required the first time and kept when left out. SAML (protocol: "saml"): metadataUrl (read now, https on a public host, 6-second timeout, no redirects) or metadataXml, one of them; metadata that cannot be read, wants signed requests or has no HTTP-Redirect single sign-on URL is 400 saml_metadata_invalid; allowIdpInitiated (default false) accepts sign-ins started at the identity provider. A provider change (OIDC issuer, client id, secret or token method; SAML entity ID, single sign-on URL or certificates replaced; or a switch of protocol) needs a new test before people can sign in, and is refused while enforcement is on (409 sso_enforced). defaultRole is admin, member or viewer, never owner.