---
title: "Create a new SSO Config."
method: POST
path: "/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs"
tags: ["SSO Configs"]
---

# Create a new SSO Config.

`POST /v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs`

## Request

- Base URL: `https://api-us.beyondidentity.com`
- URL: `https://api-us.beyondidentity.com/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-access-api/docs/v1/tenants/:tenant_id/realms/:realm_id/sso-configs/post.ts> (a function with typed inputs; its response is checked against the schema)

To create a new SSO Config, send a POST request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/sso-configs`.

## Headers

- `x-correlation_id` string, required

## Parameters

- `#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1` (unresolved $ref)
- `#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2` (unresolved $ref)

## Request body

- SsoConfigEnvelope: Represents an SSO config as a request body.
  - `sso_config` SsoConfig, required: Represents an SSO config as a request body.
    - `is_migrated` boolean: Indicates that the SSO Config was added by a script such as fast migrate
    - `display_name` string, required: A human-readable name for the application. This name is used for display purposes.
    - `payload` union, required
      - SsoConfigBookmark
        - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
        - `login_link` string, required
        - `icon` string
        - `is_tile_visible` boolean
      - SsoConfigEntraIdExternalAuthMethod
        - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
        - `redirect_uris` string[], required
        - `inbound_scim` object
        - `discover_endpoint` 'global_azure' | 'azure_us_government' | 'microsoft_azure_vianet', required: Describes the type of discovery endpoint for the entra_id_external_auth_methods sso config.
      - SsoConfigGenericOidc
        - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
        - `redirect_uris` string[], required
        - `scopes` string[], required
        - `trusted_origins` string[]
        - `login_link` string
        - `icon` string
        - `is_tile_visible` boolean
        - `confidentiality` 'confidential' | 'public', required: The confidentiality of the client, as prescribed by OAuth 2.0 and OIDC. Confidentiality is based on a client's ability to authenticate securely with the authorization server (i.e., ability to maintain the confidentiality of their client credentials). Allowable values are: - `confidential`: Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with restricted access to the client credentials), or capable of secure client authentication using other means. - `public`: Clients incapable of maintaining the confidentiality of their credentials (e.g., clients executing on the device used by the resource owner, such as an installed native application or a web browser-based application), and incapable of secure client authentication via any other means.
        - `pkce` 'disabled' | 'plain' | 's256', required: PKCE code challenge methods supported for applications, as defined by [RFC-7636](https://datatracker.ietf.org/doc/html/rfc7636). Allowable values are: - `disabled` : PKCE is disabled for this application. This is the default state if the `pkce` field is left blank. Please note that public OIDC and OAuth2 configured applications MUST enable PKCE support. Confidential clients can leave PKCE disabled if they choose. - `plain` : PKCE is enabled for this application. The server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to be identical. This is the lower security option for PKCE support and should only be used by legacy clients, or clients that don't support `s256`. - `s256` : PKCE is enabled for this application, and the server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to equate as follows: `code_challenge` = `base64url(sha256(ascii(code_verifier)))`. This is the higher security option and should always be preferred if it is supported by the client.
        - `inbound_scim` object
      - SsoConfigOidcIdp
        - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
        - `client_id` string, required: The client ID for the idp application.
        - `identifying_claim_name` string, required
        - `identity_attribute` 'id' | 'email' | 'username' | 'external_id', required: Defines which field should be used to populate the subject field of an id token. - `id` - The user ID is used. - `email` - The user email is used. - `username` - The username is used.
        - `authorization_endpoint` string, nullable, required
        - `token_endpoint` string, required
        - `jwks_endpoint` string, required
      - object
        - `type` 'saml', required
        - `acs_url` string, required: Location where the SAML Response is sent via HTTP-POST. Often referred to as the SAML Assertion Consumer Service (ACS) URL.
        - `override_recipient_and_destination` boolean, required: When this is true, the `recipient_url` and the `destination_url` are used for SAML Response. When this is false, both the `recipient_url` and the `destination_url` are omitted and the `acs_url` is used instead.
        - `recipient_url` string: If `override_recipient_and_destination` is set to `true`, this field is utilized for the SAML Response. If it is `false`, this field is unused. The location where the application may present the SAML assertion. This is usually the same location as the Single Sign-On URL.
        - `destination_url` string: If `override_recipient_and_destination` is set to `true`, this field is utilized for the SAML Response. If it is `false`, this field is unused. Identifies the location where the SAML response is intended to be sent inside of the SAML assertion.
