---
title: "POST /providers/saml/import_metadata/"
method: POST
path: "/providers/saml/import_metadata/"
tags: ["providers"]
---

# POST /providers/saml/import_metadata/

`POST /providers/saml/import_metadata/`

Create provider from SAML Metadata

## Response `201`

- SAMLProvider — SAMLProvider Serializer
  - `pk` integer, required
  - `name` string, required
  - `authentication_flow` string, uuid, nullable — Flow used for authentication when the associated application is accessed by an un-authenticated user.
  - `authorization_flow` string, uuid, required — Flow used when authorizing this provider.
  - `invalidation_flow` string, uuid, required — Flow used ending the session from a provider.
  - `property_mappings` string[]
  - `component` string, required — Get object component so that we know how to edit the object
  - `assigned_application_slug` string, nullable, required — Internal application name, used in URLs.
  - `assigned_application_name` string, nullable, required — Application's display Name.
  - `assigned_backchannel_application_slug` string, nullable, required — Internal application name, used in URLs.
  - `assigned_backchannel_application_name` string, nullable, required — Application's display Name.
  - `verbose_name` string, required — Return object's verbose_name
  - `verbose_name_plural` string, required — Return object's plural verbose_name
  - `meta_model_name` string, required — Return internal model name
  - `acs_url` string, uri, required
  - `sls_url` string, uri — Single Logout Service URL where the logout response should be sent.
  - `audience` string — Value of the audience restriction field of the assertion. When left empty, no audience restriction will be added.
  - `issuer_override` string — Also known as EntityID. Providing a value overrides the default issuer generated by authentik.
  - `assertion_valid_not_before` string — Assertion valid not before current time + this value (Format: hours=-1;minutes=-2;seconds=-3).
  - `assertion_valid_not_on_or_after` string — Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
  - `session_valid_not_on_or_after` string — Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
  - `name_id_mapping` string, uuid, nullable — Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be considered
  - `authn_context_class_ref_mapping` string, uuid, nullable — Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
  - `digest_algorithm` 'http://www.w3.org/2000/09/xmldsig#sha1' | 'http://www.w3.org/2001/04/xmlenc#sha256' | 'http://www.w3.org/2001/04/xmldsig-more#sha384' | 'http://www.w3.org/2001/04/xmlenc#sha512'
  - `signature_algorithm` 'http://www.w3.org/2000/09/xmldsig#rsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512' | 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
  - `signing_kp` string, uuid, nullable — Keypair used to sign outgoing Responses going to the Service Provider.
  - `verification_kp` string, uuid, nullable — When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.
  - `encryption_kp` string, uuid, nullable — When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the the private key.
  - `sign_assertion` boolean
  - `sign_response` boolean
  - `sign_logout_request` boolean
  - `sign_logout_response` boolean
  - `sp_binding` 'redirect' | 'post'
  - `sls_binding` 'redirect' | 'post'
  - `logout_method` 'frontchannel_iframe' | 'frontchannel_native' | 'backchannel'
  - `default_relay_state` string — Default relay_state value for IDP-initiated logins
  - `default_name_id_policy` 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
  - `url_download_metadata` string, required — Get metadata download URL
  - `url_issuer` string, required — Get Issuer/EntityID URL
  - `url_unified` string, required — Get unified SAML endpoint URL (handles SSO and SLO)
  - `url_unified_init` string, required — Get IdP-initiated SAML URL
  - `url_sso_post` string, required — Get SSO Post URL
  - `url_sso_redirect` string, required — Get SSO Redirect URL
  - `url_sso_init` string, required — Get SSO IDP-Initiated URL
  - `url_slo_post` string, required — Get SLO POST URL
  - `url_slo_redirect` string, required — Get SLO redirect URL

## Other responses

- `400` — Bad request
- `403`

---

[API](https://skmtc.dev/goauthentik/apis/authentik.md) · [All operations](https://skmtc.dev/goauthentik/apis/authentik/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/goauthentik/authentik/revisions/4e42e86021d7/schema)