---
title: "Update a SAML Connection"
method: PATCH
path: "/saml_connections/{saml_connection_id}"
tags: ["SAML Connections"]
deprecated: true
---

# Update a SAML Connection

`PATCH /saml_connections/{saml_connection_id}`

> **Deprecated.**

Updates the SAML Connection whose ID matches the provided `id` in the path.
Deprecated: Use the Enterprise Connections API instead. This endpoint will be removed in future versions.

## Path parameters

- `saml_connection_id` string, required

## Request body

- object
  - `name` string, nullable — The name of the new SAML Connection
  - `domain` string, nullable — The domain to use for the new SAML Connection
  - `domains` string[], nullable — A list of the domains on use for the SAML connection
  - `idp_entity_id` string, nullable — The Entity ID as provided by the IdP
  - `idp_sso_url` string, nullable — The SSO URL as provided by the IdP
  - `idp_certificate` string, nullable — The x509 certificated as provided by the IdP
  - `idp_metadata_url` string, nullable — The URL which serves the IdP metadata. If present, it takes priority over the corresponding individual properties and replaces them
  - `idp_metadata` string, nullable — The XML content of the IdP metadata file. If present, it takes priority over the corresponding individual properties
  - `organization_id` string, nullable — The ID of the organization to which users of this SAML Connection will be added
  - `attribute_mapping` object, nullable — Define the attribute name mapping between Identity Provider and Clerk's user properties
    - `user_id` string
    - `email_address` string
    - `first_name` string
    - `last_name` string
  - `active` boolean, nullable — Activate or de-activate the SAML Connection
  - `sync_user_attributes` boolean, nullable — Controls whether to update the user's attributes in each sign-in
  - `allow_subdomains` boolean, nullable — Allow users with an email address subdomain to use this connection in order to authenticate
  - `allow_idp_initiated` boolean, nullable — Enable or deactivate IdP-initiated flows
  - `disable_additional_identifications` boolean, nullable — Enable or deactivate additional identifications
  - `allow_organization_account_linking` boolean, nullable — Whether this connection supports account linking via organization membership
  - `force_authn` boolean — Enable or deactivate ForceAuthn
  - `login_hint` object, nullable — Configuration for the login_hint sent to the IdP on SSO sign-in
    - `mode` 'email_address' | 'custom_attribute' | 'off', required — Controls the login_hint sent to the IdP on SSO sign-in
    - `source` string — The user public_metadata key whose value is sent as the login_hint when mode is custom_attribute
  - `consent_verified_domains_deletion` boolean, nullable — When enabling the connection, controls behavior when verified domains used for enrollment modes like automatic invitation or automatic suggestion already exist for the same domain. If true, those verified domains are removed and the connection is enabled. If false or omitted, the request fails when any such verified domain exists.

## Response `200`

A SAML Connection

- union
  - object
    - `object` 'saml_connection', required
    - `id` string, required
    - `name` string, required
    - `domain` string, required
    - `domains` string[]
    - `idp_entity_id` string, nullable, required
    - `idp_sso_url` string, nullable, required
    - `idp_certificate` string, nullable, required
    - `idp_certificate_issued_at` integer, nullable, required — Unix timestamp (milliseconds) of the start of the IdP certificate validity window (X.509 NotBefore). Null when no certificate is configured.
    - `idp_certificate_expires_at` integer, nullable, required — Unix timestamp (milliseconds) of the end of the IdP certificate validity window (X.509 NotAfter). Null when no certificate is configured.
    - `idp_metadata_url` string, nullable
    - `idp_metadata` string, nullable
    - `acs_url` string, required
    - `sp_entity_id` string, required
    - `sp_metadata_url` string, required
    - `organization_id` string, nullable
    - `attribute_mapping` SAMLConnectionAttributeMapping
      - `user_id` string, required
      - `email_address` string, required
      - `first_name` string, required
      - `last_name` string, required
    - `active` boolean, required
    - `provider` string, required
    - `user_count` integer, required
    - `sync_user_attributes` boolean, required
    - `allow_subdomains` boolean, required
    - `allow_idp_initiated` boolean, required
    - `disable_additional_identifications` boolean, required
    - `allow_organization_account_linking` boolean, required
    - `force_authn` boolean, required — Enable or deactivate ForceAuthn
    - `login_hint` SAMLConnectionLoginHint, required — Configuration for the login_hint sent to the IdP on SSO sign-in
      - `mode` 'email_address' | 'custom_attribute' | 'off', required — Controls the login_hint sent to the IdP on SSO sign-in
      - `source` string — The user public_metadata key whose value is sent as the login_hint when mode is custom_attribute
    - `enterprise_connection_id` string, nullable
    - `created_at` integer, required — Unix timestamp of creation.
    - `updated_at` integer, required — Unix timestamp of last update.
  - object
    - `object` 'saml_connection', required
    - `id` string, required
    - `name` string, required
    - `domain` string
    - `domains` string[], required
    - `idp_entity_id` string, nullable, required
    - `idp_sso_url` string, nullable, required
    - `idp_certificate` string, nullable, required
    - `idp_certificate_issued_at` integer, nullable, required — Unix timestamp (milliseconds) of the start of the IdP certificate validity window (X.509 NotBefore). Null when no certificate is configured.
    - `idp_certificate_expires_at` integer, nullable, required — Unix timestamp (milliseconds) of the end of the IdP certificate validity window (X.509 NotAfter). Null when no certificate is configured.
    - `idp_metadata_url` string, nullable
    - `idp_metadata` string, nullable
    - `acs_url` string, required
    - `sp_entity_id` string, required
    - `sp_metadata_url` string, required
    - `organization_id` string, nullable
    - `attribute_mapping` SAMLConnectionAttributeMapping
      - `user_id` string, required
      - `email_address` string, required
      - `first_name` string, required
      - `last_name` string, required
    - `active` boolean, required
    - `provider` string, required
    - `user_count` integer, required
    - `sync_user_attributes` boolean, required
    - `allow_subdomains` boolean, required
    - `allow_idp_initiated` boolean, required
    - `disable_additional_identifications` boolean, required
    - `allow_organization_account_linking` boolean, required
    - `force_authn` boolean, required — Enable or deactivate ForceAuthn
    - `login_hint` SAMLConnectionLoginHint, required — Configuration for the login_hint sent to the IdP on SSO sign-in
      - `mode` 'email_address' | 'custom_attribute' | 'off', required — Controls the login_hint sent to the IdP on SSO sign-in
      - `source` string — The user public_metadata key whose value is sent as the login_hint when mode is custom_attribute
    - `enterprise_connection_id` string, nullable
    - `created_at` integer, required — Unix timestamp of creation.
    - `updated_at` integer, required — Unix timestamp of last update.

## Other responses

- `402` — Payment required
- `403` — Authorization invalid
- `404` — Resource not found
- `409` — Request was not successful
- `422` — Invalid request parameters

---

[API](https://skmtc.net/clerk/apis/clerk-backend-api.md) · [All operations](https://skmtc.net/clerk/apis/clerk-backend-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/clerk/clerk-backend-api/versions/cf036e7951d3/schema)