---
title: "Patch Sso"
method: PATCH
path: "/admin/api/v1/sso"
tags: ["Auth & SSO"]
---

# Patch Sso

`PATCH /admin/api/v1/sso`

## Request body

- StandaloneSsoPatch — Body for PATCH /admin/api/v1/sso. All fields optional.
  - `sso` SSOConfig — OIDC Single Sign-On configuration. When enabled, the engine validates JWT tokens on protected routes (``/agent/invoke``, ``/agent/stream``, ``/agent/copilotkit/stream``) against the configured OIDC provider's JWKS endpoint, discovered via ``{issuer}/.well-known/openid-configuration``.
    - `enabled` boolean — Toggle SSO enforcement on protected routes.
    - `issuer` string, required — OIDC issuer URL (e.g. https://accounts.google.com). Used to discover the JWKS endpoint via .well-known/openid-configuration.
    - `clientId` string, required — OAuth 2.0 client ID. Used as the default audience for JWT validation when 'audience' is not set.
    - `audience` string, nullable — Expected JWT 'aud' claim. Defaults to client_id if not set. Okta client credentials tokens use 'api://default'.
    - `allowedDomains` string[], nullable — Optional list of allowed email domains (e.g. ['company.com']). When set, only tokens whose email claim matches one of these domains are accepted.
    - `allowedEmails` string[], nullable — Optional list of specific email addresses allowed access. When set, only tokens whose email claim exactly matches one of these values are accepted.

## Response `200`

Successful Response

- StandaloneMutationResponseStandaloneSsoRead
  - `data` StandaloneSsoRead, required — GET response and the data payload of PATCH responses.
    - `sso` SSOConfig, required — OIDC Single Sign-On configuration. When enabled, the engine validates JWT tokens on protected routes (``/agent/invoke``, ``/agent/stream``, ``/agent/copilotkit/stream``) against the configured OIDC provider's JWKS endpoint, discovered via ``{issuer}/.well-known/openid-configuration``.
      - `enabled` boolean — Toggle SSO enforcement on protected routes.
      - `issuer` string, required — OIDC issuer URL (e.g. https://accounts.google.com). Used to discover the JWKS endpoint via .well-known/openid-configuration.
      - `clientId` string, required — OAuth 2.0 client ID. Used as the default audience for JWT validation when 'audience' is not set.
      - `audience` string, nullable — Expected JWT 'aud' claim. Defaults to client_id if not set. Okta client credentials tokens use 'api://default'.
      - `allowedDomains` string[], nullable — Optional list of allowed email domains (e.g. ['company.com']). When set, only tokens whose email claim matches one of these domains are accepted.
      - `allowedEmails` string[], nullable — Optional list of specific email addresses allowed access. When set, only tokens whose email claim exactly matches one of these values are accepted.
    - `updatedAt` string, date-time, required
  - `reload` StandaloneReloadResult, required — Reload outcome attached to every admin mutation response. ``reloaded`` means DB committed and runtime now uses the new config. ``restart_required`` means DB committed and process restart is needed. ``reload_failed`` means DB rolled back and runtime is unchanged.
    - `status` 'reloaded' | 'restart_required' | 'reload_failed', required — Outcome of a reload triggered by an admin mutation.
    - `message` string, required
    - `error` string, nullable

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/idun-group/apis/idun-agent-engine-server.md) · [All operations](https://skmtc.net/idun-group/apis/idun-agent-engine-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/idun-group/idun-agent-engine-server/versions/8909cd73cc1c/schema)