Patch Sso

OIDC Single Sign-On configuration.

When enabled, the engine validates JWT tokens on protected routes (/agent/invoke, /agent/stream, /agent/copilotkit/stream) against the configured OIDC provider's JWKS endpoint, discovered via {issuer}/.well-known/openid-configuration.

GET response and the data payload of PATCH responses.

Reload outcome attached to every admin mutation response.

reloaded means DB committed and runtime now uses the new config. restart_required means DB committed and process restart is needed. reload_failed means DB rolled back and runtime is unchanged.