MCPBundler Docs
MCPBundler Docs
Back to marketplaceGetting StartedAuthenticationTutorial - Bundle to Connected Agent
API Reference
Agent A2A Tools
Agent Channels
Agent Configuration (Staging)
Agent Configuration (Versions)
Agent Tools
agents
Agents
Attachments
Auth
Billing
bundler
Bundler
Bundler Tool
Bundles
Call Campaigns
Catalog
Conversations
Credentials
Deployments
Discover
Fleet
Genesys
Insights
internal
Knowledge Base Website Sources
Knowledge Bases
MCP Listings
Media
OAuth Clients
OAuth2
Observability
Organisation roles
Organisations
Bind An Org Key To A ProviderCancel Subscription ImmediatelyCancel Subscription At Period EndChange Subscription PlanClaim Organisation DomainAdd Org Provider ModelRegister Org ProviderCreate OrganisationClear Org Credential AssignmentDelete Org Provider ModelDelete Org ProviderDelete OrganisationDelete Schema Notification WebhookDelete SSO ConfigDisable SCIMGenerate SCIM TokenGet Notification Badge CountsGet OrganisationGet Recording PolicyGet SCIM StatusGet SSO ConfigInvite Organisation MemberList Organisation DomainsList Organisation MembersList My OrganisationsList Organisation BundlesList Organisation ListingsList Organisation MCPsList Org Provider ModelsList Org ProvidersList Organisation InvoicesList SCIM Role MappingsSet Org Credential AssignmentRefresh Org Provider Models From EndpointRemove Organisation DomainRemove Organisation MemberReplace SCIM Role MappingsSave SSO ConfigSet Schema Notification WebhookStart Subscription CheckoutSync SCIM UsersTest An Org Provider EndpointRemove An Org Key From A ProviderUpdate Member RoleUpdate Org Provider ModelUpdate Org ProviderUpdate Organisation VariablesUpdate OrganisationUpdate Organisation PolicyUpdate Recording PolicyVerify Organisation Domain
Providers
Reviews
Roadmap
SCIM
Simulation Tests
Suppression
Triggers
TTS
Users
Utils
Visitors
Voices
Webhooks
Workflows
API ReferenceOrganisations

Save SSO Config

Enabling SSO for an organisation requires this order:

  1. POST /organisations/{org_id}/domains - claim the identity domain.
  2. POST /organisations/{org_id}/domains/{domain_id}/verify - prove control via a DNS TXT record. SSO cannot be configured until at least one domain is verified.
  3. PUT /organisations/{org_id}/sso (this endpoint) - point at the provider's OIDC issuer; provisions a matching Keycloak identity provider.
  4. Optionally PATCH /organisations/{org_id}/policy with require_sso: true to force every member through SSO - only accepted once an active SSO config exists, so members can never be locked out.
PUT
/v1/organisations/{org_id}/sso

Configure (or reconfigure) SSO for the organisation.

Authorization: sso:manage.

Preconditions:

  • The organisation must have at least one verified domain (proves control over the identity domain before delegating auth to it).
  • The issuer URL must expose a valid OIDC discovery document.

Provisions or updates a Keycloak identity provider named after the organisation's slug, then persists the config with the client secret encrypted at rest.

Authorization

OAuth2AuthorizationCodeBearer
AuthorizationBearer <token>

In: header

Path Parameters

org_id*Org Id
Formatuuid

Query Parameters

verify_locally?Verify Locally
Defaulttrue

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X PUT "https://example.com/v1/organisations/497f6eca-6276-4993-bfeb-53cbbbba6f08/sso" \  -H "Content-Type: application/json" \  -d '{    "issuer_url": "string",    "client_id": "string",    "client_secret": "string"  }'
{  "status": "string",  "issuer_url": "string",  "client_id": "string",  "client_secret": "string",  "enabled": false}
{  "detail": [    {      "loc": [        "string"      ],      "msg": "string",      "type": "string"    }  ]}

Replace SCIM Role Mappings

Previous Page

Set Schema Notification Webhook

Next Page

issuer_url*Issuer Url
Length1 <= length <= 512
client_id*Client Id
Length1 <= length <= 256
client_secret*Client Secret
Length1 <= length