---
title: "Parse Saml Service Provider Metadata"
method: POST
path: "/api/v1/sso/applications/saml/parse-sp-metadata"
tags: ["SSO"]
---

# Parse Saml Service Provider Metadata

`POST /api/v1/sso/applications/saml/parse-sp-metadata`

ParseSAMLServiceProviderMetadata parses one uploaded SAML service-provider
 metadata document and returns the SAML configuration it implies, without
 creating or changing anything. The document is not stored. Use it to
 preview an SP's capabilities before creating a SAML application; edit the
 returned configuration before passing it to Create. Only upload or paste a
 customer-supplied document -- C1 does not fetch metadata URLs.

## Request body

- C1ApiSsoV1SSOApplicationServiceParseSAMLServiceProviderMetadataRequest — SSOApplicationServiceParseSAMLServiceProviderMetadataRequest carries one SAML service-provider metadata document to parse.
  - `metadataXml` string, base64, required — The SP metadata XML document, exactly as downloaded or exported from the service provider. Maximum 1 MiB. The document is parsed, never stored.

## Response `200`

SSOApplicationServiceParseSAMLServiceProviderMetadataResponse returns the
 SAML configuration derived from one metadata document and every finding the
 parser raised about it.

- C1ApiSsoV1SSOApplicationServiceParseSAMLServiceProviderMetadataResponse — SSOApplicationServiceParseSAMLServiceProviderMetadataResponse returns the SAML configuration derived from one metadata document and every finding the parser raised about it.
  - `config` C1ApiSsoV1SSOApplicationSAMLConfig — SSOApplicationSAMLConfig is the SAML-specific sign-in configuration.
    - `acsUrls` string[], nullable, required — The Assertion Consumer Service URLs the assertion may be posted to. Matched exactly; a URL that is not in this list is refused.
    - `attributeMappings` C1ApiSsoV1SAMLAttributeMapping[], nullable — The attributes released in the assertion's AttributeStatement. SAML has no scopes, so this list is the whole release: the NameID carries the identifier and these carry everything else.
      - `friendlyName` string — Optional FriendlyName, for service providers that display it.
      - `name` string, required — The Name attribute, dictated by the service provider.
      - `nameFormat` 'SAML_ATTRIBUTE_NAME_FORMAT_UNSPECIFIED' | 'SAML_ATTRIBUTE_NAME_FORMAT_URI' | 'SAML_ATTRIBUTE_NAME_FORMAT_BASIC' | 'SAML_ATTRIBUTE_NAME_FORMAT_UNSPECIFIED_URN' — The NameFormat attribute.
      - `userAttributeMappingId` string, required — The user attribute mapping that resolves the value, including its fallback chain.
    - `encryptAssertions` boolean — Encrypt the assertion.
    - `encryptionAlgorithm` 'SAML_ENCRYPTION_ALGORITHM_UNSPECIFIED' | 'SAML_ENCRYPTION_ALGORITHM_AES256_GCM' | 'SAML_ENCRYPTION_ALGORITHM_AES128_GCM' | 'SAML_ENCRYPTION_ALGORITHM_AES256_CBC' — The algorithm used when encrypt_assertions is set.
    - `nameIdFormat` 'SAML_NAME_ID_FORMAT_UNSPECIFIED' | 'SAML_NAME_ID_FORMAT_PERSISTENT' | 'SAML_NAME_ID_FORMAT_EMAIL_ADDRESS' | 'SAML_NAME_ID_FORMAT_UNSPECIFIED_URN' | 'SAML_NAME_ID_FORMAT_TRANSIENT' — Set this when the service provider requires a specific NameID format. This also selects the NameID value semantics: EMAIL_ADDRESS uses the user's primary email, TRANSIENT creates a new value for each sign-in, and PERSISTENT uses the application's pairwise subject. Immutable once set.
    - `requireSignedAuthnRequests` boolean — Reject any AuthnRequest that is not signed by one of sp_signing_certificates. At least one signing certificate is required when this is set.
    - `signAssertions` boolean — Sign the assertion. At least one of sign_assertions or sign_responses must be set.
    - `signResponses` boolean — Sign the response envelope. At least one of sign_assertions or sign_responses must be set.
    - `spEncryptionCertificate` string, base64 — The service provider's DER-encoded encryption certificate, taken from the encryption KeyDescriptor in its metadata. Required when encrypt_assertions is set.
    - `spEntityId` string, required — The service provider's entity ID, taken from its metadata. It is the audience every assertion this application issues is restricted to, and it is what the service provider presents at sign-in. Set it at creation: it is fixed for the life of the application, because changing it re-points every assertion already issued. An entity ID already in use by another SSO application in the tenant is rejected.
    - `spSigningCertificates` string[], nullable — The service provider's DER-encoded signing certificates, taken from the signing KeyDescriptors in its metadata.
  - `findings` C1ApiSsoV1SAMLMetadataFinding[], nullable — Everything the parser noticed about the document, including requirements it could not map into the configuration.
    - `component` 'COMPONENT_UNSPECIFIED' | 'COMPONENT_DOCUMENT' | 'COMPONENT_ENTITY_ID' | 'COMPONENT_ACS_URL' | 'COMPONENT_NAME_ID_FORMAT' | 'COMPONENT_SIGNING_CERTIFICATE' | 'COMPONENT_ENCRYPTION_CERTIFICATE' | 'COMPONENT_REQUIREMENT' | 'COMPONENT_BINDING' — Where the finding fits in the parsed document.
    - `level` 'LEVEL_UNSPECIFIED' | 'LEVEL_BLOCKING' | 'LEVEL_WARNING' — The severity of this finding.
    - `reason` string — Plain-language explanation of why the finding was raised.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)