POST
/api/v1/ssoConfigure SSO
Creates or (when `id` is supplied) updates an org's SAML/OIDC SSO configuration. Requires `orgId`, `provider` (`saml`|`oidc`) and `domain`; SAML additionally requires `idp_entity_id` and `idp_sso_url` and validates any `idp_certificate` as PEM (100-20,000 chars), OIDC requires `oidc_issuer` and `oidc_client_id`. URLs are checked for syntactic validity only — there is no SSRF/private-address check on IdP URLs. Any `oidc_client_secret` is encrypted with AES-256-GCM under BYOK_SECRET before storage (500 ENCRYPTION_NOT_CONFIGURED if that key is unset). Requires admin role and the Team-tier `sso` feature. 409 DUPLICATE_DOMAIN / DOMAIN_ALREADY_CLAIMED on a domain conflict, and 409 DOMAIN_NOT_VERIFIED when enabling before DNS ownership is proven. Returns 201 on create, 200 on update; secrets and certificates are never echoed back.
Authentication
Send Authorization: Bearer YOUR_API_KEY on every request. Generate API keys at /dashboard/settings/api-keys.
Request body required
Example
{
"orgId": "00000000-0000-0000-0000-000000000000",
"id": "00000000-0000-0000-0000-000000000000",
"provider": "saml",
"domain": "string",
"idp_entity_id": "string",
"idp_sso_url": "https://example.com",
"idp_certificate": "string",
"oidc_issuer": "https://example.com",
"oidc_client_id": "string",
"oidc_client_secret": "string",
"enabled": false,
"enforce": false,
"auto_provision": false,
"default_role": "admin",
"metadata": {}
}Schema
{
"application/json": {
"schema": {
"type": "object",
"properties": {
"orgId": {
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
},
"id": {
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
},
"provider": {
"type": "string",
"enum": [
"saml",
"oidc"
]
},
"domain": {
"type": "string",
"minLength": 1,
"maxLength": 255
},
"idp_entity_id": {
"type": "string",
"maxLength": 500
},
"idp_sso_url": {
"type": "string",
"maxLength": 2048,
"format": "uri"
},
"idp_certificate": {
"type": "string",
"minLength": 100,
"maxLength": 20000
},
"oidc_issuer": {
"type": "string",
"maxLength": 2048,
"format": "uri"
},
"oidc_client_id": {
"type": "string",
"maxLength": 500
},
"oidc_client_secret": {
"type": "string",
"maxLength": 2048
},
"enabled": {
"type": "boolean"
},
"enforce": {
"type": "boolean"
},
"auto_provision": {
"type": "boolean"
},
"default_role": {
"type": "string",
"enum": [
"admin",
"editor",
"viewer",
"member"
]
},
"metadata": {
"type": "object",
"additionalProperties": {}
}
},
"required": [
"orgId",
"provider",
"domain"
],
"additionalProperties": false
}
}
}Response
200 example
{
"success": true
}All status codes
200SSO configured.
201Created.
400(no description)
401(no description)
403Forbidden — insufficient role for this operation.
409Conflict — CONFLICT, DOMAIN_NOT_VERIFIED.
429(no description)
500Internal Server Error — DB_ERROR, ENCRYPTION_NOT_CONFIGURED.
Code samples
cURL
curl -X POST \
https://evalguard.ai/api/v1/sso \
-H "Authorization: Bearer $EVALGUARD_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "orgId": "00000000-0000-0000-0000-000000000000", "id": "00000000-0000-0000-0000-000000000000", "provider": "saml", "domain": "string", "idp_entity_id": "string", "idp_sso_url": "https://example.com", "idp_certificate": "string", "oidc_issuer": "https://example.com", "oidc_client_id": "string", "oidc_client_secret": "string", "enabled": false, "enforce": false, "auto_provision": false, "default_role": "admin", "metadata": {} }'TypeScript
// The TypeScript SDK (@evalguard/sdk) exposes TYPED methods — runEval,
// getEval, runSecurityScan, checkFirewall, … — not a generic request().
// For an arbitrary endpoint, call it directly:
const res = await fetch("https://evalguard.ai/api/v1/sso", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.EVALGUARD_API_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
"orgId": "00000000-0000-0000-0000-000000000000",
"id": "00000000-0000-0000-0000-000000000000",
"provider": "saml",
"domain": "string",
"idp_entity_id": "string",
"idp_sso_url": "https://example.com",
"idp_certificate": "string",
"oidc_issuer": "https://example.com",
"oidc_client_id": "string",
"oidc_client_secret": "string",
"enabled": false,
"enforce": false,
"auto_provision": false,
"default_role": "admin",
"metadata": {}
}),
});
console.log(res.status, await res.json());Python
# The Python SDK (pip install evalguardai) exposes TYPED methods on
# EvalGuardClient — run_eval, get_eval, … — not a generic request().
# For an arbitrary endpoint, call it directly:
import os
import requests
headers = {"Authorization": f"Bearer {os.environ['EVALGUARD_API_KEY']}"}
headers["Content-Type"] = "application/json"
response = requests.request(
"POST",
"https://evalguard.ai/api/v1/sso",
headers=headers,
json={
"orgId": "00000000-0000-0000-0000-000000000000",
"id": "00000000-0000-0000-0000-000000000000",
"provider": "saml",
"domain": "string",
"idp_entity_id": "string",
"idp_sso_url": "https://example.com",
"idp_certificate": "string",
"oidc_issuer": "https://example.com",
"oidc_client_id": "string",
"oidc_client_secret": "string",
"enabled": False,
"enforce": False,
"auto_provision": False,
"default_role": "admin",
"metadata": {}
},
)
print(response.status_code, response.json())Go
package main
import (
"context"
"fmt"
"net/http"
"os"
"strings"
)
func main() {
body := strings.NewReader(`{"orgId":"00000000-0000-0000-0000-000000000000","id":"00000000-0000-0000-0000-000000000000","provider":"saml","domain":"string","idp_entity_id":"string","idp_sso_url":"https://example.com","idp_certificate":"string","oidc_issuer":"https://example.com","oidc_client_id":"string","oidc_client_secret":"string","enabled":false,"enforce":false,"auto_provision":false,"default_role":"admin","metadata":{}}`)
req, _ := http.NewRequestWithContext(context.Background(), "POST", "https://evalguard.ai/api/v1/sso", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("EVALGUARD_API_KEY"))
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
fmt.Println(resp.Status)
}Errors
400401403409429500