Update SSO Configuration
Edit an SSO connection on the caller's active account. Commonly used to rotate the IdP client secret, switch the OIDC endpoints, or toggle enforced.
This is a full replacement: send the same fields as create, and all of the same Req fields must be present. The one exception is client_secret — because GET endpoints never return the secret, leave it empty/omitted to keep the stored one, or pass a new value to rotate it.
Plan-gated: requires the sso entitlement on the account's plan. Permission-gated: the caller needs the settings:update account permission — members without it get 403.
Saving resets status to active and clears the last test result (last_error_message, last_tested_at); re-run test afterwards. Changing email_domain on an oidc/saml config resets domain verification — domain_verified returns to false, a fresh DNS-TXT record is issued in the response, and the config stops applying at login until you re-run verify-domain. google/github stay auto-verified.
Path parameters
Request body
Same fields as create. Notable behaviors on update:
oidc/saml configs.google | github | oidc | saml. For google/github the auth_url/token_url/userinfo_url are force-locked to canonical endpoints; any supplied values are ignored.oidc/saml. Must be HTTPS and public (SSRF-guarded).true, matching users are forced through SSO and password login is rejected. Requires the account's plan to include the sso entitlement (else 403).Response (200 OK)
The updated SSO config (SSOConfigResponse, secret never included). For an oidc/saml config whose email_domain changed, domain_verified is false and the response carries domain_verify_record_name / domain_verify_record_value — the TXT record to publish before calling verify-domain.
Errors
provider_type, or non-HTTPS/private endpoint URL.settings:update permission, plan lacks the sso entitlement, or enforced: true requested on a plan without SSO.email_domain.