Update SAML configuration

Create or replace the workspace's SAML 2.0 sign-in configuration.

PUThttps://api.tried.com.au/workspace/saml

Creates or replaces the workspace's SAML 2.0 configuration. Users whose email domain is in domains then sign in through your identity provider and join with default_role. Admin only.

Request#

Field	Type	Required	Description
`idp_sso_url`	string	Yes	IdP single sign-on URL, or `mock` for the built-in mock IdP (off in production).
`idp_entity_id`	string	Yes, unless `mock`	IdP entity ID, up to 500 characters.
`idp_cert`	string	Yes, unless `mock`	IdP signing certificate (PEM or base64), 20 to 20000 characters.
`domains`	string[]	Yes	1 to 20 bare domains such as `example.com`. Stored lowercased. A domain can belong to only one workspace.
`enabled`	boolean	No	Default `true`.
`default_role`	string	No	`admin`, `developer` or `member`. Default `member`.

Example request#

curl -X PUT https://api.tried.com.au/workspace/saml \
  -H "Authorization: Bearer $TRIED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "idp_sso_url": "https://harbourdental.okta.com/app/harbourdental_tried/exk1a2b3c4d5e6f7g8h9/sso/saml",
    "idp_entity_id": "http://www.okta.com/exk1a2b3c4d5e6f7g8h9",
    "idp_cert": "MIIDqDCCApCgAwIBAgIGAZK...",
    "domains": [
      "harbourdental.com.au"
    ],
    "default_role": "member"
  }'

const res = await fetch("https://api.tried.com.au/workspace/saml", {
  method: "PUT",
  headers: {
    Authorization: `Bearer ${process.env.TRIED_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "idp_sso_url": "https://harbourdental.okta.com/app/harbourdental_tried/exk1a2b3c4d5e6f7g8h9/sso/saml",
    "idp_entity_id": "http://www.okta.com/exk1a2b3c4d5e6f7g8h9",
    "idp_cert": "MIIDqDCCApCgAwIBAgIGAZK...",
    "domains": [
      "harbourdental.com.au"
    ],
    "default_role": "member"
  }),
});
const saml = await res.json();

import os, requests

res = requests.put(
    "https://api.tried.com.au/workspace/saml",
    headers={"Authorization": f"Bearer {os.environ['TRIED_API_KEY']}"},
    json={
        "idp_sso_url": "https://harbourdental.okta.com/app/harbourdental_tried/exk1a2b3c4d5e6f7g8h9/sso/saml",
        "idp_entity_id": "http://www.okta.com/exk1a2b3c4d5e6f7g8h9",
        "idp_cert": "MIIDqDCCApCgAwIBAgIGAZK...",
        "domains": [
            "harbourdental.com.au",
        ],
        "default_role": "member",
    },
)
saml = res.json()

Response#

200 OK

{
  "idp_sso_url": "https://harbourdental.okta.com/app/harbourdental_tried/exk1a2b3c4d5e6f7g8h9/sso/saml",
  "idp_entity_id": "http://www.okta.com/exk1a2b3c4d5e6f7g8h9",
  "has_idp_cert": true,
  "domains": [
    "harbourdental.com.au"
  ],
  "enabled": true,
  "default_role": "member",
  "mock": false,
  "sp_entity_id": "https://api.tried.com.au/auth/saml/ws_3f9a1c7e5b2d4086a1c9e7f2/metadata",
  "acs_url": "https://api.tried.com.au/auth/saml/ws_3f9a1c7e5b2d4086a1c9e7f2/acs",
  "metadata_url": "https://api.tried.com.au/auth/saml/ws_3f9a1c7e5b2d4086a1c9e7f2/metadata"
}

Returns the saved configuration. Fields are as in Get SAML configuration. The change is written to the audit log as workspace.saml_update.

Errors#

Status	When
`400`	`idp_entity_id and idp_cert are required`, `One of those domains is already used by another workspace`, `The mock identity provider is not available here`, or a validation error such as `idp_sso_url: Invalid url`.
`401`	Missing or invalid API key.
`403`	The key's IP allowlist or scopes reject the request. This route needs the `admin` scope. A dashboard user without the right role gets `Requires role: admin`. API keys act as admin.
`429`	Rate limit exceeded. See Rate limits.

See Errors for the body format.