---
title: "Create an SSO configuration"
method: POST
path: "/sso/configs"
tags: ["SSO"]
---

# Create an SSO configuration

`POST /sso/configs`

## Request

- Base URL: `https://example.itential.io`
- URL: `https://example.itential.io/sso/configs`
- Auth: none declared

Creates an SSO configuration.

## Request body

- object
  - `config` IapSsoSchema: Schema describing an SSO configuration object
    - `name` string, required: Name of the SSO configuration
    - `ssoType` 'saml', required: Single sign on type, SAML, OpenID, etc.
    - `settings` IapSsoSchemaSettings, required
      - `description` string: A description of the sso configuration
      - `issuer` string, required: Issuer identity provider
      - `loginURL` string, required: Login URL for SSO identity provider
      - `logoutURL` string: Logout URL for SSO identity provider
      - `certificate` string, required: Security certificate
      - `samlEmailAttribute` string: Attribute containing user email address
      - `samlUserNameAttribute` string, required: Attribute containing the full user name
      - `samlGroupsAttribute` string, required: Attribute containing the name of the groups property
      - `samlFirstNameAttribute` string: Attribute containing the first name of the user
      - `forceLogin` boolean, required: A boolean flag indicating if a user is forced to login
      - `disableAuthnContext` boolean: A boolean flag determining if we check how a user logged in
    - `active` boolean: Whether or not the SSO Config is selected for use. For 'active' to be true, 'tested' must also be true.
    - `tested` boolean: Whether the sso config was tested

## Response `200`

The result of the SSO config creation process.

- SsoCreateSsoConfigResponse200
  - `status` 'OK' | 'Created': The status of the API request.
  - `message` string: Message containing either confirmation of the operation or the reason for the failure of the operation.
  - `data` IapSsoSchema: Schema describing an SSO configuration object
    - `name` string, required: Name of the SSO configuration
    - `ssoType` 'saml', required: Single sign on type, SAML, OpenID, etc.
    - `settings` IapSsoSchemaSettings, required
      - `description` string: A description of the sso configuration
      - `issuer` string, required: Issuer identity provider
      - `loginURL` string, required: Login URL for SSO identity provider
      - `logoutURL` string: Logout URL for SSO identity provider
      - `certificate` string, required: Security certificate
      - `samlEmailAttribute` string: Attribute containing user email address
      - `samlUserNameAttribute` string, required: Attribute containing the full user name
      - `samlGroupsAttribute` string, required: Attribute containing the name of the groups property
      - `samlFirstNameAttribute` string: Attribute containing the first name of the user
      - `forceLogin` boolean, required: A boolean flag indicating if a user is forced to login
      - `disableAuthnContext` boolean: A boolean flag determining if we check how a user logged in
    - `active` boolean: Whether or not the SSO Config is selected for use. For 'active' to be true, 'tested' must also be true.
    - `tested` boolean: Whether the sso config was tested

## Other responses

- `500`: Error response from API

---

[API](https://skmtc.dev/itential/apis/itential-2.md) - [All operations](https://skmtc.dev/itential/apis/itential-2/llms.txt) - [OpenAPI document](https://skmtc.dev/itential/apis/itential-2/revisions/2095cc90e583?raw)