        - `audience_url` string, required: The intended audience of the SAML assertion. Often referred to as the service provider Entity ID.
        - `default_relay_state` string, required: Identifies a specific application resource in an IDP initiated Single Sign-On scenario. In most instances this is blank.
        - `name_format` 'unspecified' | 'email_address' | 'x509_subject_name' | 'persistent' | 'transient' | 'entity' | 'kerberos' | 'windows_domain_qualified_name', required: Name format of the assertion's subject statement. Processing rules and constraints can be applied based on selection. Default value is "unspecified" unless SP explicitly requires differently.
        - `authentication_context` 'x509' | 'integrated_windows_federation' | 'kerberos' | 'password' | 'password_protected_transport' | 'tls_client' | 'unspecified' | 'refeds_mfa', required: The SAML Authentication Context Class for the assertion's authentication statement. Default value is "X509".
        - `subject_user_name_attribute` 'user_name' | 'email' | 'email_prefix' | 'external_id' | 'display_name' | 'custom' | 'none', required: Determines the default value for a user's application username. The application username will be used for the assertion's subject statement.
        - `sign_envelope` boolean, required: Determines whether the SAML authentication response message is digitally signed by the IdP or not. A digital signature is required to ensure that only your IdP generated the response message.
        - `sign_assertions` boolean, required: All of the assertions should be signed by the IdP.
        - `signature_algorithm` 'rsa_sha256' | 'rsa_sha1' | 'rsa_sha384' | 'rsa_sha512', required: The algorithm used for signing the SAML assertions.
        - `digest_algorithm` 'sha256' | 'sha1' | 'sha384' | 'sha512', required: The algorithm used to encrypt the SAML assertion.
        - `encrypt_assertions` boolean, required: This is the flag that determines if the SAML assertion is encrypted. If this flag is set to `true`, there **MUST** be a SAML encryption certificate uploaded. Encryption ensures that nobody but the sender and receiver can understand the assertion.
        - `assertion_validity_duration_seconds` integer, required: The amount of time SAML assertions are valid for in seconds.
        - `assertion_encryption_algorithm` 'aes256_cbc' | 'aes256_gcm' | 'aes128_cbc' | 'aes128_gcm': The algorithm used for the digest in SAML assertions.
        - `assertion_key_transport_algorithm` 'rsa_oaep' | 'rsa1_5': The algorithm used for key transport in SAML assertions.
        - `assertion_encryption_public_key` string: The public key used to encrypt the SAML assertion. This is required if `encrypt_assertions` is true.
        - `sp_signature_certificates` Items, required (unresolved $ref)
        - `enable_single_log_out` boolean, required: Enables single logout. Single Logout (SLO) is a feature that allows users to be logged out from multiple service providers (SPs) and the identity provider (IdP) with a single logout action.
        - `single_log_out_url` string: The location where the single logout response will be sent. This is only enabled if `enable_single_log_out` is true.
        - `single_log_out_issuer_url` string: The issuer ID for the service provider when handling a Single Logout. This is only enabled if `enable_single_log_out` is true.
        - `single_log_out_binding` 'post' | 'redirect': The SAML binding used for SAML messages.
        - `single_logout_sign_request_and_response` boolean, required: If enabled, Single Logout requests must bbe signed and Single Logout responses will also be signed.
        - `validate_signed_requests` boolean, required: Select this to validate all SAML requests using the SP Signature Certificate.
        - `other_sso_urls` object: For use with SP-initiated sign-in flows. Enter the ACS URLs for any other requestable SSO nodes used by your app integration. This option enables applications to choose where to send the SAML Response. Specify a URL and an index that uniquely identifies each ACS URL endpoint. Some SAML AuthnRequest messages don't specify an index or URL. In these cases, the SAML Response is sent to the ACS specified in the Single sign on URL field. When you enable Signed Requests, Beyond Identity deletes any previously defined static SSO URLs and reads the SSO URLs from the signed SAML request instead. You can't have both static SSO URLs and dynamic SSO URLs. This can only be set if `validate_signed_requests` is set to false.
          - `index` integer, required: The index that this URL may be referenced by.
          - `url` string, required: This is a URL that may be used to replace the ACS URL.
        - `additional_user_attributes` object[], required: This structure describes additional attributes that can be attached to SAML assertion.
          - `name` string, required: The SAML attribute name.
          - `name_format` NameFormat, required (unresolved $ref)
          - `value` Items, required (unresolved $ref)
          - `custom_value` string: The custom static string value when value is set to `custom_static_string`.
        - `identity_provider_certs` object[]: The X509 certificates of the identity provider (Beyond Identity). These are the certificates that is in our IDP metadata, and that the upstream services use to validate our SAML assertion.
          - `id` string, required: The id of the certificate.
          - `created_at` string, date-time, required: Timestamp of when the certificate was created.
