PATCH
/saml_connections/{saml_connection_id}DeprecatedUpdate a SAML Connection
Updates the SAML Connection whose ID matches the provided id in the path.
Deprecated: Use the Enterprise Connections API instead. This endpoint will be removed in future versions.
- IdempotentThe SDK sends
Idempotency-Key, so a retried request is only applied once.
saml_connection_idstringrequired
The ID of the SAML Connection to update
namestringoptional
The name of the new SAML Connection
domainstringdeprecatedoptional
The domain to use for the new SAML Connection
domainsarray<string>optional
A list of the domains on use for the SAML connection
idp_entity_idstringoptional
The Entity ID as provided by the IdP
idp_sso_urlstringoptional
The SSO URL as provided by the IdP
idp_certificatestringdeprecatedoptional
Deprecated, use idp_certificates. One X.509 certificate, PEM or bare base64, or several concatenated PEM certificates; replaces the connection's whole certificate set
idp_certificatesarray<string>optional
The IdP X.509 signing certificates the connection trusts, one per entry, in PEM or bare base64. Replaces the connection's whole certificate set and takes precedence over idp_certificate
idp_metadata_urlstringoptional
The URL which serves the IdP metadata. If present, it takes priority over the corresponding individual properties and replaces them
idp_metadatastringoptional
The XML content of the IdP metadata file. If present, it takes priority over the corresponding individual properties
organization_idstringoptional
The ID of the organization to which users of this SAML Connection will be added
attribute_mappingobjectoptional
Define the attribute name mapping between Identity Provider and Clerk's user properties
activebooleanoptional
Activate or de-activate the SAML Connection
sync_user_attributesbooleanoptional
Controls whether to update the user's attributes in each sign-in
allow_subdomainsbooleanoptional
Allow users with an email address subdomain to use this connection in order to authenticate
allow_idp_initiatedbooleanoptional
Enable or deactivate IdP-initiated flows
disable_additional_identificationsbooleanoptional
Enable or deactivate additional identifications
allow_organization_account_linkingbooleanoptional
Whether this connection supports account linking via organization membership
force_authnbooleanoptional
Enable or deactivate ForceAuthn
login_hintobjectoptional
Configuration for the login_hint sent to the IdP on SSO sign-in
consent_verified_domains_deletionbooleanoptional
When enabling the connection, controls behavior when verified domains used for enrollment modes like automatic invitation or automatic suggestion already exist for the same domain. If true, those verified domains are removed and the connection is enabled. If false or omitted, the request fails when any such verified domain exists.
200A SAML Connection
objectstringrequired
idstringrequired
namestringrequired
domainstringdeprecatedoptional
domainsarray<string>optional
idp_entity_idstringrequired
idp_sso_urlstringrequired
idp_certificatestringrequired
idp_certificate_issued_atintegerrequired
Unix timestamp (milliseconds) of the start of the IdP certificate validity window (X.509 NotBefore). Null when no certificate is configured.
idp_certificate_expires_atintegerrequired
Unix timestamp (milliseconds) of the end of the IdP certificate validity window (X.509 NotAfter). Null when no certificate is configured.
idp_certificatesarray<object>required
Every IdP signing certificate the connection trusts, primary first. A SAML response verifies against any of them.
idp_metadata_urlstringoptional
idp_metadatastringoptional
acs_urlstringrequired
sp_entity_idstringrequired
sp_metadata_urlstringrequired
organization_idstringoptional
attribute_mappingobjectoptional
activebooleanrequired
providerstringrequired
user_countintegerrequired
sync_user_attributesbooleanrequired
allow_subdomainsbooleanrequired
allow_idp_initiatedbooleanrequired
disable_additional_identificationsbooleanrequired
allow_organization_account_linkingbooleanrequired
force_authnbooleanrequired
Enable or deactivate ForceAuthn
login_hintobjectrequired
Configuration for the login_hint sent to the IdP on SSO sign-in
enterprise_connection_idstringoptional
created_atintegerrequired
Unix timestamp of creation.
updated_atintegerrequired
Unix timestamp of last update.
402Payment required
errorsarray<object>required
metaobjectoptional
clerk_trace_idstringoptional
403Authorization invalid
errorsarray<object>required
metaobjectoptional
clerk_trace_idstringoptional
404Resource not found
errorsarray<object>required
metaobjectoptional
clerk_trace_idstringoptional
409Request was not successful
errorsarray<object>required
metaobjectoptional
clerk_trace_idstringoptional
422Invalid request parameters
errorsarray<object>required
metaobjectoptional
clerk_trace_idstringoptional
Error handling
A 402 is returned: Payment required. A 403 is returned: Authorization invalid. A 404 is returned: Resource not found. A 409 is returned: Request was not successful. A 422 is returned: Invalid request parameters.