---
title: "PATCH /api/v1/sso/oidc/config"
method: PATCH
path: "/api/v1/sso/oidc/config"
tags: ["OIDC SSO"]
---

# PATCH /api/v1/sso/oidc/config

`PATCH /api/v1/sso/oidc/config`

Update OIDC config

## Request body

- object
  - `allowedEmailDomains` string — A list of allowed email domains that users can use to authenticate with. This field is comma separated. Supports wildcards (e.g. *.example.com). Example: 'example.com, *.acme.com'
  - `discoveryURL` string — The URL of the OIDC discovery endpoint.
  - `configurationType` 'custom' | 'discoveryURL' — The configuration type to use for the OIDC configuration.
  - `issuer` string — The issuer for the OIDC configuration. This is only supported when the OIDC configuration type is set to 'custom'.
  - `authorizationEndpoint` string — The endpoint to use for OIDC authorization. This is only supported when the OIDC configuration type is set to 'custom'.
  - `jwksUri` string — The URL of the OIDC JWKS endpoint.
  - `tokenEndpoint` string — The token endpoint to use for OIDC token exchange.
  - `userinfoEndpoint` string — The userinfo endpoint to get user information from the OIDC provider.
  - `clientId` string — The client ID to use for OIDC authentication.
  - `clientSecret` string — The client secret to use for OIDC authentication.
  - `isActive` boolean — Whether to enable or disable this OIDC configuration.
  - `manageGroupMemberships` boolean — Whether to manage group memberships for the OIDC configuration. If enabled, users will automatically be assigned groups when they sign in, based on which groups they are a member of in the OIDC provider.
  - `jwtSignatureAlgorithm` 'RS256' | 'HS256' | 'RS512' | 'EdDSA' — The algorithm to use for JWT signature verification.
  - `organizationId` string, required — The ID of the organization to update the OIDC config for.

## Response `200`

Default Response

- object
  - `id` string, uuid, required
  - `issuer` string, nullable
  - `authorizationEndpoint` string, nullable
  - `configurationType` string, required
  - `discoveryURL` string, nullable
  - `jwksUri` string, nullable
  - `tokenEndpoint` string, nullable
  - `userinfoEndpoint` string, nullable
  - `orgId` string, uuid, required
  - `allowedEmailDomains` string, nullable
  - `isActive` boolean, required
  - `manageGroupMemberships` boolean

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/885aef3e6c11/schema)