# Set SSO SAML configuration for specific application in the organization

Set SSO SAML configuration for specific application in the organization. Creates a new configuration if it does not exist, or updates an existing one. **Required permissions**: `organizations:edit`, `orgs:edit`.

Endpoint: PUT /v1/organizations/{organization_id}/applications/{app_id}/sso/saml/set
Security: AdminAccessToken

## Security:

  - `AdminAccessToken` (unknown)
    oauth2

## Path parameters:

  - `organization_id` (string, required)
    ID of the organization

  - `app_id` (string, required)
    ID of the application

## Request fields (application/json):

  - `service_provider` (object, required)

  - `service_provider.default_redirect_uri` (string)
    Default redirect URI for the application

  - `service_provider.acs_url` (string)
    Custom ACS URL for backend-driven flows

  - `identity_provider` (object, required)

  - `identity_provider.entity_id` (string, required)
    Entity ID of the identity provider

  - `identity_provider.sso_url` (string, required)
    Single sign-on URL of the SAML identity provider, which will receive the authentication request

  - `identity_provider.signing_certificates` (array, required)
    Certificates used to validate the signature of the SAML response. Provided by the SAML identity provider.

  - `identity_provider.nameid_type` (string)
    Type of identifier in the SAML nameId (email, phone_number, username, etc.)

  - `name` (string, required)
    Name of the SSO configuration

  - `enabled` (boolean)
    Indicates whether the SSO configuration is enabled

  - `sso_signup_enabled` (boolean)
    Indicates whether public signup through SSO is allowed

  - `group_role_mapping` (object)
    Group-to-role mapping configuration

  - `group_role_mapping.enabled` (boolean)
    Link federated IdP groups to user roles to automate permission assignments

  - `group_role_mapping.group_claim_name` (string)
    Attribute/claim in the SSO response that carries the group names (e.g. groups, memberOf, or a URI)

  - `group_role_mapping.mappings` (array)
    Mappings of federated IdP group name to Mosaic role IDs

  - `group_role_mapping.mappings.idp_group_name` (string, required)
    Federated IdP group name as it appears in the SSO response

  - `group_role_mapping.mappings.role_ids` (array, required)
    Mosaic role IDs to assign for this group (1 group to N roles)

  - `group_role_mapping.default_role_ids` (array)
    Fallback Mosaic role IDs used when no mapping resolves

## Response 200 fields (application/json):

  - `result` (object, required)