---
title: "Change what a domain does"
method: PATCH
path: "/api/v1/sso/domains/{domain}"
tags: ["Team"]
---

# Change what a domain does

`PATCH /api/v1/sso/domains/{domain}`

## Request

- Base URL: `http://localhost:5180`
- URL: `http://localhost:5180/api/v1/sso/domains/{domain}`
- Auth: API key in cookie `better-auth.session_token`

Switches a claimed domain between `auto_join` and `restricted`. A verified domain stays verified. Making one restricted while single sign-on is on signs out everybody on it but the caller, and `signedOut` says how many.

## Path parameters

- `domain` string, required

## Request body

- object
  - `mode` 'auto_join' | 'restricted', required: `auto_join` puts anyone signing in with an address there on the team; `restricted` also requires them to sign in through the provider.

## Response `200`

Single sign-on for this team as it stands.

- object
  - `ok` unknown, required
  - `data` object, required
    - `protocol` 'saml' | 'oidc', required
    - `enabled` boolean, required: Whether people on the verified domains sign in through the provider.
    - `saml` object, required
      - `ssoUrl` string, nullable, required
      - `idpEntityId` string, nullable, required
      - `certificate` string, nullable, required: The provider’s signing certificate, as PEM. A response not signed by it is refused.
    - `oidc` object, required
      - `issuer` string, nullable, required
      - `clientId` string, nullable, required
      - `clientSecretSet` boolean, required: Whether a client secret is stored. The secret itself is never returned.
    - `serviceProvider` object, required
      - `entityId` string, required
      - `acsUrl` string, required
      - `metadataUrl` string, required
      - `redirectUri` string, required
    - `domains` object[], required
      - `domain` string, required: The domain, lower case, with no scheme or `@`.
      - `mode` 'auto_join' | 'restricted', required: `auto_join` puts anyone signing in with an address there on the team; `restricted` also requires them to sign in through the provider while it is switched on.
      - `verified` boolean, required: Whether the DNS record has been found. Until it has, the domain does nothing.
      - `txtHost` string, required: The name to publish the TXT record under.
      - `txtValue` string, required: The value the TXT record must hold.
    - `updatedAt` string, nullable, required: ISO 8601 timestamp.
    - `signedOut` number: How many people this change signed out, because their domain now signs in only through the provider. Present only when it signed somebody out.
  - `meta` object, required
    - `requestId` string, required: Echoed in the x-request-id header. Quote it in a bug report.

## Other responses

- `403`: Not an owner of this team.
- `404`: This team has not claimed that domain.

---

[API](https://skmtc.dev/dardaris/apis/dardaris-api.md) · [All operations](https://skmtc.dev/dardaris/apis/dardaris-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dardaris/apis/dardaris-api/revisions/4aff33835c73?raw)