Create or update the tenant's primary SSO/IdP configuration (AAL3 step-up)

PUT

/v1/console/sso/tenants/{tenant}

curl --request PUT \
  --url https://example.com/v1/console/sso/tenants/example \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "assurance_mapping": { "acr": [ "example" ], "amr": [ "example" ], "saml_contexts": [ "example" ] }, "claimed_domains": [ "example" ], "display_name": "example", "enabled": true, "network_allowlist": [ "example" ], "oidc_client_id": "example", "oidc_client_secret": "example", "oidc_groups_claim": "example", "oidc_issuer": "https://example.com", "protocol": "oidc", "require_sso": true, "saml_acs_url": "https://example.com", "saml_email_attr": "example", "saml_entity_id": "example", "saml_groups_attr": "example", "saml_idp_sso_url": "https://example.com", "saml_metadata_url": "https://example.com", "saml_sp_cert_pem": "example", "saml_sp_key_pem": "example", "saml_sp_sign_cert_pem": "example", "saml_sp_sign_key_pem": "example", "scim_authoritative": true }'

• this engine

Creates or updates the tenant’s primary IdP configuration. Step-up required; secrets are sealed at rest and never returned.

Authorizations

• bearerAuth
• browserSession

Parameters

Path Parameters

tenant

required

string

Tenant whose IdP surface this is (the tenant’s key).

Request Body ^required

Media type application/json

object

assurance_mapping

Exact upstream MFA values. Omitted/null amr accepts mfa or a signed combination of knowledge (pwd/pin) and possession (otp/hwk/swk); a single method never counts by default. Explicit amr lists replace these defaults with operator-owned exact matches. Omitted/null saml_contexts defaults to https://refeds.org/profile/mfa. ACR has no implicit values. Empty lists trust none. An empty object restores defaults; omission preserves the stored mapping.

object

acr

Array<string> | null

amr

Array<string> | null

saml_contexts

Array<string> | null

claimed_domains

Array<string>

display_name

string

<= 80 characters

enabled

boolean

network_allowlist

Array<string>

oidc_client_id

string

oidc_client_secret

string format: password

oidc_groups_claim

string

oidc_issuer

string format: uri

protocol

required

string

Allowed values: oidc saml

require_sso

boolean

saml_acs_url

string format: uri

saml_email_attr

string

saml_entity_id

string

saml_groups_attr

string

saml_idp_sso_url

string format: uri

saml_metadata_url

string format: uri

saml_sp_cert_pem

string

saml_sp_key_pem

string format: password

saml_sp_sign_cert_pem

string

saml_sp_sign_key_pem

string format: password

scim_authoritative

boolean

Responses

200

OK

Media type application/json

object

alias

string

assurance_mapping

Exact upstream MFA values. Omitted/null amr accepts mfa or a signed combination of knowledge (pwd/pin) and possession (otp/hwk/swk); a single method never counts by default. Explicit amr lists replace these defaults with operator-owned exact matches. Omitted/null saml_contexts defaults to https://refeds.org/profile/mfa. ACR has no implicit values. Empty lists trust none. An empty object restores defaults; omission preserves the stored mapping.

object

acr

Array<string> | null

amr

Array<string> | null

saml_contexts

Array<string> | null

claimed_domains

Array<string>

configured

required

boolean

display_name

string

<= 80 characters

enforced_by

string

groups_mapped_by

string

network_allowlist

Array<string>

oidc_client_id

string

oidc_client_secret_hint

string

oidc_groups_claim

string

oidc_issuer

string format: uri

protocol

string

Allowed values: oidc saml

provider_available

required

boolean

redirect_uri

string format: uri

require_sso

boolean

routed_by

string

saml_acs_url

string format: uri

saml_email_attr

string

saml_entity_id

string

saml_groups_attr

string

saml_idp_sso_url

string format: uri

saml_metadata_url

string format: uri

saml_sp_cert_pem

string

saml_sp_key_hint

string

saml_sp_sign_cert_pem

string

saml_sp_sign_key_hint

string

scim_authoritative

boolean

status

string

target_tenant

string

updated_at

string format: date-time

Example

{
  "protocol": "oidc"
}

400

Bad request

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

401

Unauthenticated

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

403

Forbidden

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

404

Not found

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

409

Conflict / setup required

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

429

Rate limited

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}