---
title: "Update an identity provider's credentials"
method: PUT
path: "/organizations/{organizationID}/sso/providers/{providerAlias}"
tags: ["Organizations"]
---

# Update an identity provider's credentials

`PUT /organizations/{organizationID}/sso/providers/{providerAlias}`

## Request

- Base URL: `https://api.xata.tech`
- URL: `https://api.xata.tech/organizations/{organizationID}/sso/providers/{providerAlias}`
- Auth: OAuth 2
  - Implicit: `https://auth.xata.io/realms/xata/protocol/openid-connect/auth`
  - Scopes: `org:write`

Replaces the provider's credentials, and for `oidc` re-discovers its endpoints from the issuer. The domain it
serves and whether it is enforced are carried across unchanged, so rotating a client secret does not quietly
turn enforcement off. A provider whose domain stopped being verified is refused until the domain verifies again.

## Request body

- UpdateOrganizationSSOProviderRequest: Request payload for replacing an identity provider's credentials
  - `issuer` string, uri: OIDC issuer URL. Required for `oidc`, and for `microsoft` where it names the Entra tenant; ignored for `google`.
  - `client_id` string, required: OAuth client ID the organization registered with the provider
  - `client_secret` string, required: OAuth client secret. Write-only: it is stored in Keycloak and is never returned by this API.

## Response `200`

Identity provider updated

- OrganizationSSOProvider: An identity provider serving one of the organization's verified domains. The client secret is write-only and is never returned.
  - `alias` string, required: Stable identifier for this provider, used in its own endpoints.
  - `type` 'google' | 'microsoft' | 'oidc', required: Which identity provider this is. `google` pins the login to a Google Workspace domain and `microsoft` to a single Entra tenant, taken from the issuer; `oidc` is the fallback for anything else that speaks OpenID Connect.
  - `display_name` string, required: Name members see for this provider when signing in.
  - `domain` string, required: The verified email domain this provider serves. Empty while the domain is not verified.
  - `enforced` boolean, required: Whether members on this domain are sent to this provider automatically, leaving no other way in. Registering a provider does not set this; it is enabled separately.
  - `issuer` string, uri: OIDC issuer URL, without the /.well-known suffix.
  - `client_id` string, required: OAuth client ID the organization registered with the provider.

## Other responses

- `400`: Error returned when the request is malformed or contains invalid parameters
- `401`: Error returned when authentication or authorization fails
- `403`: Single sign-on is not enabled for the organization, or the caller is not an Admin
- `404`: The identity provider does not exist
- `409`: The identity provider has no verified domain; verify the domain again first
- `5XX`: Unexpected Error

## Changes

- **2026-09-24** `a9044087aadf`: 1 info
  - added the non-success response with the status `409`
- **2026-09-11** `dea04a8fcb58`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/xata/apis/xata-api/changes/organizations/:organizationID/sso/providers/:providerAlias/put.md)

---

[API](https://skmtc.dev/xata/apis/xata-api.md) - [All operations](https://skmtc.dev/xata/apis/xata-api/llms.txt) - [OpenAPI document](https://skmtc.dev/xata/apis/xata-api/revisions/3145f2078d68?raw)