# Configure SSO provider

Create or replace the SSO provider for a dashboard.

Source: https://statusdashboard.com/docs/api/status-dashboards/dashboards/sso/update

`PUT /app/dashboards/{id}/sso`

Creates or replaces the SSO provider for a dashboard. If a provider already exists, it is fully replaced by the new configuration. Requires the **SSO** feature entitlement.

Saving a provider does **not** automatically enable SSO enforcement. Use the [Toggle SSO](/docs/api/status-dashboards/dashboards/sso/toggle) endpoint to enable it after configuration.

***

## Path parameters
| Parameter | Description                |
| --------- | -------------------------- |
| `id`      | The UUID of the dashboard. |

***

## Request
See [API Basics](/docs/api) for required headers.

### Request body — SAML
| Field             | Type     | Required | Description                                                 |
| ----------------- | -------- | -------- | ----------------------------------------------------------- |
| `providerType`    | `"SAML"` | Yes      | Must be `"SAML"`.                                           |
| `samlMetadataXml` | string   | Yes      | The IdP federation metadata XML. Maximum 50,000 characters. |

### Request body — OIDC
| Field          | Type     | Required | Description                       |
| -------------- | -------- | -------- | --------------------------------- |
| `providerType` | `"OIDC"` | Yes      | Must be `"OIDC"`.                 |
| `oidc`         | object   | Yes      | OIDC provider details. See below. |

#### `oidc` object
| Field                   | Type   | Description                                                                                                                      |
| ----------------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------- |
| `issuer`                | string | Issuer URL of the identity provider (must be a valid HTTPS URL).                                                                 |
| `clientId`              | string | Client ID assigned by the IdP.                                                                                                   |
| `clientSecret`          | string | Client secret assigned by the IdP. Send an empty string to leave the existing secret unchanged; must be non-empty on first save. |
| `authorizationEndpoint` | string | Authorization endpoint URL.                                                                                                      |
| `tokenEndpoint`         | string | Token endpoint URL.                                                                                                              |
| `userInfoEndpoint`      | string | UserInfo endpoint URL.                                                                                                           |
| `jwksUri`               | string | JWKS URI for verifying ID tokens.                                                                                                |

***

## Sample request — SAML
```bash
curl -X PUT https://api.statusdashboard.com/app/dashboards/a1b2c3d4-e5f6-7890-abcd-ef1234567890/sso \
  -H "Authorization: Bearer bcf847abf5c6:def456" \
  -H "Content-Type: application/json" \
  -d '{
    "providerType": "SAML",
    "samlMetadataXml": "<?xml version=\"1.0\"?>..."
  }'
```

## Sample request — OIDC
```bash
curl -X PUT https://api.statusdashboard.com/app/dashboards/a1b2c3d4-e5f6-7890-abcd-ef1234567890/sso \
  -H "Authorization: Bearer bcf847abf5c6:def456" \
  -H "Content-Type: application/json" \
  -d '{
    "providerType": "OIDC",
    "oidc": {
      "issuer": "https://dev-12345678.okta.com",
      "clientId": "0oabc123def456ghi789",
      "clientSecret": "your-client-secret",
      "authorizationEndpoint": "https://dev-12345678.okta.com/oauth2/v1/authorize",
      "tokenEndpoint": "https://dev-12345678.okta.com/oauth2/v1/token",
      "userInfoEndpoint": "https://dev-12345678.okta.com/oauth2/v1/userinfo",
      "jwksUri": "https://dev-12345678.okta.com/oauth2/v1/keys"
    }
  }'
```

## Sample response
**Status: `200 OK`**

```json
{
  "enabled": false,
  "providerType": "OIDC",
  "cognitoProviderName": "DASHBOARD-A1B2C3D4"
}
```

The full SSO configuration including SP metadata can be retrieved with [Get SSO config](/docs/api/status-dashboards/dashboards/sso/get).

***

## Error responses
| Status | When                                                                 |
| ------ | -------------------------------------------------------------------- |
| `400`  | Validation error — see `details` in the response body.               |
| `403`  | SSO feature not enabled on the plan.                                 |
| `404`  | Dashboard not found or does not belong to the caller's organization. |