---
title: "PATCH /accounts/self/ssoAuthSettings"
method: PATCH
path: "/accounts/self/ssoAuthSettings"
tags: ["SSO"]
---

# PATCH /accounts/self/ssoAuthSettings

`PATCH /accounts/self/ssoAuthSettings`

Updates Single Sign On Authentication Settings with the given values.

## Request body

- union
  - ApiDisabledSsoSettingsUpdate — No Single Sign On enabled and ssoOidcIdpConfigUrls include requested.
    - `type` 'disabled', required
  - ApiGenericOidcSsoSettingsUpdate — Generic OpenID Connect SSO config.
    - `type` 'oidc', required
    - `spInitiatedSsoLogin` boolean — If this field is set to true, it means that all the non admin users under this account will use this SSO settings to authenticate when performing Service provider initiated login. A Service provider initiated login means that an unauthenticated user tries to directly login to an application like the VMS webapp and the application redirects them to their configured Identity provider to authenticate themselves. This is the opposite of an Idp initiated login where the user directly logs in to their identity provider, which then shows them a catalog of applications they have access to.
    - `config` object, required
      - `credentials` ApiIDPCredentials, required
        - `clientId` string, required
        - `clientSecret` string, required
      - `endpoints` ApiIDPEndpoints, required
        - `authorization` string, url, required — Authorization URL of the IDP
        - `token` string, url, required — Token URL of the IDP
        - `userInfo` string, url, required — User info URL of the IDP
        - `jwks` string, url, required — JWKs URL of the IDP
      - `issuer` ApiIDPIssuer, required
        - `url` string, url, required — Issuer URL of the IDP
    - `scim` Scim
      - `autoUserProvisioningEnabled` boolean — If this option is enabled, it means that if the user does not exist in the VMS, the system will automatically provision them, eliminating the need for any manual intervention.
  - ApiGoogleOidcSsoSettingsUpdate — Google OpenID Connect SSO config.
    - `type` 'google', required
    - `spInitiatedSsoLogin` boolean — If this field is set to true, it means that all the non admin users under this account will use this SSO settings to authenticate when performing Service provider initiated login. A Service provider initiated login means that an unauthenticated user tries to directly login to an application like the VMS webapp and the application redirects them to their configured Identity provider to authenticate themselves. This is the opposite of an Idp initiated login where the user directly logs in to their identity provider, which then shows them a catalog of applications they have access to.
  - ApiOktaOidcSsoSettingsUpdate — Okta OpenID Connect SSO config.
    - `type` 'okta', required
    - `spInitiatedSsoLogin` boolean — If this field is set to true, it means that all the non admin users under this account will use this SSO settings to authenticate when performing Service provider initiated login. A Service provider initiated login means that an unauthenticated user tries to directly login to an application like the VMS webapp and the application redirects them to their configured Identity provider to authenticate themselves. This is the opposite of an Idp initiated login where the user directly logs in to their identity provider, which then shows them a catalog of applications they have access to.
    - `config` object, required
      - `credentials` ApiIDPCredentials, required
        - `clientId` string, required
        - `clientSecret` string, required
      - `issuer` ApiIDPIssuer, required
        - `url` string, url, required — Issuer URL of the IDP
    - `scim` Scim
      - `autoUserProvisioningEnabled` boolean — If this option is enabled, it means that if the user does not exist in the VMS, the system will automatically provision them, eliminating the need for any manual intervention.
  - ApiMicrosoftGlobalOidcSsoSettingsUpdate — If the "Microsoft Global" OIDC SSO type is configured, users with personal Microsoft accounts and users under any active directory can use it to login to the system. Guest users of an active directory can't use this configuration to login. As it is impossible to authoritatively decide which account an unknown user belongs to, Auto User Provisioning is not possible.
    - `type` 'microsoftGlobal', required
    - `spInitiatedSsoLogin` boolean — If this field is set to true, it means that all the non admin users under this account will use this SSO settings to authenticate when performing Service provider initiated login. A Service provider initiated login means that an unauthenticated user tries to directly login to an application like the VMS webapp and the application redirects them to their configured Identity provider to authenticate themselves. This is the opposite of an Idp initiated login where the user directly logs in to their identity provider, which then shows them a catalog of applications they have access to.
  - ApiMicrosoftActiveDirectoryOidcSsoSettingsUpdate — With the "Microsoft Active Directory" OIDC SSO type, a specific active directory is configured as identity provider for the account. The specific directory is identified by the required tenantId. Any user and guest under this specific active directory can use this configuration to login. "Microsoft Accounts", also known as "Personal accounts" can only be used to identify as a user if that account has been invited as a guest account in the Active Directory. Auto User Provisioning can be enabled for this configuration.
    - `type` 'microsoftActiveDirectory', required
    - `spInitiatedSsoLogin` boolean — If this field is set to true, it means that all the non admin users under this account will use this SSO settings to authenticate when performing Service provider initiated login. A Service provider initiated login means that an unauthenticated user tries to directly login to an application like the VMS webapp and the application redirects them to their configured Identity provider to authenticate themselves. This is the opposite of an Idp initiated login where the user directly logs in to their identity provider, which then shows them a catalog of applications they have access to.
    - `config` object, required
      - `credentials` ApiIDPCredentials, required
        - `clientId` string, required
        - `clientSecret` string, required
      - `tenantId` string, required — Tenant id of the IDP
    - `scim` Scim
      - `autoUserProvisioningEnabled` boolean — If this option is enabled, it means that if the user does not exist in the VMS, the system will automatically provision them, eliminating the need for any manual intervention.
  - ApiBrivoSsoSettingsUpdate — Brivo Security Suite (BSS) SSO config. Only available for BSS clients. Only the "Brivo Management User" Service Account (BMU) can update this setting.
    - `type` 'bss', required
    - `environment` 'production' | 'qa' | 'development', required — Environment of the Brivo Security Suite.

## Response `204`

IDP Updated

## Other responses

- `400` — The supplied object is invalid. Error detail will contain the validation error.
- `401` — You are not authenticated. Please authenticate and try again.
- `403` — You have no permission to access the specified resource.
- `404` — Referenced resource could not be found.
- `500` — Something went wrong in the server. Please try again.

---

[API](https://skmtc.net/eagleeyenetworks/apis/devices.md) · [All operations](https://skmtc.net/eagleeyenetworks/apis/devices/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/eagleeyenetworks/devices/revisions/df57313de545/schema)