---
title: "Update a SAML configuration"
method: PATCH
path: "/api/v2/saml_configurations/{saml_config_uuid}"
tags: ["Organizations"]
---

# Update a SAML configuration

`PATCH /api/v2/saml_configurations/{saml_config_uuid}`

Update a single SAML configuration for the current organization.

Use this endpoint to enable or disable identity-provider-initiated login, set the
just-in-time provisioning domains, and set the default role assigned to
just-in-time provisioned users. A default role is required to enable just-in-time provisioning.

## Path parameters

- `saml_config_uuid` string, required

## Request body

- SAMLConfigurationUpdateRequest — Request to update a SAML configuration.
  - `data` SAMLConfigurationUpdateData, required — Data for updating a SAML configuration.
    - `attributes` SAMLConfigurationUpdateAttributes — Attributes for updating a SAML configuration.
      - `idp_initiated` boolean — Whether identity-provider-initiated login is enabled for the organization.
      - `jit_domains` string[] — Email domains for which users are automatically provisioned on first SAML login (just-in-time provisioning). A default role is required to enable just-in-time provisioning.
    - `id` string, required — The UUID of the SAML configuration to update. Must match the UUID in the URL path.
    - `relationships` SAMLConfigurationRelationships — Relationships of a SAML configuration.
      - `default_roles` RelationshipToRoles — Relationship to roles.
        - `data` RelationshipToRoleData[] — An array containing type and the unique identifier of a role.
          - `id` string — The unique identifier of the role.
          - `type` 'roles' — Roles type.
    - `type` 'saml_configurations', required — SAML configurations resource type.

## Response `200`

OK

- SAMLConfigurationResponse — Response containing a single SAML configuration.
  - `data` SAMLConfiguration, required — A SAML configuration object.
    - `attributes` SAMLConfigurationAttributes — Attributes of a SAML configuration.
      - `assertion_consumer_service` string[] — The assertion consumer service (ACS) URLs that the identity provider posts SAML responses to.
      - `created_at` string, date-time — Creation time of the SAML configuration.
      - `entity_id` string — The service provider entity ID Datadog presents to the identity provider.
      - `expires_at` string, date-time, nullable — Expiration time of the uploaded identity provider metadata.
      - `idp_initiated` boolean — Whether identity-provider-initiated login is enabled for the organization.
      - `jit_domains` string[] — Email domains for which users are automatically provisioned on first SAML login (just-in-time provisioning).
      - `modified_at` string, date-time — Time of the last SAML configuration modification.
      - `sso_url` string, nullable — The single sign-on URL users can visit to start a SAML login. Returns `null` when the organization is identity-provider-initiated and has no subdomain.
    - `id` string, required — The UUID of the SAML configuration.
    - `relationships` SAMLConfigurationRelationships — Relationships of a SAML configuration.
      - `default_roles` RelationshipToRoles — Relationship to roles.
        - `data` RelationshipToRoleData[] — An array containing type and the unique identifier of a role.
          - `id` string — The unique identifier of the role.
          - `type` 'roles' — Roles type.
    - `type` 'saml_configurations', required — SAML configurations resource type.
  - `included` Role[] — Resources related to the SAML configuration, such as the default roles.
    - `attributes` RoleAttributes — Attributes of the role.
      - `created_at` string, date-time — Creation time of the role.
      - `modified_at` string, date-time — Time of last role modification.
      - `name` string — The name of the role. The name is neither unique nor a stable identifier of the role.
      - `receives_permissions_from` string[] — The managed role from which this role automatically inherits new permissions. Specify one of the following: "Datadog Admin Role", "Datadog Standard Role", or "Datadog Read Only Role". If empty or not specified, the role does not automatically inherit permissions from any managed role.
      - `user_count` integer — Number of users with that role.
    - `id` string — The unique identifier of the role.
    - `relationships` RoleResponseRelationships — Relationships of the role object returned by the API.
      - `permissions` RelationshipToPermissions — Relationship to multiple permissions objects.
        - `data` RelationshipToPermissionData[] — Relationships to permission objects.
          - `id` string — ID of the permission.
          - `type` 'permissions' — Permissions resource type.
    - `type` 'roles', required — Roles type.

## Other responses

- `400` — Bad Request
- `403` — Authentication Error
- `404` — Not Found
- `422` — Unprocessable Entity
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)