Sign in

v51

latestOpenAPI 3.1.0raw.githubusercontent.com2026-08-01206322659.2 KB
orgs

Set or clear the SSO connection's default just-in-time role.

put/orgs/{org_id}/identity-providers/{provider_id}/default-role

Path parameters

org_idstring required
provider_idstring required

Request body

role_idinteger nullable

Target role id, or null to remove the catch-all (group-mapping-only). Accepts a number or a stringified id.

Response

Updated connection

allowed_domainsstring[] required
client_idstring nullable

OIDC client id. null for non-OIDC kinds.

client_secret_setboolean required

Whether a client secret is configured. The secret itself is never returned.

created_atinteger required
default_role_idstring nullable

Catch-all role granted to JIT members with no matching group mapping. null = no catch-all role.

display_namestring nullable
enabledboolean required
enforcedboolean required

Read-only here: SSO enforcement isn't configurable via the API yet.

groups_claimstring nullable
idstring required
issuerstring nullable

OIDC issuer. null for non-OIDC kinds (e.g. SAML), whose connection details live in kind-specific fields added when those kinds ship.

kindstring required
org_idstring required
provider_keystring required
scopesstring nullable
updated_atinteger required