Settings

Configure Saml Sso

Configure SAML sign-in. Does NOT switch it on - see /activate.

Configuring and activating are separate calls in the app and stay separate here, so a half-finished configuration cannot lock anyone out.

put/org/sso/saml

Request

  • Base URL: https://be.graph8.com/api/v1
  • URL: https://be.graph8.com/api/v1/org/sso/saml
  • Auth: HTTP bearer

Headers

Authorizationstring nullable
X-Target-Org-Idstring nullable

Request body

provider_namestring required

IdP name: okta, azure, google, onelogin, custom.

idp_entity_idstring required

Identity Provider Entity ID.

idp_sso_urlstring required

SSO URL from the IdP.

idp_certificatestring required

X.509 certificate from the IdP, PEM format.

require_ssoboolean

Make SSO the ONLY way in. False here and set it later with PUT /org/sso/enforcement once you have signed in through SSO yourself — that ordering is what stops a lockout.

allowed_domainsstring[] nullable

Email domains allowed to sign in this way.

Response

Successful Response

dataSettingsPayload required

An open envelope for a settings object.

Open because an ontology concept and an SSO config both grow fields as the product does, and on a settings read a dropped field reads as "not configured" rather than "we did not tell you".

Changes

No recorded changes to this operation across all 2 revisions of this API.