---
title: "Creates a SAML 2.0 Provider with specified Tenant Id"
method: POST
path: "/tenants/{tenant_id}/saml/providers"
tags: ["tenants"]
---

# Creates a SAML 2.0 Provider with specified Tenant Id

`POST /tenants/{tenant_id}/saml/providers`

You need `tenants.tenant.edit` permission to access this resource

## Path parameters

- `tenant_id` string, required

## Request body

- object
  - `data` object, required
    - `id` string, required
    - `type` 'saml-provider', required
    - `attributes` object, required
      - `entity_id` string, required — Provider entityId. A value should be a valid URI
      - `login_endpoint` string, required — Provider login endpoint. A value should be a valid URI
      - `logout_endpoint` string, required — Provider logout endpoint. A value should be a valid URI
      - `assert_endpoint` string, required — URL of service provider assert endpoint. A value should be a valid URI
      - `idp_certificates` string[], required — An array of Identity Provider certificates
      - `name_id_format` 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'undefined', required — Format for Name ID
      - `private_key` string, required — Private key for the service provider
      - `certificate` string, required — Certificate for the service provider
      - `force_auth` boolean, required — Forces re-authentication of users even if the user has a SSO session with the Identity Provider
      - `allow_unencrypted_assertion` boolean, required — Allows unencrypted assertions
      - `config` object, required
        - `hide_auth_page` boolean — Hides default login page
        - `email_attribute` string, required — Name of the attribute that contains a user email address
        - `auto_create_users` boolean, required — Creates user if not registered
    - `relationships` object, required
      - `tenant` object, required
        - `data` object, required
          - `id` string, required
          - `type` 'tenant', required
      - `links` object, required
        - `self` string, required

## Response `201`

Created

- object
  - `data` object, required
    - `id` string, required
    - `type` 'saml-provider', required
    - `attributes` object, required
      - `entity_id` string, required — Provider entityId. A value should be a valid URI
      - `login_endpoint` string, required — Provider login endpoint. A value should be a valid URI
      - `logout_endpoint` string, required — Provider logout endpoint. A value should be a valid URI
      - `assert_endpoint` string, required — URL of service provider assert endpoint. A value should be a valid URI
      - `idp_certificates` string[], required — An array of Identity Provider certificates
      - `name_id_format` 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'undefined', required — Format for Name ID
      - `private_key` string, required — Private key for the service provider
      - `certificate` string, required — Certificate for the service provider
      - `force_auth` boolean, required — Forces re-authentication of users even if the user has a SSO session with the Identity Provider
      - `allow_unencrypted_assertion` boolean, required — Allows unencrypted assertions
      - `config` object, required
        - `hide_auth_page` boolean — Hides default login page
        - `email_attribute` string, required — Name of the attribute that contains a user email address
        - `auto_create_users` boolean, required — Creates user if not registered
    - `relationships` object, required
      - `tenant` object, required
        - `data` object, required
          - `id` string, required
          - `type` 'tenant', required
      - `links` object, required
        - `self` string, required

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found

---

[API](https://skmtc.net/elastic/apis/elastic-io-rest-api-documentation-v2.md) · [All operations](https://skmtc.net/elastic/apis/elastic-io-rest-api-documentation-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/elastic-io-rest-api-documentation-v2/revisions/411f9f98c01e/schema)