---
title: "Create or update team SSO configuration REST API | HitKeep"
description: "Reference for the HitKeep REST API operation Create or update team SSO configuration, including request parameters, responses, and authentication notes."
canonical: "https://hitkeep.com/api/operations/apiuserteamsidsso/put/"
---

# Create or update team SSO configuration REST API

PUT

/api/user/teams/{id}/sso

FetchcURL

```
const url = 'http://127.0.0.1:25737/api/user/teams/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/sso';
const options = {
  method: 'PUT',
  headers: {cookie: 'hk_token=<hk_token>', 'Content-Type': 'application/json'},
  body: '{"allowed_domains":["example"],"auto_provision":true,"client_id":"example","client_secret":"example","display_name_claim":"name","email_claim":"email","enabled":true,"issuer_url":"https://example.com","provider_type":"oidc"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```
curl --request PUT \
  --url http://127.0.0.1:25737/api/user/teams/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/sso \
  --header 'Content-Type: application/json' \
  --cookie hk_token=<hk_token> \
  --data '{ "allowed_domains": [ "example" ], "auto_provision": true, "client_id": "example", "client_secret": "example", "display_name_claim": "name", "email_claim": "email", "enabled": true, "issuer_url": "https://example.com", "provider_type": "oidc" }'
```

-

Validates OIDC discovery and stores the client secret encrypted with the instance key. Leave client_secret blank to keep an existing secret, or provide a new value to rotate it. Enabling this configuration adds SSO as an optional login method; password login is unchanged.

## Authorizations

- **[cookieAuth](https://hitkeep.com/api/#cookieauth)**

## Parameters

### Path Parameters

**id**

required

string format: uuid

## Request Bodyrequired

application/json

object

**allowed_domains**

required

Array<string>

>= 1 items <= 50 items

**auto_provision**

required

When true, verified users from trusted domains may join this team as Members without an invitation. Managed-cloud seat and team limits still apply.

boolean

**client_id**

required

string

<= 512 characters

**client_secret**

Required on create. Blank preserves the stored secret on update.

string

**display_name_claim**

required

string

default: name

**email_claim**

required

string

default: email

**enabled**

required

boolean

**issuer_url**

required

string format: uri

<= 2048 characters

**provider_type**

required

string

Allowed values: oidc

## Responses

### 200

Redacted team SSO configuration

application/json

Redacted team OIDC configuration. The client secret is never returned.

object

**allowed_domains**

required

Array<string>

**auto_provision**

required

boolean

**callback_url**

required

string format: uri

**client_id**

required

string

**client_secret_configured**

required

boolean

**display_name_claim**

required

string

**email_claim**

required

string

**enabled**

required

boolean

**issuer_url**

required

string format: uri

**provider_type**

required

string

Allowed values: oidc

**updated_at**

string format: date-time

##### Example

```
{
  "provider_type": "oidc"
}
```

### 400

Invalid configuration or missing client secret

application/json

object

**message**

string

##### Examplegenerated

```
{
  "message": "example"
}
```

### 403

Team settings permission or SSO entitlement required

application/json

object

**message**

string

##### Examplegenerated

```
{
  "message": "example"
}
```

### 409

An allowed email domain belongs to another team SSO configuration

application/json

object

**message**

string

##### Examplegenerated

```
{
  "message": "example"
}
```

### 502

OIDC discovery failed

application/json

object

**message**

string

##### Examplegenerated

```
{
  "message": "example"
}
```

[Previous Get team SSO configuration](https://hitkeep.com/api/operations/apiuserteamsidsso/get/)[Next Delete team SSO configuration](https://hitkeep.com/api/operations/apiuserteamsidsso/delete/)