          - `expires_at` string, date-time, required: Timestamp of when the certificate expires.
          - `is_active` boolean, required: Indicates whether the certificate is active.
          - `idp_public_certificate` string, required: Beyond Identity's public signing key wrapped in a certificate. Stored as a base64 encoded DER format.
        - `use_short_url` boolean: Changes the EntityID in the SAML response to a shorter version. This is to support applications with URL restrictions.
      - object
        - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
        - `client_id` string, required: The client ID for the idp application.
        - `client_secret` string, nullable: The client secret to authenticate as the idp application.
        - `pkce` 'disabled' | 'plain' | 's256': PKCE code challenge methods supported for applications, as defined by [RFC-7636](https://datatracker.ietf.org/doc/html/rfc7636). Allowable values are: - `disabled` : PKCE is disabled for this application. This is the default state if the `pkce` field is left blank. Please note that public OIDC and OAuth2 configured applications MUST enable PKCE support. Confidential clients can leave PKCE disabled if they choose. - `plain` : PKCE is enabled for this application. The server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to be identical. This is the lower security option for PKCE support and should only be used by legacy clients, or clients that don't support `s256`. - `s256` : PKCE is enabled for this application, and the server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to equate as follows: `code_challenge` = `base64url(sha256(ascii(code_verifier)))`. This is the higher security option and should always be preferred if it is supported by the client.
        - `id_token_scopes` string[]
        - `identifying_claim_name` string, required
        - `identity_attribute` 'id' | 'email' | 'username' | 'external_id', required: Defines which field should be used to populate the subject field of an id token. - `id` - The user ID is used. - `email` - The user email is used. - `username` - The username is used.
        - `okta_domain` string, required
        - `inbound_scim` object
      - SsoConfigOktaBiIdp
        - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
        - `pkce` 'disabled' | 'plain' | 's256', required: PKCE code challenge methods supported for applications, as defined by [RFC-7636](https://datatracker.ietf.org/doc/html/rfc7636). Allowable values are: - `disabled` : PKCE is disabled for this application. This is the default state if the `pkce` field is left blank. Please note that public OIDC and OAuth2 configured applications MUST enable PKCE support. Confidential clients can leave PKCE disabled if they choose. - `plain` : PKCE is enabled for this application. The server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to be identical. This is the lower security option for PKCE support and should only be used by legacy clients, or clients that don't support `s256`. - `s256` : PKCE is enabled for this application, and the server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to equate as follows: `code_challenge` = `base64url(sha256(ascii(code_verifier)))`. This is the higher security option and should always be preferred if it is supported by the client.
        - `okta_registration` object, required: Represents a list of Resource Servers as a response body.
          - `domain` string: The domain Url inside of Okta.
          - `okta_token` string: An okta token used for accessing the okta API.
          - `attribute_name` string: The name of the attribute within okta that we are going to set to true.
          - `is_enabled` boolean: If the integration is enabled.
        - `inbound_scim` object
      - SsoConfigNametagOauth2: This request contains the details of the Nametag OAuth2 Client Credentials Application. This application has access to read identities and groups.
        - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
      - SsoConfigRealityCheck
        - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
        - `company_identifier` string, required
      - SsoConfigWsFed
        - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
        - `acs_url` string, required: This is where to redirect to. This is also known as the SP SSO url.
        - `audience_url` string, required: The Recipient/Audience of the RSTR.
        - `expiration_time_seconds` integer, required: The amount of time in seconds that the RSTR should be valid for.
        - `digest_algorithm` DigestAlgorithm, required (unresolved $ref)
        - `signature_algorithm` SignatureAlgorithm, required (unresolved $ref)
        - `name_format` NameFormat, required (unresolved $ref)
        - `subject_user_name_attribute` SubjectUserNameAttribute, required (unresolved $ref)
        - `authentication_context` AuthenticationContext, required (unresolved $ref)
        - `additional_user_attributes` object[], required: Any additional attributes to attach to the assertion.
          - `name` string, required: The SAML attribute name.
          - `name_format` NameFormat, required (unresolved $ref)
          - `value` Items, required (unresolved $ref)
          - `namespace` string: This is an XML namespace that is applied the attribute and all of its children.
        - `icon` string: The URL or data URI of the icon representing the SSO configuration.
        - `is_tile_visible` boolean: Indicates if the SSO configuration tile is visible to the user.
        - `inbound_scim` object

