Update SSO configuration

Create or replace the workspace's OpenID Connect single sign-on configuration.

PUThttps://api.tried.com.au/workspace/sso

Creates or replaces the workspace's OIDC single sign-on configuration. Users whose email domain is in domains then sign in through your identity provider, and new users join as member. Admin only.

Request#

Field	Type	Required	Description
`issuer`	string	Yes	Issuer URL, 4 to 500 characters. `mock` (or the mock issuer URL) selects the built-in mock identity provider, which is off in production.
`client_id`	string	Yes	OIDC client ID, up to 500 characters.
`client_secret`	string or null	No	Client secret, up to 1000 characters. Leave it out to keep the stored secret. `null` clears it.
`domains`	string[]	Yes	1 to 20 bare domains such as `example.com`. Stored lowercased. A domain can belong to only one workspace.
`enabled`	boolean	No	Default `true`.

Example request#

curl -X PUT https://api.tried.com.au/workspace/sso \
  -H "Authorization: Bearer $TRIED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "issuer": "https://login.microsoftonline.com/7d1f2c3a-9b4e-4a5f-8c6d-0e1f2a3b4c5d/v2.0",
    "client_id": "5e8f1a2b-3c4d-4e5f-9a0b-1c2d3e4f5a6b",
    "client_secret": "kq8Q~example-secret",
    "domains": [
      "harbourdental.com.au"
    ],
    "enabled": true
  }'

const res = await fetch("https://api.tried.com.au/workspace/sso", {
  method: "PUT",
  headers: {
    Authorization: `Bearer ${process.env.TRIED_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "issuer": "https://login.microsoftonline.com/7d1f2c3a-9b4e-4a5f-8c6d-0e1f2a3b4c5d/v2.0",
    "client_id": "5e8f1a2b-3c4d-4e5f-9a0b-1c2d3e4f5a6b",
    "client_secret": "kq8Q~example-secret",
    "domains": [
      "harbourdental.com.au"
    ],
    "enabled": true
  }),
});
const sso = await res.json();

import os, requests

res = requests.put(
    "https://api.tried.com.au/workspace/sso",
    headers={"Authorization": f"Bearer {os.environ['TRIED_API_KEY']}"},
    json={
        "issuer": "https://login.microsoftonline.com/7d1f2c3a-9b4e-4a5f-8c6d-0e1f2a3b4c5d/v2.0",
        "client_id": "5e8f1a2b-3c4d-4e5f-9a0b-1c2d3e4f5a6b",
        "client_secret": "kq8Q~example-secret",
        "domains": [
            "harbourdental.com.au",
        ],
        "enabled": True,
    },
)
sso = res.json()

Response#

200 OK

{
  "provider": "oidc",
  "issuer": "https://login.microsoftonline.com/7d1f2c3a-9b4e-4a5f-8c6d-0e1f2a3b4c5d/v2.0",
  "client_id": "5e8f1a2b-3c4d-4e5f-9a0b-1c2d3e4f5a6b",
  "has_client_secret": true,
  "domains": [
    "harbourdental.com.au"
  ],
  "enabled": true,
  "mock": false,
  "redirect_uri": "https://api.tried.com.au/auth/sso/callback"
}

Returns the saved configuration. Fields are as in Get SSO configuration.

Errors#

Status	When
`400`	`One of those domains is already used by another workspace`, `The mock identity provider is not available here`, or a validation error such as `domains.0: Use bare domains like example.com`.
`401`	Missing or invalid API key.
`403`	The key's IP allowlist or scopes reject the request. This route needs the `admin` scope. A dashboard user without the right role gets `Requires role: admin`. API keys act as admin.
`429`	Rate limit exceeded. See Rate limits.

See Errors for the body format.