---
title: "POST /v1/inboundSamlSsoProfiles"
method: POST
path: "/v1/inboundSamlSsoProfiles"
tags: ["inboundSamlSsoProfiles"]
---

# POST /v1/inboundSamlSsoProfiles

`POST /v1/inboundSamlSsoProfiles`

Creates an InboundSamlSsoProfile for a customer. When the target customer has enabled [Multi-party approval for sensitive actions](https://support.google.com/a/answer/13790448), the `Operation` in the response will have `"done": false`, it will not have a response, and the metadata will have `"state": "awaiting-multi-party-approval"`.

## Request body

- InboundSamlSsoProfile — A [SAML 2.0](https://www.oasis-open.org/standards#samlv2.0) federation between a Google enterprise customer and a SAML identity provider.
  - `customer` string — Immutable. The customer. For example: `customers/C0123abc`.
  - `idpConfig` SamlIdpConfig — SAML IDP (identity provider) configuration.
    - `logoutRedirectUri` string — The **Logout Redirect URL** (sign-out page URL) of the identity provider. When a user clicks the sign-out link on a Google page, they will be redirected to this URL. This is a pure redirect with no attached SAML `LogoutRequest` i.e. SAML single logout is not supported. Must use `HTTPS`.
    - `singleSignOnServiceUri` string — Required. The `SingleSignOnService` endpoint location (sign-in page URL) of the identity provider. This is the URL where the `AuthnRequest` will be sent. Must use `HTTPS`. Assumed to accept the `HTTP-Redirect` binding.
    - `changePasswordUri` string — The **Change Password URL** of the identity provider. Users will be sent to this URL when changing their passwords at `myaccount.google.com`. This takes precedence over the change password URL configured at customer-level. Must use `HTTPS`.
    - `entityId` string — Required. The SAML **Entity ID** of the identity provider.
  - `spConfig` SamlSpConfig — SAML SP (service provider) configuration.
    - `entityId` string — Output only. The SAML **Entity ID** for this service provider.
    - `assertionConsumerServiceUri` string — Output only. The SAML **Assertion Consumer Service (ACS) URL** to be used for the IDP-initiated login. Assumed to accept response messages via the `HTTP-POST` binding.
  - `displayName` string — Human-readable name of the SAML SSO profile.
  - `name` string — Output only. [Resource name](https://cloud.google.com/apis/design/resource_names) of the SAML SSO profile.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/cloudidentity.md) · [All operations](https://skmtc.net/google/apis/cloudidentity/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/cloudidentity/revisions/179b4eeed5a2/schema)