---
title: "Update Sso Settings"
method: PATCH
path: "/update/sso_settings"
tags: ["SSO Settings"]
---

# Update Sso Settings

`PATCH /update/sso_settings`

Update SSO configuration by saving to the dedicated SSO table.

## Request body

- SSOConfig — Configuration for SSO environment variables and settings
  - `google_client_id` string, nullable — Google OAuth Client ID for SSO authentication
  - `google_client_secret` string, nullable — Google OAuth Client Secret for SSO authentication
  - `microsoft_client_id` string, nullable — Microsoft OAuth Client ID for SSO authentication
  - `microsoft_client_secret` string, nullable — Microsoft OAuth Client Secret for SSO authentication
  - `microsoft_tenant` string, nullable — Microsoft Azure Tenant ID for SSO authentication
  - `generic_client_id` string, nullable — Generic OAuth Client ID for SSO authentication (used for Okta and other providers)
  - `generic_client_secret` string, nullable — Generic OAuth Client Secret for SSO authentication
  - `generic_authorization_endpoint` string, nullable — Authorization endpoint URL for generic OAuth provider
  - `generic_token_endpoint` string, nullable — Token endpoint URL for generic OAuth provider
  - `generic_userinfo_endpoint` string, nullable — User info endpoint URL for generic OAuth provider
  - `proxy_base_url` string, nullable — Base URL of the proxy server for SSO redirects
  - `user_email` string, nullable — Email of the proxy admin user
  - `ui_access_mode` union — Access mode for the UI
    - AccessControlUIAccessMode — Model for Controlling UI Access Mode via SSO Groups
      - `type` 'restricted_sso_group', required
      - `restricted_sso_group` string, required
      - `sso_group_jwt_field` string, required
    - string
  - `role_mappings` RoleMappings — Configuration for mapping SSO groups to LiteLLM roles. The system will look at the group_claim field in the SSO token to determine which role to assign the user based on the roles mapping.
    - `provider` string, required — SSO Provider name (e.g., 'google', 'microsoft', 'generic')
    - `group_claim` string, required — The field name in the SSO token that contains the groups array (e.g., 'groups', 'roles')
    - `default_role` 'proxy_admin' | 'proxy_admin_viewer' | 'org_admin' | 'internal_user' | 'internal_user_viewer' | 'team' | 'customer' — Admin Roles: PROXY_ADMIN: admin over the platform PROXY_ADMIN_VIEW_ONLY: can login, view all own keys, view all spend ORG_ADMIN: admin over a specific organization, can create teams, users only within their organization Internal User Roles: INTERNAL_USER: can login, view/create/delete their own keys, view their spend INTERNAL_USER_VIEW_ONLY: can login, view their own keys, view their own spend Team Roles: TEAM: used for JWT auth Customer Roles: CUSTOMER: External users -> these are customers
    - `roles` object — Mapping of LiteLLM role names to arrays of SSO group names. Example: {'proxy_admin': ['group-1', 'group-2'], 'proxy_admin_viewer': ['group-3']}
  - `team_mappings` TeamMappings — Configuration for mapping SSO JWT fields to team IDs. This allows configuring team_ids_jwt_field via the database instead of requiring config file changes and restarts.
    - `team_ids_jwt_field` string, nullable — The field name in the SSO/JWT token that contains the team IDs array (e.g., 'groups', 'teams'). Supports dot notation for nested fields.

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/flock/apis/litellm-api.md) · [All operations](https://skmtc.net/flock/apis/litellm-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/flock/litellm-api/revisions/8fbaab4fc7c5/schema)