---
title: "PATCH /orgs/{org_id}/identity-providers/{provider_id}"
method: PATCH
path: "/orgs/{org_id}/identity-providers/{provider_id}"
tags: ["orgs"]
---

# PATCH /orgs/{org_id}/identity-providers/{provider_id}

`PATCH /orgs/{org_id}/identity-providers/{provider_id}`

Update an SSO identity connection.

## Path parameters

- `org_id` string, required
- `provider_id` string, required

## Request body

- UpdateIdentityProviderReqBody — Update a connection. All fields optional; absent = unchanged. `client_secret` is write-only — supply it only to rotate.
  - `allowed_domains` string[], nullable
  - `client_id` string, nullable
  - `client_secret` string, nullable
  - `display_name` string, nullable
  - `enabled` boolean, nullable
  - `groups_claim` string, nullable
  - `issuer` string, nullable
  - `scopes` string, nullable

## Response `200`

Updated connection

- IdentityProviderView — Masked view of a connection. Never includes the client secret.
  - `allowed_domains` string[], required
  - `client_id` string, nullable — OIDC client id. `null` for non-OIDC kinds.
  - `client_secret_set` boolean, required — Whether a client secret is configured. The secret itself is never returned.
  - `created_at` integer, required
  - `default_role_id` string, nullable — Catch-all role granted to JIT members with no matching group mapping. `null` = no catch-all role.
  - `display_name` string, nullable
  - `enabled` boolean, required
  - `enforced` boolean, required — Read-only here: SSO enforcement isn't configurable via the API yet.
  - `groups_claim` string, nullable
  - `id` string, required
  - `issuer` string, nullable — OIDC issuer. `null` for non-OIDC kinds (e.g. SAML), whose connection details live in kind-specific fields added when those kinds ship.
  - `kind` string, required
  - `org_id` string, required
  - `provider_key` string, required
  - `scopes` string, nullable
  - `updated_at` integer, required

## Other responses

- `404` — Not found

## Changes

- **2026-07-03** `e1c81d0f4235` — 1 info
  - endpoint added
- **2026-03-16** `eb2c08128881` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/timbal-ai/apis/timbal-platform-api/changes/orgs/:org_id/identity-providers/:provider_id/patch.md)

---

[API](https://skmtc.dev/timbal-ai/apis/timbal-platform-api.md) · [All operations](https://skmtc.dev/timbal-ai/apis/timbal-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/timbal-ai/timbal-platform-api/revisions/dd7e398ce0d3/schema)