---
title: "POST /api/v1/ldap/config"
method: POST
path: "/api/v1/ldap/config"
tags: ["LDAP SSO"]
---

# POST /api/v1/ldap/config

`POST /api/v1/ldap/config`

Create LDAP config

## Request body

- object
  - `organizationId` string, required — The ID of the organization to create the LDAP config for.
  - `isActive` boolean, required — Whether to enable or disable this LDAP configuration.
  - `url` string, required — The LDAP server to connect to such as `ldap://ldap.your-org.com`, `ldaps://ldap.myorg.com:636` (for connection over SSL/TLS), etc.
  - `bindDN` string, required — The distinguished name of the object to bind when performing the user search such as `cn=infisical,ou=Users,dc=acme,dc=com`
  - `bindPass` string, required — The password to use along with Bind DN when performing the user search.
  - `uniqueUserAttribute` string — The attribute to use as the unique identifier of LDAP users such as `sAMAccountName`, `cn`, `uid`, `objectGUID`. If left blank, defaults to uidNumber
  - `searchBase` string, required — The base DN to use for the user search such as `ou=Users,dc=acme,dc=com`
  - `searchFilter` string — The template used to construct the LDAP user search filter such as `(uid={{username}})` uses literal `{{username}}` to have the given username used in the search. The default is `(uid={{username}})` which is compatible with several common directory schemas.
  - `groupSearchBase` string, required — LDAP search base to use for group membership search such as `ou=Groups,dc=acme,dc=com`
  - `groupSearchFilter` string — The template used when constructing the group membership query such as `(&(objectClass=posixGroup)(memberUid={{.Username}}))`. The template can access the following context variables: `[UserDN, UserName]`. The default is `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))` which is compatible with several common directory schemas.
  - `caCert` string — The CA certificate to use when verifying the LDAP server certificate.
  - `clientCertificate` string — PEM-encoded client certificate presented during the TLS handshake for mutual TLS (mTLS). Must be provided together with clientKeyCertificate.
  - `clientKeyCertificate` string — PEM-encoded private key matching the client certificate, used during the TLS handshake for mutual TLS (mTLS). Must be provided together with clientCertificate.

## Response `200`

Default Response

- object
  - `updatedAt` string, date-time, required
  - `createdAt` string, date-time, required
  - `isActive` boolean, required
  - `orgId` string, uuid, required
  - `id` string, uuid, required
  - `url` string, required
  - `searchBase` string, required
  - `searchFilter` string
  - `groupSearchBase` string
  - `uniqueUserAttribute` string
  - `groupSearchFilter` string

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/885aef3e6c11/schema)