## Response `200`

The sso config has been created.

- object: Represents an SSO config as a response body.
  - `id` string, uuid, required: A unique identifier for an SSO config. This is automatically generated on creation. This field is immutable and read-only. This field is unique within the realm.
  - `display_name` string, required: A human-readable name for the SSO config. This name is used for display purposes.
  - `payload` union, required
    - object
      - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
      - `login_link` string, required
      - `icon` string
      - `is_tile_visible` boolean
      - `application_tile_id` string
    - object
      - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
      - `redirect_uris` string[], required
      - `oidc_configuration` object, required
        - `issuer` string, required
        - `authorization_endpoint` string, nullable
        - `token_endpoint` string, required
        - `userinfo_endpoint` string, nullable
        - `jwks_uri` string, required
        - `response_types_supported` string[], required
        - `token_endpoint_auth_methods_supported` TokenEndpointAuthMethod[], required
      - `client_id` string, required: The client ID for the idp application.
      - `inbound_scim` 0 (unresolved $ref)
      - `application_id` string, required
      - `authenticator_config_id` string, required
      - `resource_server_id` string, required
      - `discover_endpoint` DiscoverEndpoint, required (unresolved $ref)
    - object
      - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
      - `redirect_uris` string[], required
      - `scopes` string[], required
      - `trusted_origins` string[], required
      - `login_link` string
      - `icon` string
      - `is_tile_visible` boolean
      - `confidentiality` 'confidential' | 'public', required: The confidentiality of the client, as prescribed by OAuth 2.0 and OIDC. Confidentiality is based on a client's ability to authenticate securely with the authorization server (i.e., ability to maintain the confidentiality of their client credentials). Allowable values are: - `confidential`: Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with restricted access to the client credentials), or capable of secure client authentication using other means. - `public`: Clients incapable of maintaining the confidentiality of their credentials (e.g., clients executing on the device used by the resource owner, such as an installed native application or a web browser-based application), and incapable of secure client authentication via any other means.
      - `pkce` 'disabled' | 'plain' | 's256', required: PKCE code challenge methods supported for applications, as defined by [RFC-7636](https://datatracker.ietf.org/doc/html/rfc7636). Allowable values are: - `disabled` : PKCE is disabled for this application. This is the default state if the `pkce` field is left blank. Please note that public OIDC and OAuth2 configured applications MUST enable PKCE support. Confidential clients can leave PKCE disabled if they choose. - `plain` : PKCE is enabled for this application. The server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to be identical. This is the lower security option for PKCE support and should only be used by legacy clients, or clients that don't support `s256`. - `s256` : PKCE is enabled for this application, and the server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to equate as follows: `code_challenge` = `base64url(sha256(ascii(code_verifier)))`. This is the higher security option and should always be preferred if it is supported by the client.
      - `oidc_configuration` OidcConfiguration, required (unresolved $ref)
      - `client_id` string, required: The client ID for the idp application.
      - `client_secret` string: The client secret to authenticate as the idp application.
      - `inbound_scim` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2': Describes the type of sso config.
      - `application_id` string, required
      - `authenticator_config_id` string, required
      - `resource_server_id` string, required
      - `application_tile_id` string
    - object
      - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
      - `client_id` string, required: The client ID for the idp application.
      - `client_secret` string: The client secret to authenticate as the idp application.
