--- updatedAt: 2026-05-28T08:16:45.000Z agentTools: projectIndex: https://docs.scalr.io/llms.txt --- # Create SAML Integration Create SAML Integration. # OpenAPI definition ```json { "components": { "schemas": { "SamlIntegration": { "properties": { "attributes": { "properties": { "auto-redirect": { "description": "If enabled, user will be redirected to IdP's login page.", "nullable": true, "type": "boolean" }, "base-url": { "description": "Base URL to construct SAML endpoints from. It needs to be a URL with the protocol, server, port and context path.", "nullable": true, "type": "string" }, "debug": { "default": false, "description": "Enables debug mode.", "type": "boolean" }, "error-message": { "description": "A message from an IdP that indicates a nature of the problem", "nullable": true, "readOnly": true, "type": "string" }, "idp-cert-fingerprint": { "description": "Instead of using the whole x509cert you can use a fingerprint in order to validate the SAMLResponse, but we don't recommend to use this method on production since is exploitable by collision attack.", "nullable": true, "type": "string" }, "idp-cert-fingerprint-algorithm": { "default": "sha256", "description": "IDP cert fingerprint algorithm", "type": "string" }, "idp-entity-id": { "description": "Identifier of the IdP entity (must be a URI).", "type": "string" }, "idp-single-logout-service-binding": { "description": "SAML protocol binding to be used when returning the response message (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect).", "nullable": true, "type": "string" }, "idp-single-logout-service-response-url": { "description": "URL location of IdP where SLO Response will be sent.", "nullable": true, "type": "string" }, "idp-single-logout-service-url": { "description": "URL target of IdP where Scalr will send the SLO Request.", "nullable": true, "type": "string" }, "idp-single-sign-on-service-binding": { "description": "SAML protocol binding to be used when returning the response message (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect).", "nullable": true, "type": "string" }, "idp-single-sign-on-service-url": { "description": "URL target of IdP where Scalr will send the Authentication Request Message.", "type": "string" }, "idp-x509cert": { "description": "Public x509 certificate of the IdP.", "nullable": true, "type": "string" }, "idp-x509cert-multi-encryption": { "description": "IDP x509cert multi encryption", "nullable": true, "type": "string" }, "idp-x509cert-multi-signing": { "description": "In some scenarios IdP uses different certificates for signing/encryption, or is under key rollover phase and more than one certificate is published on IdP metadata. (when used, 'IdP x509cert' and 'IdP Cert Fingerprint' values are ignored)", "nullable": true, "type": "string" }, "is-used": { "default": false, "description": "Whether this SAML IdP is in use.", "readOnly": true, "type": "boolean" }, "mapping-azure-aad-account-type": { "description": "Account type.", "nullable": true, "type": "string" }, "mapping-azure-aad-client-id": { "description": "Client ID.", "nullable": true, "type": "string" }, "mapping-azure-aad-enabled": { "default": false, "description": "Use Azure Active Directory.", "type": "boolean" }, "mapping-azure-aad-secret-key": { "description": "Secret key.", "nullable": true, "type": "string" }, "mapping-azure-aad-tenant-id": { "description": "Tenant ID.", "nullable": true, "type": "string" }, "mapping-email": { "description": "Email attribute, in case usernames and emails are different.", "nullable": true, "type": "string" }, "mapping-fullname": { "description": "Display name attribute.", "nullable": true, "type": "string" }, "mapping-groups": { "description": "The name of the Groups attribute to use in SAML Assertion.", "nullable": true, "type": "string" }, "mapping-separator": { "description": "Groups separator", "nullable": true, "type": "string" }, "name": { "description": "Name of SAML integration", "maxLength": 255, "type": "string" }, "security-allow-repeat-attribute-name": { "default": false, "description": "If true, it will not raise an error when the Statement Element contains attribute elements with name duplicated.", "type": "boolean" }, "security-authn-requests-signed": { "default": false, "description": "Indicates whether the messages sent by Scalr will be signed.", "type": "boolean" }, "security-digest-algorithm": { "description": "Algorithm that Scalr will use on digest process.", "enum": [ "http://www.w3.org/2001/04/xmlenc#sha256", "http://www.w3.org/2001/04/xmldsig-more#sha384", "http://www.w3.org/2001/04/xmlenc#sha512" ], "nullable": true, "type": "string" }, "security-logout-request-signed": { "default": false, "description": "Indicates whether the messages sent by Scalr will be signed.", "type": "boolean" }, "security-logout-response-signed": { "default": false, "description": "Indicates whether the messages sent by Scalr will be signed.", "type": "boolean" }, "security-name-id-encrypted": { "default": false, "description": "Indicates that the nameID of the sent by Scalr will be encrypted.", "type": "boolean" }, "security-requested-authn-context": { "default": "[\"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport\"]", "description": "Leave empty and no AuthContext will be sent in the AuthNRequest,Set an array with the possible auth context values: [\"urn:oasis:names:tc:SAML:2.0:ac:classes:Password\", \"urn:oasis:names:tc:SAML:2.0:ac:classes:X509\"]", "type": "string" }, "security-requested-authn-context-comparison": { "default": "exact", "description": "Allows the authn comparison parameter to be set.", "enum": [ "exact", "minimum", "better", "maximum" ], "type": "string" }, "security-sign-metadata": { "description": "Sign the Metadata. If enabled SP certificate must be provided.", "nullable": true, "type": "boolean" }, "security-signature-algorithm": { "default": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", "description": "Algorithm that Scalr will use on signing process.", "enum": [ "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384", "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" ], "type": "string" }, "security-want-assertions-encrypted": { "default": false, "description": "Indicates a requirement for the elements received by Scalr to be encrypted.", "type": "boolean" }, "security-want-assertions-signed": { "default": false, "description": "Indicates a requirement for the elements received by Scalr to be signed.", "type": "boolean" }, "security-want-messages-signed": { "default": false, "description": "Indicates a requirement for the , and elements received by Scalr to be signed.", "type": "boolean" }, "security-want-name-id": { "default": true, "description": "Indicates a requirement for the NameID element on the SAMLResponse received by this SP to be present.", "type": "boolean" }, "security-want-name-id-encrypted": { "default": false, "description": "Indicates a requirement for the NameID received by Scalr to be encrypted.", "type": "boolean" }, "sp-assertion-consumer-service-binding": { "default": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", "description": "SAML protocol binding to be used when returning the response message. It supports HTTP-POST binding only.", "type": "string" }, "sp-default-entity-id": { "readOnly": true, "type": "string" }, "sp-entity-id": { "description": "Service provider entity identifier", "maxLength": 24, "type": "string" }, "sp-name-id-format": { "default": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified", "description": "SP name id format", "type": "string" }, "sp-private-key": { "description": "SP private key", "nullable": true, "type": "string" }, "sp-single-logout-service-binding": { "default": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", "description": "SP single logout service binding", "type": "string" }, "sp-x509cert": { "description": "SP x509cert", "nullable": true, "type": "string" }, "sp-x509cert-new": { "description": "SP x509cert new", "nullable": true, "type": "string" }, "status": { "description": "Status of SAML integration.", "enum": [ "active", "disabled", "failed" ], "type": "string" }, "strict": { "default": true, "description": "If enabled, Scalr will reject unsigned or unencrypted messages when expects them to be signed or encrypted.", "type": "boolean" }, "use-identifier-in-urls": { "default": true, "type": "boolean" }, "verification-status": { "default": "pending", "description": "Represents the verification status with the IdP SAML provider)", "enum": [ "pending", "success", "running" ], "readOnly": true, "type": "string" } }, "required": [ "name", "idp-entity-id", "idp-single-sign-on-service-url" ], "type": "object" }, "id": { "readOnly": true, "type": "string" }, "links": { "properties": { "self": { "readOnly": true, "type": "string" } }, "readOnly": true, "type": "object" }, "relationships": { "properties": { "account": { "description": "The account this SAML integration belongs to.", "properties": { "data": { "nullable": true, "properties": { "id": { "type": "string" }, "type": { "enum": [ "accounts", "" ], "type": "string" } }, "required": [ "type", "id" ], "type": "object" } }, "readOnly": true, "required": [ "data" ], "type": "object" } }, "type": "object" }, "type": { "enum": [ "saml-integration" ], "type": "string" } }, "required": [ "type", "attributes" ], "type": "object" }, "SamlIntegrationDocument": { "description": "JSON:API Document.