---
title: "Update"
method: POST
path: "/api/v1/settings/sso"
tags: ["SSO"]
---

# Update

`POST /api/v1/settings/sso`

Update changes the tenant's SSO provider settings. Supply the settings
 object and an update mask listing the fields to change; only masked fields
 are applied. Editable paths: enabled, default_subject_type,
 default_assertion_lifetime, default_id_token_signed_response_alg.

## Request body

- C1ApiSsoV1SSOSettingsServiceUpdateRequest — SSOSettingsServiceUpdateRequest updates the tenant's SSO provider settings.
  - `settings` C1ApiSsoV1SSOSettings, required — SSOSettings is the per-tenant configuration for ConductorOne acting as an SSO provider.
    - `createdAt` string, date-time, nullable
    - `defaultAssertionLifetime` string, duration, nullable
    - `defaultIdTokenSignedResponseAlg` 'OIDC_SIGNING_ALGORITHM_UNSPECIFIED' | 'OIDC_SIGNING_ALGORITHM_EDDSA' | 'OIDC_SIGNING_ALGORITHM_ES256' | 'OIDC_SIGNING_ALGORITHM_RS256' — The id_token signing algorithm applied to OIDC applications that do not choose one. When unset, the server uses EdDSA.
    - `defaultSubjectType` 'SSO_SUBJECT_TYPE_UNSPECIFIED' | 'SSO_SUBJECT_TYPE_PAIRWISE' | 'SSO_SUBJECT_TYPE_PUBLIC' | 'SSO_SUBJECT_TYPE_COMPATIBILITY' — The subject type materialized onto new SSO applications that do not choose one. Changing this default does not change existing applications. When unset, the server uses pairwise subjects.
    - `enabled` boolean — Master switch for the SSO provider. ConductorOne also gates the feature behind an operator-controlled rollout flag; this is the tenant administrator's intent. Individual SSO applications can still be disabled one at a time.
    - `updatedAt` string, date-time, nullable
  - `updateMask` string, nullable, required

## Response `200`

SSOSettingsServiceUpdateResponse returns the updated settings.

- C1ApiSsoV1SSOSettingsServiceUpdateResponse — SSOSettingsServiceUpdateResponse returns the updated settings.
  - `settings` C1ApiSsoV1SSOSettings — SSOSettings is the per-tenant configuration for ConductorOne acting as an SSO provider.
    - `createdAt` string, date-time, nullable
    - `defaultAssertionLifetime` string, duration, nullable
    - `defaultIdTokenSignedResponseAlg` 'OIDC_SIGNING_ALGORITHM_UNSPECIFIED' | 'OIDC_SIGNING_ALGORITHM_EDDSA' | 'OIDC_SIGNING_ALGORITHM_ES256' | 'OIDC_SIGNING_ALGORITHM_RS256' — The id_token signing algorithm applied to OIDC applications that do not choose one. When unset, the server uses EdDSA.
    - `defaultSubjectType` 'SSO_SUBJECT_TYPE_UNSPECIFIED' | 'SSO_SUBJECT_TYPE_PAIRWISE' | 'SSO_SUBJECT_TYPE_PUBLIC' | 'SSO_SUBJECT_TYPE_COMPATIBILITY' — The subject type materialized onto new SSO applications that do not choose one. Changing this default does not change existing applications. When unset, the server uses pairwise subjects.
    - `enabled` boolean — Master switch for the SSO provider. ConductorOne also gates the feature behind an operator-controlled rollout flag; this is the tenant administrator's intent. Individual SSO applications can still be disabled one at a time.
    - `updatedAt` string, date-time, nullable

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)