Docmost Octri Preview
POST/sso/create

Create an SSO provider

Creates an SSO provider for the workspace. Supply name and type, then include the configuration fields required for that provider type.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

18 body fields

SSO provider configuration. name and type are required; other required fields depend on the provider type.

allowSignupbooleanoptional
If `true`, users authenticating via this provider for the first time are automatically created in the workspace.
groupSyncbooleanoptional
If `true`, syncs group memberships from the SSO provider to Docmost groups.
isEnabledbooleanoptional
If `true`, this provider is active and shown on the login page.
ldapBaseDnstringoptional
LDAP: Base DN for user search (e.g. `ou=users,dc=example,dc=com`).
ldapBindDnstringoptional
LDAP: Bind Distinguished Name for connecting to the LDAP server.
ldapBindPasswordstringoptional
LDAP: Bind password.
ldapTlsCaCertstringoptional
LDAP: CA certificate for TLS verification (PEM format).
ldapTlsEnabledbooleanoptional
LDAP: If `true`, uses TLS for the connection.
ldapUrlstringoptional
LDAP: Server URL with protocol (`ldap://` or `ldaps://`).
ldapUserAttributesobjectoptional
LDAP: Attribute mapping for user fields (name, email). Maps LDAP attribute names to Docmost user fields.
ldapUserSearchFilterstringoptional
LDAP: Search filter for locating users (e.g. `(uid={{username}})`).
namestringrequired
Display name for the SSO provider (shown on the login page).
oidcClientIdstringoptional
OIDC/Google: OAuth client ID.
oidcClientSecretstringoptional
OIDC/Google: OAuth client secret.
oidcIssuerstringoptional
OIDC/Google: Issuer URL (e.g. `https://accounts.google.com`).
samlCertificatestringoptional
SAML: X.509 certificate for signature verification (PEM format).
samlUrlstringoptional
SAML: IdP metadata URL or SSO endpoint URL.
typestringrequired
Provider type. `saml`: SAML 2.0 identity provider. `oidc`: OpenID Connect provider. `google`: Google OAuth (simplified OIDC). `ldap`: LDAP/Active Directory.
Allowed:samloidcgoogleldap

3 status codes
200Returns the created SSO provider in the response payload.
dataobjectoptional
statusintegeroptional
successbooleanoptional
400Returned when the provider configuration fails validation.
errorstringoptional
Reason phrase, for example `Bad Request`.
messagestringoptional
statusCodeintegeroptional
403Returned when you do not have permission to create an SSO provider.
errorstringoptional
Reason phrase, for example `Bad Request`.
messagestringoptional
statusCodeintegeroptional

Error handling

A 400 is returned when the provider configuration fails validation. A 403 is returned when you do not have permission to manage SSO providers. name and type are required; name must not exceed 64 characters, and oidcIssuer must be a URI when provided.