---
title: "Create SAML application"
method: POST
path: "/api/saml-applications"
tags: ["SAML applications"]
---

# Create SAML application

`POST /api/saml-applications`

Create a new SAML application with the given configuration. A default signing certificate with 3 years lifetime will be automatically created.

## Request body

- object
  - `name` string, required — The name of the SAML application.
  - `description` string, nullable — Optional description of the SAML application.
  - `customData` object — Optional custom data for the application.
  - `attributeMapping` object
    - `sub` string
    - `name` string
    - `given_name` string
    - `family_name` string
    - `middle_name` string
    - `nickname` string
    - `preferred_username` string
    - `profile` string
    - `picture` string
    - `website` string
    - `email` string
    - `email_verified` string
    - `gender` string
    - `birthdate` string
    - `zoneinfo` string
    - `locale` string
    - `phone_number` string
    - `phone_number_verified` string
    - `address` string
    - `updated_at` string
    - `username` string
    - `created_at` string
    - `custom_data` string
    - `identities` string
    - `sso_identities` string
    - `roles` string
    - `organizations` string
    - `organization_data` string
    - `organization_roles` string
  - `entityId` string, nullable
  - `acsUrl` string, nullable — The Assertion Consumer Service (ACS) URL where the SAML response will be sent.
  - `encryption` object, nullable — Validator function
  - `nameIdFormat` 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified', required

## Response `201`

The SAML application was created successfully.

- object
  - `tenantId` string, required
  - `id` string, required
  - `name` string, required
  - `description` string, nullable, required
  - `type` 'Native' | 'SPA' | 'Traditional' | 'MachineToMachine' | 'Protected' | 'SAML', required
  - `customData` object, required — arbitrary
  - `isThirdParty` boolean, required
  - `appLevelAccessControlEnabled` boolean, required
  - `createdAt` number, required
  - `attributeMapping` object, required
    - `sub` string
    - `name` string
    - `given_name` string
    - `family_name` string
    - `middle_name` string
    - `nickname` string
    - `preferred_username` string
    - `profile` string
    - `picture` string
    - `website` string
    - `email` string
    - `email_verified` string
    - `gender` string
    - `birthdate` string
    - `zoneinfo` string
    - `locale` string
    - `phone_number` string
    - `phone_number_verified` string
    - `address` string
    - `updated_at` string
    - `username` string
    - `created_at` string
    - `custom_data` string
    - `identities` string
    - `sso_identities` string
    - `roles` string
    - `organizations` string
    - `organization_data` string
    - `organization_roles` string
  - `entityId` string, nullable, required
  - `acsUrl` object, nullable, required
    - `binding` 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' | 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect', required
    - `url` string, url, required
  - `encryption` object, nullable, required — Validator function
  - `nameIdFormat` 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified', required

## Other responses

- `400` — Invalid request body.
- `401` — Unauthorized
- `403` — Forbidden
- `422` — Validation error. The ACS URL is invalid or other validation errors.

---

[API](https://skmtc.net/logto/apis/logto-api-references.md) · [All operations](https://skmtc.net/logto/apis/logto-api-references/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/logto/logto-api-references/revisions/a163dc77d842/schema)