---
title: "Put Team Sso"
method: PUT
path: "/api/v1/teams/{team_id}/sso"
tags: ["sso"]
---

# Put Team Sso

`PUT /api/v1/teams/{team_id}/sso`

## Request

- Base URL: `https://api.badgeia.com`
- URL: `https://api.badgeia.com/api/v1/teams/{team_id}/sso`
- Auth: none declared

Replace the workspace's SSO configuration. Owner only, Enterprise only.

Below Enterprise, a configured workspace accepts only exposure-reducing
edits (``_exposure_increase``, #1420).

## Path parameters

- `team_id` string, uuid, required

## Request body

- SsoConfigUpdate: Body of ``PUT /teams/{team_id}/sso``. Replaces the whole configuration.
  - `provider` 'saml' | 'google', required
  - `saml` SamlConfigIn
    - `idp_entity_id` string, required
    - `sso_url` string, required
    - `slo_url` string, nullable
    - `x509_certs` string[], required
    - `name_id_format` 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
    - `want_assertions_signed` true
  - `google` GoogleConfigIn
    - `allowed_domains` string[], required
  - `domains` string[], nullable
  - `sso_only` boolean
  - `default_role` 'member' | 'viewer'

## Response `200`

Successful Response

- SsoConfigRead
  - `team_id` string, uuid, required
  - `configured` boolean, required
  - `provider` 'saml' | 'google', nullable
  - `saml` SamlConfigRead
    - `idp_entity_id` string, required
    - `sso_url` string, required
    - `slo_url` string, nullable, required
    - `x509_certs` string[], required
    - `certificates` SsoCertificateRead[], required
      - `fingerprint_sha256` string, required
      - `subject` string, required
      - `not_after` string, date-time, required
    - `name_id_format` 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified', required
    - `want_assertions_signed` boolean
  - `google` GoogleConfigRead
    - `allowed_domains` string[], required
  - `sso_only` boolean
  - `default_role` 'member' | 'viewer'
  - `domains` SsoDomainRead[]
    - `domain` string, required
    - `verified` boolean, required
    - `verification` SsoDomainVerificationRead, required: The DNS record that proves the domain (security F1).
      - `record_name` string, required
      - `record_type` 'TXT'
      - `record_value` string, required
  - `updated_at` string, date-time, nullable
  - `members_without_password` integer
  - `service_provider` SsoServiceProviderRead, required: What the IdP administrator copies into their IdP.
    - `entity_id` string, required
    - `acs_url` string, required
    - `metadata_url` string, required
    - `google_redirect_uri` string, nullable, required
  - `plan_allows_sso` boolean, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/badgeia/apis/badge.md) · [All operations](https://skmtc.dev/badgeia/apis/badge/llms.txt) · [OpenAPI document](https://skmtc.dev/badgeia/apis/badge/revisions/7e7f7fee8b77?raw)