---
title: "Configure Saml Sso"
method: PUT
path: "/org/sso/saml"
tags: ["Settings"]
---

# Configure Saml Sso

`PUT /org/sso/saml`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/org/sso/saml`
- Auth: HTTP bearer

Configure SAML sign-in. Does NOT switch it on - see `/activate`.

Configuring and activating are separate calls in the app and stay separate
here, so a half-finished configuration cannot lock anyone out.

## Headers

- `Authorization` string, nullable
- `X-Target-Org-Id` string, nullable

## Request body

- SAMLConfigRequest: SAML sign-in configuration. The certificate and URLs come from the identity provider. Nothing here is guessable, which is why every one of the first four fields is required — a half-configured SSO that then gets activated is how an org locks itself out.
  - `provider_name` string, required: IdP name: okta, azure, google, onelogin, custom.
  - `idp_entity_id` string, required: Identity Provider Entity ID.
  - `idp_sso_url` string, required: SSO URL from the IdP.
  - `idp_certificate` string, required: X.509 certificate from the IdP, PEM format.
  - `require_sso` boolean: Make SSO the ONLY way in. False here and set it later with `PUT /org/sso/enforcement` once you have signed in through SSO yourself — that ordering is what stops a lockout.
  - `allowed_domains` string[], nullable: Email domains allowed to sign in this way.

## Response `200`

Successful Response

- ApiResponseSettingsPayload
  - `data` SettingsPayload, required: An open envelope for a settings object. Open because an ontology concept and an SSO config both grow fields as the product does, and on a settings read a dropped field reads as "not configured" rather than "we did not tell you".
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/2e7cfa0ca921?raw)