Create or update team SSO configuration REST API

PUT

/api/user/teams/{id}/sso

curl --request PUT \
  --url http://127.0.0.1:25737/api/user/teams/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/sso \
  --header 'Content-Type: application/json' \
  --cookie hk_token=<hk_token> \
  --data '{ "allowed_domains": [ "example" ], "auto_provision": true, "client_id": "example", "client_secret": "example", "display_name_claim": "name", "email_claim": "email", "enabled": true, "issuer_url": "https://example.com", "provider_type": "oidc" }'

Validates OIDC discovery and stores the client secret encrypted with the instance key. Leave client_secret blank to keep an existing secret, or provide a new value to rotate it. Enabling this configuration adds SSO as an optional login method; password login is unchanged.

Authorizations

• cookieAuth

Parameters

Path Parameters

id

required

string format: uuid

Request Body^required

Media typeapplication/json

object

allowed_domains

required

Array<string>

>= 1 items <= 50 items

auto_provision

required

When true, verified users from trusted domains may join this team as Members without an invitation. Managed-cloud seat and team limits still apply.

boolean

client_id

required

string

<= 512 characters

client_secret

Required on create. Blank preserves the stored secret on update.

string

display_name_claim

required

string

default: name

email_claim

required

string

default: email

enabled

required

boolean

issuer_url

required

string format: uri

<= 2048 characters

provider_type

required

string

Allowed values: oidc

Responses

200

Redacted team SSO configuration

Media typeapplication/json

Redacted team OIDC configuration. The client secret is never returned.

object

allowed_domains

required

Array<string>

auto_provision

required

boolean

callback_url

required

string format: uri

client_id

required

string

client_secret_configured

required

boolean

display_name_claim

required

string

email_claim

required

string

enabled

required

boolean

issuer_url

required

string format: uri

provider_type

required

string

Allowed values: oidc

updated_at

string format: date-time

Example

{
  "provider_type": "oidc"
}

400

Invalid configuration or missing client secret

Media typeapplication/json

object

message

string

Example^generated

{
  "message": "example"
}

403

Team settings permission or SSO entitlement required

Media typeapplication/json

object

message

string

Example^generated

{
  "message": "example"
}

409

An allowed email domain belongs to another team SSO configuration

Media typeapplication/json

object

message

string

Example^generated

{
  "message": "example"
}

502

OIDC discovery failed

Media typeapplication/json

object

message

string

Example^generated

{
  "message": "example"
}