      - `pkce` 'disabled' | 'plain' | 's256', required: PKCE code challenge methods supported for applications, as defined by [RFC-7636](https://datatracker.ietf.org/doc/html/rfc7636). Allowable values are: - `disabled` : PKCE is disabled for this application. This is the default state if the `pkce` field is left blank. Please note that public OIDC and OAuth2 configured applications MUST enable PKCE support. Confidential clients can leave PKCE disabled if they choose. - `plain` : PKCE is enabled for this application. The server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to be identical. This is the lower security option for PKCE support and should only be used by legacy clients, or clients that don't support `s256`. - `s256` : PKCE is enabled for this application, and the server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to equate as follows: `code_challenge` = `base64url(sha256(ascii(code_verifier)))`. This is the higher security option and should always be preferred if it is supported by the client.
      - `id_token_scopes` string[]
      - `identifying_claim_name` string, required
      - `identity_attribute` 'id' | 'email' | 'username' | 'external_id', required: Defines which field should be used to populate the subject field of an id token. - `id` - The user ID is used. - `email` - The user email is used. - `username` - The username is used.
      - `authorization_endpoint` string, nullable, required
      - `token_endpoint` string, required
      - `jwks_endpoint` string, required
      - `redirect_uri` string, required
      - `identity_provider_id` string, required
    - object
      - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2': Describes the type of sso config.
      - `acs_url` string: The Assertion Consumer Service (ACS) URL where the SAML assertions are sent.
      - `override_recipient_and_destination` boolean: Flag to override the recipient and destination URLs in the SAML response.
      - `recipient_url` string: The recipient URL for the SAML response.
      - `destination_url` string: The destination URL for the SAML response.
      - `audience_url` string: The URL that identifies the intended audience for the SAML assertion.
      - `default_relay_state` string: The default relay state parameter for the SAML response.
      - `name_format` NameFormat (unresolved $ref)
      - `authentication_context` AuthenticationContext (unresolved $ref)
      - `subject_user_name_attribute` SubjectUserNameAttribute (unresolved $ref)
      - `sign_envelope` boolean: Flag indicating whether to sign the SAML envelope.
      - `sign_assertions` boolean: Flag indicating whether to sign the SAML assertions.
      - `signature_algorithm` SignatureAlgorithm (unresolved $ref)
      - `digest_algorithm` DigestAlgorithm (unresolved $ref)
      - `encrypt_assertions` boolean: Flag indicating whether to encrypt the SAML assertions.
      - `assertion_validity_duration_seconds` integer: The duration (in seconds) for which the SAML assertion is valid.
      - `assertion_encryption_algorithm` AssertionEncryptionAlgorithm (unresolved $ref)
      - `assertion_key_transport_algorithm` AssertionKeyTransportAlgorithm (unresolved $ref)
      - `assertion_encryption_public_key` string: The public key used for encrypting the SAML assertions.
      - `sp_signature_certificates` Items[]: The certificates used for signing the SAML assertions. (unresolved $ref)
      - `enable_single_log_out` boolean: Flag indicating whether to enable single logout (SLO) functionality.
      - `single_log_out_url` string: The URL for single logout (SLO).
      - `single_log_out_issuer_url` string: The issuer URL for single logout (SLO).
      - `single_log_out_binding` SingleLogOutBinding (unresolved $ref)
      - `single_logout_sign_request_and_response` boolean: Flag indicating whether to sign the single logout (SLO) requests and responses.
      - `validate_signed_requests` boolean: Flag indicating whether to validate signed SAML requests.
      - `other_sso_urls` OtherSsoUrls (unresolved $ref)
      - `additional_user_attributes` AdditionalUserAttributes[]: Additional user attributes to include in the SAML assertions. (unresolved $ref)
      - `icon` string: The icon associated with the SSO configuration.
      - `is_tile_visible` boolean: Flag indicating whether the configuration tile is visible.
