--- title: "POST /sources/saml/" method: POST path: "/sources/saml/" tags: ["sources"] --- # POST /sources/saml/ `POST /sources/saml/` SAMLSource Viewset ## Request body - SAMLSourceRequest — SAMLSource Serializer - `name` string, required — Source's display Name. - `slug` string, required — Internal source name, used in URLs. - `enabled` boolean - `promoted` boolean — When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon. - `authentication_flow` string, uuid, nullable — Flow to use when authenticating existing users. - `enrollment_flow` string, uuid, nullable — Flow to use when enrolling new users. - `user_property_mappings` string[] - `group_property_mappings` string[] - `policy_engine_mode` 'all' | 'any' - `user_matching_mode` 'identifier' | 'email_link' | 'email_deny' | 'username_link' | 'username_deny' - `user_path_template` string - `icon` string - `group_matching_mode` 'identifier' | 'name_link' | 'name_deny' - `pre_authentication_flow` string, uuid, required — Flow used before authentication. - `issuer_override` string — Also known as Entity ID. Defaults to the Metadata URL. - `sso_url` string, uri, required — URL that the initial Login request is sent to. - `slo_url` string, uri, nullable — Optional URL if your IDP supports Single-Logout. - `allow_idp_initiated` boolean — Allows authentication flows initiated by the IdP. This can be a security risk, as no validation of the request ID is done. - `force_authn` boolean — When enabled, the IdP will re-authenticate the user even if a session exists. - `name_id_policy` 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified' - `binding_type` 'REDIRECT' | 'POST' | 'POST_AUTO' - `verification_kp` string, uuid, nullable — When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default. - `signing_kp` string, uuid, nullable — Keypair used to sign outgoing Responses going to the Identity Provider. - `digest_algorithm` 'http://www.w3.org/2000/09/xmldsig#sha1' | 'http://www.w3.org/2001/04/xmlenc#sha256' | 'http://www.w3.org/2001/04/xmldsig-more#sha384' | 'http://www.w3.org/2001/04/xmlenc#sha512' - `signature_algorithm` 'http://www.w3.org/2000/09/xmldsig#rsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512' | 'http://www.w3.org/2000/09/xmldsig#dsa-sha1' - `temporary_user_delete_after` string — Time offset when temporary users should be deleted. This only applies if your IDP uses the NameID Format 'transient', and the user doesn't log out manually. (Format: hours=1;minutes=2;seconds=3). - `encryption_kp` string, uuid, nullable — When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the the private key. - `signed_assertion` boolean - `signed_response` boolean ## Response `201` - SAMLSource — SAMLSource Serializer - `pk` string, uuid, required - `name` string, required — Source's display Name. - `slug` string, required — Internal source name, used in URLs. - `enabled` boolean - `promoted` boolean — When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon. - `authentication_flow` string, uuid, nullable — Flow to use when authenticating existing users. - `enrollment_flow` string, uuid, nullable — Flow to use when enrolling new users. - `user_property_mappings` string[] - `group_property_mappings` string[] - `component` string, required — Get object component so that we know how to edit the object - `verbose_name` string, required — Return object's verbose_name - `verbose_name_plural` string, required — Return object's plural verbose_name - `meta_model_name` string, required — Return internal model name - `policy_engine_mode` 'all' | 'any' - `user_matching_mode` 'identifier' | 'email_link' | 'email_deny' | 'username_link' | 'username_deny' - `managed` string, nullable, required — Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update. - `user_path_template` string - `icon` string - `icon_url` string, required - `icon_themed_urls` ThemedUrls, required — Themed URLs - maps theme names to URLs for light and dark themes - `light` string, nullable - `dark` string, nullable - `group_matching_mode` 'identifier' | 'name_link' | 'name_deny' - `pre_authentication_flow` string, uuid, required — Flow used before authentication. - `issuer_override` string — Also known as Entity ID. Defaults to the Metadata URL. - `url_issuer` string, required — Get the resolved Issuer, falling back to the metadata URL when unset - `sso_url` string, uri, required — URL that the initial Login request is sent to. - `slo_url` string, uri, nullable — Optional URL if your IDP supports Single-Logout. - `allow_idp_initiated` boolean — Allows authentication flows initiated by the IdP. This can be a security risk, as no validation of the request ID is done. - `force_authn` boolean — When enabled, the IdP will re-authenticate the user even if a session exists. - `name_id_policy` 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified' - `binding_type` 'REDIRECT' | 'POST' | 'POST_AUTO' - `verification_kp` string, uuid, nullable — When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default. - `signing_kp` string, uuid, nullable — Keypair used to sign outgoing Responses going to the Identity Provider. - `digest_algorithm` 'http://www.w3.org/2000/09/xmldsig#sha1' | 'http://www.w3.org/2001/04/xmlenc#sha256' | 'http://www.w3.org/2001/04/xmldsig-more#sha384' | 'http://www.w3.org/2001/04/xmlenc#sha512' - `signature_algorithm` 'http://www.w3.org/2000/09/xmldsig#rsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384' | 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512' | 'http://www.w3.org/2000/09/xmldsig#dsa-sha1' - `temporary_user_delete_after` string — Time offset when temporary users should be deleted. This only applies if your IDP uses the NameID Format 'transient', and the user doesn't log out manually. (Format: hours=1;minutes=2;seconds=3). - `encryption_kp` string, uuid, nullable — When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the the private key. - `signed_assertion` boolean - `signed_response` boolean ## Other responses - `400` - `403` --- [API](https://skmtc.dev/goauthentik/apis/authentik.md) · [All operations](https://skmtc.dev/goauthentik/apis/authentik/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/goauthentik/authentik/revisions/4e42e86021d7/schema)