---
title: "Register organization SAML SSO"
method: POST
path: "/v1/sso/saml"
tags: ["SSO"]
---

# Register organization SAML SSO

`POST /v1/sso/saml`

Registers or replaces the active organization SAML SSO provider.

## Response `201`

Organization SSO connection created

- OrganizationSsoConnectionResponse
  - `connection` OrganizationSsoConnection, required
    - `id` string, required
    - `providerId` string, required
    - `kind` 'oidc' | 'saml', required
    - `issuer` string, uri, required
    - `domain` string, required
    - `status` string, required
    - `signInPath` string, required
    - `signInUrl` string, uri, required
    - `redirectUrl` string, uri, required
    - `acsUrl` string, uri, nullable, required
    - `metadataUrl` string, uri, nullable, required
    - `domainVerified` boolean, required
    - `domainVerificationHost` string, required
    - `domainVerificationDnsName` string, required
    - `oidc` OrganizationOidcSsoConfig, required
      - `clientId` string, nullable, required
      - `scopes` string[], required
      - `skipDiscovery` boolean, required
      - `authorizationEndpoint` string, uri, nullable, required
      - `tokenEndpoint` string, uri, nullable, required
      - `jwksEndpoint` string, uri, nullable, required
      - `userInfoEndpoint` string, uri, nullable, required
      - `tokenEndpointAuthentication` 'client_secret_basic' | 'client_secret_post', nullable, required
    - `saml` OrganizationSamlSsoConfig, required
      - `entryPoint` string, uri, nullable, required
      - `audience` string, nullable, required
      - `wantAssertionsSigned` boolean, required
    - `lastTestedAt` string, date-time, nullable, required
    - `lastError` string, nullable, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
  - `domainVerificationToken` string, nullable

## Other responses

- `400` — Invalid request
- `401` — Unauthorized
- `402` — SSO management requires an Enterprise plan.
- `403` — Only workspace owners and super-admins can manage SSO.
- `404` — Organization not found

## Changes

- **2026-08-19** `5420718291ee` — 2 info
  - added the required property `connection/anyOf[#/components/schemas/OrganizationSsoConnection]/domainVerificationDnsName` to the response with the `201` status
  - added the required property `connection/anyOf[#/components/schemas/OrganizationSsoConnection]/domainVerificationHost` to the response with the `201` status

[Change history](https://skmtc.dev/openworklabs/apis/den-api/changes/v1/sso/saml/post.md)

---

[API](https://skmtc.dev/openworklabs/apis/den-api.md) · [All operations](https://skmtc.dev/openworklabs/apis/den-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/openworklabs/den-api/revisions/fcbb34aa1702/schema)