      - `application_id` string: The application ID associated with the SSO configuration.
      - `authenticator_config_id` string: The authenticator configuration ID.
      - `application_tile_id` string: The application tile ID.
      - `idp_initiated_url` string: The URL for IdP-initiated SSO.
      - `sp_initiated_url` string: The URL for SP-initiated SSO.
      - `inbound_scim` 0 (unresolved $ref)
      - `use_short_url` boolean: Changes the EntityID in the SAML response to a shorter version. This is to support applications with URL restrictions.
      - `short_sp_initiated_url` string: This is the shortened URL that will be used to initiate a SAML login from the service provider side. Generated and provided by Beyond Identity. This should only be displayed when `use_short_urls` is true.
      - `short_entity_id_url` string: This is the shortened URL that we will use as our issuer inside of a SAML response.
    - object
      - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
      - `client_id` string, required: The client ID for the idp application.
      - `client_secret` string: The client secret to authenticate as the idp application.
      - `pkce` 'disabled' | 'plain' | 's256', required: PKCE code challenge methods supported for applications, as defined by [RFC-7636](https://datatracker.ietf.org/doc/html/rfc7636). Allowable values are: - `disabled` : PKCE is disabled for this application. This is the default state if the `pkce` field is left blank. Please note that public OIDC and OAuth2 configured applications MUST enable PKCE support. Confidential clients can leave PKCE disabled if they choose. - `plain` : PKCE is enabled for this application. The server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to be identical. This is the lower security option for PKCE support and should only be used by legacy clients, or clients that don't support `s256`. - `s256` : PKCE is enabled for this application, and the server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to equate as follows: `code_challenge` = `base64url(sha256(ascii(code_verifier)))`. This is the higher security option and should always be preferred if it is supported by the client.
      - `id_token_scopes` string[]
      - `identifying_claim_name` string, required
      - `identity_attribute` 'id' | 'email' | 'username' | 'external_id', required: Defines which field should be used to populate the subject field of an id token. - `id` - The user ID is used. - `email` - The user email is used. - `username` - The username is used.
      - `okta_domain` string, required
      - `authorization_endpoint` string, nullable, required
      - `token_endpoint` string, required
      - `jwks_endpoint` string, required
      - `redirect_uri` string, required
      - `identity_provider_id` string, required
      - `inbound_scim` 0 (unresolved $ref)
    - object
      - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
      - `pkce` 'disabled' | 'plain' | 's256', required: PKCE code challenge methods supported for applications, as defined by [RFC-7636](https://datatracker.ietf.org/doc/html/rfc7636). Allowable values are: - `disabled` : PKCE is disabled for this application. This is the default state if the `pkce` field is left blank. Please note that public OIDC and OAuth2 configured applications MUST enable PKCE support. Confidential clients can leave PKCE disabled if they choose. - `plain` : PKCE is enabled for this application. The server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to be identical. This is the lower security option for PKCE support and should only be used by legacy clients, or clients that don't support `s256`. - `s256` : PKCE is enabled for this application, and the server will correlate the `code_challenge` and `code_verifier` between the `authorize` and `token` requests. In this configuration, those fields are required to equate as follows: `code_challenge` = `base64url(sha256(ascii(code_verifier)))`. This is the higher security option and should always be preferred if it is supported by the client.
      - `oidc_configuration` OidcConfiguration, required (unresolved $ref)
      - `client_id` string, required: The client ID for the idp application.
      - `client_secret` string, required: The client secret to authenticate as the idp application.
