# Update SSO provider

Partially update an existing SSO provider.

Source: https://statusdashboard.com/docs/api/security/sso/update

`PATCH /app/sso/providers/{providerId}`

Partially updates an SSO provider. Only the fields you include are changed. Requires the **SSO** feature entitlement.

* `providerType` is immutable — you cannot switch a provider between SAML and OIDC.
* If `domains` is provided, it **replaces** the entire domain set atomically. Domains already owned by this provider are accepted freely; domains owned by another provider return `409`.
* For OIDC providers, send `oidcClientSecret` as an empty string to leave the existing secret unchanged; send a non-empty value to update it.
* When `samlMetadataXml` is updated, `idpLogoutUrl` is re-extracted automatically. When `oidcIssuer` is updated, the discovery document is re-fetched to refresh `idpLogoutUrl`.

***

## Path parameters
| Parameter    | Description                   |
| ------------ | ----------------------------- |
| `providerId` | The UUID of the SSO provider. |

***

## Request
See [API Basics](/docs/api) for required headers.

All request body fields are optional. Include only the fields you want to update.

| Field                       | Type      | Description                                                                                                                                           |
| --------------------------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| `name`                      | string    | Display name for the provider. Max 100 characters.                                                                                                    |
| `enabled`                   | boolean   | Whether the provider is active for SSO login.                                                                                                         |
| `domains`                   | string\[] | Replacement domain set. Replaces the full existing set when provided (at least one domain). Subject to your organization's per-provider domain limit. |
| `samlMetadataXml`           | string    | Updated IdP federation metadata XML (SAML only). Max 50,000 characters.                                                                               |
| `oidcIssuer`                | string    | Issuer URL (OIDC only).                                                                                                                               |
| `oidcClientId`              | string    | Client ID (OIDC only).                                                                                                                                |
| `oidcClientSecret`          | string    | Client secret (OIDC only). Send empty string to keep existing.                                                                                        |
| `oidcAuthorizationEndpoint` | string    | Authorization endpoint URL (OIDC only).                                                                                                               |
| `oidcTokenEndpoint`         | string    | Token endpoint URL (OIDC only).                                                                                                                       |
| `oidcUserInfoEndpoint`      | string    | UserInfo endpoint URL (OIDC only).                                                                                                                    |
| `oidcJwksUri`               | string    | JWKS URI (OIDC only).                                                                                                                                 |

***

## Sample request
```bash
curl -X PATCH https://api.statusdashboard.com/app/sso/providers/a1b2c3d4-e5f6-7890-abcd-ef1234567890 \
  -H "Authorization: Bearer bcf847abf5c6:def456" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": false,
    "domains": ["acme.com"]
  }'
```

## Sample response
**Status: `200 OK`**

Returns the full updated provider record. Shape is identical to [Get SSO provider](/docs/api/security/sso/get).

```json
{
  "providerId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "name": "Acme SAML",
  "providerType": "SAML",
  "cognitoProviderName": "PLATFORM-a1b2c3d4-ef123456",
  "enabled": false,
  "domains": ["acme.com"],
  "samlMetadataXml": "<?xml version=\"1.0\"?>...",
  "idpLogoutUrl": "https://idp.acme.com/saml/logout",
  "createdAt": "2026-01-10T12:00:00.000Z",
  "updatedAt": "2026-05-01T10:00:00.000Z"
}
```

***

## Error responses
| Status | When                                                                                                                  |
| ------ | --------------------------------------------------------------------------------------------------------------------- |
| `400`  | Validation error, or the SAML metadata is invalid or contains expired certificates. See `error` in the response body. |
| `403`  | SSO feature not enabled on the plan, or the per-provider domain limit has been reached.                               |
| `404`  | SSO provider not found or does not belong to the caller's organization.                                               |
| `409`  | One or more of the specified domains is already in use by another provider.                                           |