# Create SSO provider

Create a new SAML or OIDC SSO provider for your organization.

Source: https://statusdashboard.com/docs/api/security/sso/create

`POST /app/sso/providers`

Creates a new SSO provider and registers it as a Cognito identity provider. Requires the **SSO** feature entitlement.

* Each domain must be globally unique — a domain cannot be assigned to more than one provider across all organizations.
* Each provider requires at least one email domain. The maximum domains per provider is set for your organization and returned in [List SSO providers](/docs/api/security/sso/list) and [Get SSO provider](/docs/api/security/sso/get) responses.
* `idpLogoutUrl` is auto-extracted from SAML metadata or discovered from the OIDC discovery document on save.
* Creating a provider does **not** automatically enable SSO for any dashboard. Use [Configure SSO provider](/docs/api/status-dashboards/dashboards/sso/update) on a dashboard to activate it.

***

## Path parameters
None.

***

## Request
See [API Basics](/docs/api) for required headers.

### Request body — SAML
| Field             | Type      | Required | Description                                                                                                                                           |
| ----------------- | --------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| `providerType`    | `"SAML"`  | Yes      | Must be `"SAML"`.                                                                                                                                     |
| `name`            | string    | Yes      | Display name for the provider. Max 100 characters.                                                                                                    |
| `enabled`         | boolean   | No       | Whether the provider is active. Defaults to `true`.                                                                                                   |
| `domains`         | string\[] | Yes      | Email domains that route users to this provider (at least one required, e.g. `"acme.com"`). Subject to your organization's per-provider domain limit. |
| `samlMetadataXml` | string    | Yes      | The IdP federation metadata XML. Max 50,000 characters.                                                                                               |

### Request body — OIDC
| Field          | Type      | Required | Description                                                                                                                        |
| -------------- | --------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| `providerType` | `"OIDC"`  | Yes      | Must be `"OIDC"`.                                                                                                                  |
| `name`         | string    | Yes      | Display name for the provider. Max 100 characters.                                                                                 |
| `enabled`      | boolean   | No       | Whether the provider is active. Defaults to `true`.                                                                                |
| `domains`      | string\[] | Yes      | Email domains that route users to this provider (at least one required). Subject to your organization's per-provider domain limit. |
| `oidc`         | object    | Yes      | OIDC provider details. See below.                                                                                                  |

#### `oidc` object
| Field                   | Type   | Required | Description                                                      |
| ----------------------- | ------ | -------- | ---------------------------------------------------------------- |
| `issuer`                | string | Yes      | Issuer URL of the identity provider (must be a valid HTTPS URL). |
| `clientId`              | string | Yes      | Client ID assigned by the IdP.                                   |
| `clientSecret`          | string | Yes      | Client secret assigned by the IdP.                               |
| `authorizationEndpoint` | string | Yes      | Authorization endpoint URL.                                      |
| `tokenEndpoint`         | string | Yes      | Token endpoint URL.                                              |
| `userInfoEndpoint`      | string | Yes      | UserInfo endpoint URL.                                           |
| `jwksUri`               | string | Yes      | JWKS URI for verifying ID tokens.                                |

***

## Sample request — SAML
```bash
curl -X POST https://api.statusdashboard.com/app/sso/providers \
  -H "Authorization: Bearer bcf847abf5c6:def456" \
  -H "Content-Type: application/json" \
  -d '{
    "providerType": "SAML",
    "name": "Acme SAML",
    "domains": ["acme.com", "acme.org"],
    "samlMetadataXml": "<?xml version=\"1.0\"?>..."
  }'
```

## Sample request — OIDC
```bash
curl -X POST https://api.statusdashboard.com/app/sso/providers \
  -H "Authorization: Bearer bcf847abf5c6:def456" \
  -H "Content-Type: application/json" \
  -d '{
    "providerType": "OIDC",
    "name": "Acme OIDC",
    "domains": ["internal.acme.com"],
    "oidc": {
      "issuer": "https://dev-12345678.okta.com",
      "clientId": "0oabc123def456ghi789",
      "clientSecret": "your-client-secret",
      "authorizationEndpoint": "https://dev-12345678.okta.com/oauth2/v1/authorize",
      "tokenEndpoint": "https://dev-12345678.okta.com/oauth2/v1/token",
      "userInfoEndpoint": "https://dev-12345678.okta.com/oauth2/v1/userinfo",
      "jwksUri": "https://dev-12345678.okta.com/oauth2/v1/keys"
    }
  }'
```

## Sample response
**Status: `201 Created`**

```json
{
  "providerId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "name": "Acme SAML",
  "providerType": "SAML",
  "cognitoProviderName": "PLATFORM-a1b2c3d4-ef123456",
  "enabled": true,
  "domains": ["acme.com", "acme.org"],
  "samlMetadataXml": "<?xml version=\"1.0\"?>...",
  "createdAt": "2026-01-10T12:00:00.000Z",
  "updatedAt": "2026-01-10T12:00:00.000Z"
}
```

For OIDC providers the response includes `oidcIssuer` and `oidcClientId`. Use [Get SSO provider](/docs/api/security/sso/get) to retrieve the full configuration.

***

## Error responses
| Status | When                                                                                                                  |
| ------ | --------------------------------------------------------------------------------------------------------------------- |
| `400`  | Validation error, or the SAML metadata is invalid or contains expired certificates. See `error` in the response body. |
| `403`  | SSO feature not enabled on the plan, or the per-provider domain limit has been reached.                               |
| `409`  | One or more of the specified domains is already in use by another provider.                                           |