Set IdP initiated auth config

PUT /api/sso-connectors/{id}/idp-initiated-auth-config

Set IdP initiated authentication config for a given SAML SSO connector. Any existing IdP initiated auth config will be overwritten.

Path parameters

id string Required

The unique identifier of the sso connector.

application/json

Body object Required

defaultApplicationId Required

The unique identifier for the application that users will sign in to using IdP initiated authentication. The application type must be Traditional or SPA. autoSendAuthorizationRequest is not supported for SPA applications.

Minimum length is 1, maximum length is 21.
autoSendAuthorizationRequest Required

Whether to automatically send an authorization request to the application's OIDC authorization endpoint when a IdP initiated authentication request is received. If not provided, Logto will use the default value false.
clientIdpInitiatedAuthCallbackUri Required

The callback URI for the IdP initiated authentication request. Only available when autoSendAuthorizationRequest is false. Logto will redirect the user to this URI after the IdP initiated authentication request is received. You should manually trigger the authorization request to the application's OIDC authorization endpoint at the client side.
redirectUri

The sign-in callback redirect URI for the application. This URI must be registered in the application's OIDC client metadata. If not provided, Logto will use the first registered redirect URI of the application. Only available when autoSendAuthorizationRequest is true.
authParameters

The additional parameters to be sent to the application's OIDC authorization endpoint, e.g. resources and scopes. Only available when autoSendAuthorizationRequest is true.

defaultApplicationId Required

The unique identifier for the application that users will sign in to using IdP initiated authentication. The application type must be Traditional or SPA. autoSendAuthorizationRequest is not supported for SPA applications.

Minimum length is 1, maximum length is 21.
autoSendAuthorizationRequest Required

Whether to automatically send an authorization request to the application's OIDC authorization endpoint when a IdP initiated authentication request is received. If not provided, Logto will use the default value false.
clientIdpInitiatedAuthCallbackUri

The callback URI for the IdP initiated authentication request. Only available when autoSendAuthorizationRequest is false. Logto will redirect the user to this URI after the IdP initiated authentication request is received. You should manually trigger the authorization request to the application's OIDC authorization endpoint at the client side.
redirectUri

The sign-in callback redirect URI for the application. This URI must be registered in the application's OIDC client metadata. If not provided, Logto will use the first registered redirect URI of the application. Only available when autoSendAuthorizationRequest is true.
authParameters

The additional parameters to be sent to the application's OIDC authorization endpoint, e.g. resources and scopes. Only available when autoSendAuthorizationRequest is true.
Hide authParameters attribute Show authParameters attribute
- scope string

Responses

200 application/json

The updated IdP initiated auth config.
Hide response attributes Show response attributes object
- tenantId string Required
  
  Maximum length is 21.
- connectorId string Required
  
  Minimum length is 1, maximum length is 128.
- defaultApplicationId string Required
  
  Minimum length is 1, maximum length is 21.
- redirectUri string | null Required
- authParameters object Required
  
  Hide authParameters attribute Show authParameters attribute object
  
  scope string
- autoSendAuthorizationRequest boolean Required
- clientIdpInitiatedAuthCallbackUri string | null Required
- createdAt number Required
400

The request body is invalid. The SSO connector is not a SAML connector or the application is not a Traditional web application.
401

Unauthorized
403

Forbidden
404

SSO connector or application not found.

PUT /api/sso-connectors/{id}/idp-initiated-auth-config

curl \
 --request PUT 'https://[tenant_id].logto.app/api/sso-connectors/{id}/idp-initiated-auth-config' \
 --header "Authorization: Bearer $ACCESS_TOKEN" \
 --header "Content-Type: application/json"

Request examples

{}

{
  "authParameters": {
    "scope": "string"
  }
}

Response examples (200)

{
  "tenantId": "string",
  "connectorId": "string",
  "defaultApplicationId": "string",
  "redirectUri": "string",
  "authParameters": {
    "scope": "string"
  },
  "autoSendAuthorizationRequest": true,
  "clientIdpInitiatedAuthCallbackUri": "string",
  "createdAt": 42.0
}