---
title: "Register organization SAML SSO"
method: POST
path: "/v1/sso/saml"
tags: ["SSO"]
---

# Register organization SAML SSO

`POST /v1/sso/saml`

Registers or replaces the active organization SAML SSO provider.

## Response `201`

Organization SSO connection created

- OrganizationSsoConnectionResponse
  - `connection` OrganizationSsoConnection, required
    - `id` string, required
    - `providerId` string, required
    - `kind` 'oidc' | 'saml', required
    - `issuer` string, uri, required
    - `domain` string, required
    - `status` 'disabled' | 'enabled', required
    - `testStatus` 'untested' | 'testing' | 'succeeded' | 'failed', required
    - `testExpiresAt` string, date-time, nullable, required
    - `signInPath` string, required
    - `signInUrl` string, uri, required
    - `redirectUrl` string, uri, required
    - `acsUrl` string, uri, nullable, required
    - `metadataUrl` string, uri, nullable, required
    - `domainVerified` boolean, required
    - `domainVerificationHost` string, required
    - `domainVerificationDnsName` string, required
    - `oidc` OrganizationOidcSsoConfig, required
      - `clientId` string, nullable, required
      - `scopes` string[], required
      - `skipDiscovery` boolean, required
      - `authorizationEndpoint` string, uri, nullable, required
      - `tokenEndpoint` string, uri, nullable, required
      - `jwksEndpoint` string, uri, nullable, required
      - `userInfoEndpoint` string, uri, nullable, required
      - `tokenEndpointAuthentication` 'client_secret_basic' | 'client_secret_post', nullable, required
    - `saml` OrganizationSamlSsoConfig, required
      - `entryPoint` string, uri, nullable, required
      - `audience` string, nullable, required
      - `wantAssertionsSigned` boolean, required
    - `lastTestedAt` string, date-time, nullable, required
    - `lastError` string, nullable, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
  - `domainVerificationToken` string, nullable

## Other responses

- `400` — Invalid request
- `401` — Unauthorized
- `402` — SSO management requires an Enterprise plan.
- `403` — Only workspace owners and super-admins can manage SSO.
- `404` — Organization not found

## Changes

- **2026-09-03** `e61f7fe33f02` — 2 warning, 2 info
  - added the new `disabled` enum value to the `connection/anyOf[#/components/schemas/OrganizationSsoConnection]/status` response property for the response status `201`
  - added the new `enabled` enum value to the `connection/anyOf[#/components/schemas/OrganizationSsoConnection]/status` response property for the response status `201`
  - added the required property `connection/anyOf[#/components/schemas/OrganizationSsoConnection]/testExpiresAt` to the response with the `201` status
  - added the required property `connection/anyOf[#/components/schemas/OrganizationSsoConnection]/testStatus` to the response with the `201` status
- **2026-08-19** `5420718291ee` — 2 info
  - added the required property `connection/anyOf[#/components/schemas/OrganizationSsoConnection]/domainVerificationDnsName` to the response with the `201` status
  - added the required property `connection/anyOf[#/components/schemas/OrganizationSsoConnection]/domainVerificationHost` to the response with the `201` status

[Change history](https://skmtc.dev/openworklabs/apis/den-api/changes/v1/sso/saml/post.md)

---

[API](https://skmtc.dev/openworklabs/apis/den-api.md) · [All operations](https://skmtc.dev/openworklabs/apis/den-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/openworklabs/den-api/revisions/d3984673ccd1/schema)