---
title: "Edit SSO connections"
method: PUT
path: "/authn2/v0/tenant/{enterprise_id}/connection/{connection_id}"
tags: ["esper_cloud_api_SSO Connections"]
---

# Edit SSO connections

`PUT /authn2/v0/tenant/{enterprise_id}/connection/{connection_id}`

Updates an existing SSO connection for a tenant, identified by connection_id. Use it to change a connection's display name, strategy, or provider configuration (SAML or OIDC settings) after it's been created.

Requires a full request body (display_name, strategy, and the strategy-specific config block); returns the updated connection, including its service provider ACS URL, entity ID, logout URL, and signing certificate link where applicable.

**About SSO Connections**

SSO connections let a tenant authenticate users through an external identity provider using SAML (samlp) or OIDC (oidc). Editing a connection updates the underlying provider configuration Esper uses to negotiate SSO logins for that tenant. [Learn more](https://help.esper.io/hc/en-us/articles/14266541959569-Introduction-to-User-Authentication).

**Key Fields / Query Parameters**

- strategy — samlp or oidc, determines which config fields apply
- config.sign_in_url / config.x509_certificate — required for SAML connections
- config.issuer_url / config.client_id — required for OIDC connections

**Common Use Cases**

- Rotating a SAML signing certificate or updating an OIDC client ID
- Renaming a connection's display name

**Best Practices**

- Confirm which strategy (samlp vs oidc) the connection uses before submitting config fields, since each strategy requires different config properties

## Path parameters

- `enterprise_id` string, uuid, required
- `connection_id` string, uuid, required

## Request body

- EsperCloudApiCustomConnectionRequest
  - `display_name` string
  - `strategy` 'samlp' | 'oidc' — Strategy: * `samlp` - SAML connection * `oidc` - OIDC connection
  - `config` EsperCloudApiCustomConnectionConfigResponse
    - `sign_in_url` string, url — Required for SAML connection
    - `disable_sign_out` boolean
    - `sign_out_url` string, url
    - `x509_certificate` string — Required for SAML connection
    - `issuer_url` string, url — Required for OIDC connection
    - `client_id` string — Required for OIDC connection

## Response `200`

Updated connection

- EsperCloudApiCustomConnectionResponse
  - `id` string
  - `name` string
  - `display_name` string
  - `strategy` 'samlp' | 'oidc' — Strategy: * `samlp` - SAML connection * `oidc` - OIDC connection
  - `service_provider_acs_url` string, url
  - `service_provider_entity_id` string
  - `service_provider_logout_url` string
  - `signing_certificate_link` string
  - `callback_url` string, url
  - `config` EsperCloudApiCustomConnectionConfigResponse
    - `sign_in_url` string, url — Required for SAML connection
    - `disable_sign_out` boolean
    - `sign_out_url` string, url
    - `x509_certificate` string — Required for SAML connection
    - `issuer_url` string, url — Required for OIDC connection
    - `client_id` string — Required for OIDC connection

## Other responses

- `400` — custom connection update error
- `401` — Unauthorized
- `403` — Forbidden, no permission to perform this action.

---

[API](https://skmtc.dev/esper/apis/esper-api-reference.md) · [All operations](https://skmtc.dev/esper/apis/esper-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/esper/esper-api-reference/revisions/6b55f43485ae/schema)