Create SSO Configuration
Create a new SSO connection for the caller's active account. Once a matching config is enforced and (for custom IdPs) domain-verified, account members whose email addresses match the configured email_domain are forced through your IdP at login instead of using password auth.
Plan-gated: requires the account's sso entitlement (else 403). Permission-gated: requires the settings:write account permission — members without it get 403.
Each email_domain can have at most one SSO config per account. Adding a second one for the same domain returns 409.
After creation, run POST /v1/sso/config/{id}/test to sanity-check the config. For oidc / saml providers you must also complete domain verification before the config applies at login (see below).
Request body
@<email_domain> hit this config. Must be unique within the account.google, github, oidc, saml. For google / github the OAuth endpoints are fixed (see below); oidc / saml are custom IdPs that require their own endpoint URLs.client_secret keeps the existing secret.provider_type: "oidc" and "saml". Ignored for google / github — the platform force-locks those to Google's / GitHub's canonical endpoints, overriding any values you send (a fake-IdP guard). Must be https and resolve to a public host; internal/private hosts (link-local, RFC1918, cluster-internal) are rejected with 400.openid profile email (user:email for github).true, account members whose email domain matches are forced through SSO — their password login is rejected. Requires the account's plan to include the sso entitlement or the request is refused with 403. Default false (opt-in SSO).Domain verification (oidc / saml)
Before a custom oidc / saml config applies at login, the account must prove it owns email_domain. On create (and whenever email_domain changes) the config is returned with domain_verified: false plus a DNS-TXT challenge in domain_verify_record_name / domain_verify_record_value. Publish that TXT record, then call POST /v1/sso/config/{id}/verify-domain — on an exact match domain_verified flips to true.
google / github configs are auto-verified (identity is asserted by the provider and the endpoints are locked), so they carry no TXT challenge and apply immediately.
Response (200 OK)
The newly-created SSO config (secret never included). Fields: id, account_id, email_domain, provider_type, client_id, auth_url, token_url, userinfo_url, scopes, status (active | error), enforced, domain_verified, domain_verify_record_name (omitted once verified / for google+github), domain_verify_record_value (same), last_error_message, last_tested_at, created_at, updated_at.
Errors
provider_type, missing auth_url/token_url/userinfo_url for oidc/saml, or a non-https / internal endpoint URL.settings:write, the account's plan doesn't include SSO, or enforced: true was sent for a plan without the SSO entitlement.email_domain already exists in the account.