---
title: "Update an organization's Zitadel IdP template (admin)"
method: PUT
path: "/v1/organizations/{organization_id}/sso/idp"
tags: ["organizations"]
---

# Update an organization's Zitadel IdP template (admin)

`PUT /v1/organizations/{organization_id}/sso/idp`

## Request

- Base URL: `https://api.ethiack.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.ethiack.com/v1/organizations/{organization_id}/sso/idp`
- Auth: none declared

Update the template in place -- new issuer, rotated secret, new metadata.

The template id does not change, so the customer's ACS URL stays valid and
connections referencing it are unaffected. A full replacement, not a patch,
with one allowance: an OIDC body omitting ``client_secret`` keeps the stored
one.

Args:
    organization_id (int): The parent organization.
    payload (SsoIdpRequest): The new configuration.
    db (AsyncSession): Request-scoped session.
    context (ActiveContext): Resolved caller.

Returns:
    IdpTemplateResponse: The template id and, for SAML, the customer's URLs.

## Path parameters

- `organization_id` integer, required

## Request body

- union
  - OidcTemplateRequest: Create or update a generic-OIDC template. Covers every enterprise OIDC customer — Okta, Entra ID, Keycloak, Auth0 — because Zitadel does not distinguish them.
    - `protocol` 'oidc', required: Discriminator. OIDC is preferred where the customer supports it: the code exchange binds to this specific provider.
    - `name` string, required: Display name shown on the login screen.
    - `issuer` string, required: The provider's OIDC issuer URL. Zitadel discovers the endpoints from its well-known document.
    - `client_id` string, required: OAuth client id the customer registered for Zitadel.
    - `client_secret` string, nullable: The matching secret. Required when creating; on an update, omit it to keep the stored one — Zitadel preserves a secret that is absent from the request, so an issuer change needs no secret round-trip.
    - `scopes` string[]: Scopes requested; must include openid.
  - SamlTemplateRequest: Create or update a SAML template. Required for parity with legacy, whose SSO was SAML-only. Note the customer must configure their IdP against the **per-template** ACS and metadata URLs returned by this call, not against a shared endpoint.
    - `protocol` 'saml', required: Discriminator.
    - `name` string, required: Display name shown on the login screen.
    - `metadata_url` string, nullable: Public HTTPS URL of the IdP's SAML metadata. Fetched once, when this request is processed, and stored as the document; it is not re-fetched, so a signing-certificate rotation needs the configuration saved again. Exactly one of this or metadata_xml is required.
    - `metadata_xml` string, nullable: Base64-encoded SAML metadata document, for an IdP that publishes no reachable metadata endpoint. Like metadata_url, it goes stale on certificate rotation. Exactly one of this or metadata_url is required.
    - `sign_requests` boolean: Sign the AuthnRequest. Leaving this off lets anyone who can reach the IdP's SSO endpoint mint a request naming Zitadel.
    - `allow_sha1` boolean: Sign with RSA-SHA1 instead of RSA-SHA256. SHA-1 is collision-broken; set this only for a legacy IdP that accepts nothing else, and record why.

## Response `200`

Successful Response

- IdpTemplateResponse: The template as it now stands, plus what the customer has to configure. Carries **no credential**: Zitadel never returns a client secret, and this does not echo the one that was sent.
  - `zitadel_idp_id` string, required: The Zitadel IdP template this organization's federated logins now run against.
  - `protocol` 'oidc' | 'saml', required: Which protocol family the template configures.
  - `acs_url` string, nullable: SAML only. The Assertion Consumer Service URL the customer must configure in their IdP. Unique to this template, which is what keeps one customer's assertions off another's connection.
  - `sp_metadata_url` string, nullable: SAML only. Zitadel's **SP** metadata for this template, for customers who prefer importing it over manual entry. Named for the direction: the request bodies' `metadata_url` is the opposite one, the customer's IdP metadata that Zitadel fetches.
  - `certificate_url` string, nullable: SAML only. Zitadel's signing certificate for this template.
  - `slo_url` string, nullable: SAML only. Single-logout endpoint for this template.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ethiack/apis/ethiack-api.md) - [All operations](https://skmtc.dev/ethiack/apis/ethiack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ethiack/apis/ethiack-api/revisions/4eaba89bfebf?raw)