      - `okta_registration` OktaRegistration, required (unresolved $ref)
      - `inbound_scim` 0 (unresolved $ref)
      - `application_id` string, required
      - `authenticator_config_id` string, required
    - object: This response contains the details of the Nametag OAuth2 Client Credentials Application. This application has access to read identities and groups.
      - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
      - `tenant_id` string, required: The ID of the Tenant that this Nametag OAuth2 Client Credentials Application belongs to.
      - `realm_id` string, required: The ID of the Realm that this Nametag OAuth2 Client Credentials Application belongs to.
      - `application_id` string, required: The ID of the OAuth2 application associated with the Nametag OAuth2 Client Credentials Application.
      - `client_id` string, required: The client ID for the Nametag OAuth2 Client Credentials Application.
      - `client_secret` string, required: The client secret for the Nametag OAuth2 Client Credentials Application.
      - `api_base_url` string, required: The API base URL for Nametag API requests to Beyond Identity.
    - object
      - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
      - `company_identifier` string, required
    - object
      - `type` 'bookmark' | 'entra_id_external_auth_methods' | 'generic_oidc' | 'generic_oidc_idp' | 'generic_saml' | 'okta_idp' | 'okta_sso_bi_idp' | 'scim' | 'ws_fed' | 'nametag_oauth2', required: Describes the type of sso config.
      - `application_id` string, required
      - `client_id` string, required: The client ID for the scim application.
      - `client_secret` string, required: The client secret for the scim application.
      - `scim_url` string, required: Beyond Identity Scim server endpoint
      - `token_endpoint` string, required
    - object
      - `type` 0, required (unresolved $ref)
      - `acs_url` string, required
      - `expiration_time_seconds` integer
      - `audience_url` string, required
      - `digest_algorithm` DigestAlgorithm, required (unresolved $ref)
      - `signature_algorithm` SignatureAlgorithm, required (unresolved $ref)
      - `name_format` NameFormat, required (unresolved $ref)
      - `subject_user_name_attribute` SubjectUserNameAttribute, required (unresolved $ref)
      - `authentication_context` AuthenticationContext, required (unresolved $ref)
      - `additional_user_attributes` Items[], required (unresolved $ref)
      - `icon` string: The icon associated with the SSO configuration.
      - `is_tile_visible` boolean: Flag indicating whether the configuration tile is visible.
      - `application_id` string, required: The application ID associated with the SSO configuration.
      - `authenticator_config_id` string, required: The authenticator configuration ID.
      - `application_tile_id` string: The application tile ID.
      - `idp_sso_url` string
      - `idp_issuer_url` string
      - `metadata_url` string
      - `inbound_scim` 0 (unresolved $ref)

## Other responses

- `400`: The request is malformed.
- `401`: An invalid Authorization token has been supplied.
- `403`: The supplied authorization token doesn't allow the requested operation.
- `500`: Internal server error.

## Changes

- **2026-11-06** `42f3cac49392`: 2 breaking, 9 info
  - removed `subschema #5, subschema #6` from the `sso_config/payload` request property `oneOf` list
  - added `subschema #1, subschema #2, subschema #3, subschema #4, subschema #5, subschema #6, subschema #7, subschema #8, subschema #9, subschema #10` to the `payload` response property `oneOf` list for the response status `200`
  - added the new `nametag_oauth2` enum value to the request property `sso_config/payload/oneOf[#/components/schemas/SsoConfigBookmark]/type`
  - added the new `nametag_oauth2` enum value to the request property `sso_config/payload/oneOf[#/components/schemas/SsoConfigEntraIdExternalAuthMethod]/type`
  - …7 more

[Operation history](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-access-api/changes/v1/tenants/:tenant_id/realms/:realm_id/sso-configs/post.md)

---

[API](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-access-api.md) - [All operations](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-access-api/llms.txt) - [OpenAPI document](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-access-api/revisions/42f3cac49392?raw)