---
title: "Update SSO connection"
method: PATCH
path: "/auth/sso/connections/{connectionId}"
tags: ["SSO Connections"]
---

# Update SSO connection

`PATCH /auth/sso/connections/{connectionId}`

Update the status or metadata of an existing SSO identity provider connection.

## Path parameters

- `connectionId` string, uuid, required

## Headers

- `x-idempotency-key` string, uuid, required
- `Content-Type` string, required

## Request body

- union — Fields that can be updated for an existing SSO identity provider connection.
  - object — Patch only the lifecycle status of the connection.
    - `status` 'enabled' | 'disabled', required — Lifecycle status of the connection.
    - `metadata` object — Provider-specific metadata required to refresh connection configuration.
      - `saml` object, required — SAML-specific metadata for the identity provider connection.
        - `samlMetadataURL` string, uri, required — HTTPS URL referencing the SAML metadata document.
  - object — Patch only the provider-specific metadata.
    - `status` 'enabled' | 'disabled' — Lifecycle status of the connection.
    - `metadata` object, required — Provider-specific metadata required to refresh connection configuration.
      - `saml` object, required — SAML-specific metadata for the identity provider connection.
        - `samlMetadataURL` string, uri, required — HTTPS URL referencing the SAML metadata document.
  - object — Patch both lifecycle status and provider metadata in a single request.
    - `status` 'enabled' | 'disabled', required — Lifecycle status of the connection.
    - `metadata` object, required — Provider-specific metadata required to refresh connection configuration.
      - `saml` object, required — SAML-specific metadata for the identity provider connection.
        - `samlMetadataURL` string, uri, required — HTTPS URL referencing the SAML metadata document.

## Response `200`

Success.

- object — Identity provider connection managed by the SSO service.
  - `id` string, uuid, required — Unique identifier of the SSO connection.
  - `reference` string, required — Identifier assigned by the downstream identity provider.
  - `type` 'SAML', required — Identity provider connection type.
  - `status` 'enabled' | 'disabled', required — Lifecycle status of the connection.
  - `metadata` object, required
    - `saml` object, required — SAML-specific metadata for the identity provider connection.
      - `samlMetadataURL` string, uri, required — HTTPS URL referencing the SAML metadata document.
  - `name` string, required — Internal name assigned to the connection.
  - `displayName` string, required — Display label returned to clients initiating SSO.
  - `provider` 'auth0' | 'jumpcloud' | 'microsoft' | 'okta', required — Allowed/Supported SSO providers.
  - `createdAt` string, date-time, required — ISO-8601 timestamp when the connection was created.
  - `updatedAt` string, date-time, required — ISO-8601 timestamp when the connection was last updated.

## Other responses

- `400` — Bad Request.
- `401` — Unauthorized.
- `403` — Insufficient Scope.
- `404` — Not Found.
- `415` — Unsupported Media Type.
- `429` — Too Many Requests.
- `500` — Internal Server Error.

---

[API](https://skmtc.net/payrails/apis/payrails-api-reference.md) · [All operations](https://skmtc.net/payrails/apis/payrails-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/payrails/payrails-api-reference/versions/9dd2f0158582/schema)