\n\nsee: https://jsonapi.org/format/#document-structure", "properties": { "data": { "$ref": "#/components/schemas/SamlIntegration" }, "included": { "items": { "type": "object" }, "readOnly": true, "type": "array" }, "meta": { "readOnly": true, "type": "object" } }, "type": "object" } }, "securitySchemes": { "API-Key": { "scheme": "bearer", "type": "http" } } }, "info": { "description": "Scalr IACP API", "license": { "name": "Apache 2.0", "url": "https://www.apache.org/licenses/LICENSE-2.0" }, "title": "Scalr IACP API", "version": "unversioned" }, "openapi": "3.0.0", "paths": { "/integrations/saml": { "post": { "description": "Create SAML Integration.\n", "operationId": "create_saml_integration", "parameters": [], "requestBody": { "content": { "application/vnd.api+json": { "examples": { "default": { "value": "{\n \"data\":{\n \"type\":\"saml-integration\",\n \"attributes\":{\n \"sp-entity-id\":\"idp-v0ocukdk89c6k8nqs\",\n \"name\":\"manual-saml-integration\",\n \"idp-entity-id\":\"https://saml.example.com/entityidd\",\n \"idp-single-sign-on-service-url\":\"https://mocksaml.com/api/saml/sso\",\n \"mapping-azure-aad-enabled\":false,\n \"security-want-name-id\":true,\n \"strict\":false,\n \"idp-cert-fingerprint-algorithm\":\"sha256\",\n \"security-signature-algorithm\":\"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256\",\n \"security-requested-authn-context\":\"[\\\"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport\\\"]\",\n \"security-requested-authn-context-comparison\":\"minimum\",\n \"sp-name-id-format\":\"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\",\n \"sp-assertion-consumer-service-binding\":\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\",\n \"sp-single-logout-service-binding\":\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\",\n \"sp-default-entity-id\":\"https://my.scalr.iopublic/saml/idp-v0ocukdk89c6k8nqs/metadata\",\n \"idp-x509cert\":\"\",\n \"base-url\":\"https://mocksaml.com/api/saml/sso\",\n \"idp-single-sign-on-service-binding\":\"https://mocksaml.com/api/saml/sso\",\n \"mapping-email\":\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\",\n \"idp-single-logout-service-response-url\":\"https://mocksaml.com/api/saml/sso\",\n \"idp-single-logout-service-binding\":\"https://mocksaml.com/api/saml/sso\",\n \"idp-x509cert-multi-signing\":\"\",\n \"idp-x509cert-multi-encryption\":\"\",\n \"security-logout-request-signed\":false,\n \"security-digest-algorithm\":\"http://www.w3.org/2001/04/xmlenc#sha256\"\n }\n }\n}" } }, "schema": { "$ref": "#/components/schemas/SamlIntegrationDocument" } } } }, "responses": { "201": { "content": { "application/vnd.api+json": { "examples": { "default": { "value": "{\n \"data\": {\n \"attributes\": {\n \"auto-redirect\": null,\n \"base-url\": \"https://mocksaml.com/api/saml/sso\",\n \"debug\": false,\n \"error-message\": null,\n \"idp-cert-fingerprint\": null,\n \"idp-cert-fingerprint-algorithm\": \"sha256\",\n \"idp-entity-id\": \"https://saml.example.com/entityidd\",\n \"idp-single-logout-service-binding\": \"https://mocksaml.com/api/saml/sso\",\n \"idp-single-logout-service-response-url\": \"https://mocksaml.com/api/saml/sso\",\n \"idp-single-logout-service-url\": null,\n \"idp-single-sign-on-service-binding\": \"https://mocksaml.com/api/saml/sso\",\n \"idp-single-sign-on-service-url\": \"https://mocksaml.com/api/saml/sso\",\n \"idp-x509cert\": null,\n \"idp-x509cert-multi-encryption\": \"\",\n \"idp-x509cert-multi-signing\": \"\",\n \"is-used\": false,\n \"mapping-azure-aad-account-type\": null,\n \"mapping-azure-aad-client-id\": null,\n \"mapping-azure-aad-enabled\": false,\n \"mapping-azure-aad-secret-key\": null,\n \"mapping-azure-aad-tenant-id\": null,\n \"mapping-email\": \"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\",\n \"mapping-fullname\": null,\n \"mapping-groups\": null,\n \"mapping-separator\": null,\n \"name\": \"manual-saml-integration\",\n \"security-allow-repeat-attribute-name\": false,\n \"security-authn-requests-signed\": false,\n \"security-digest-algorithm\": \"http://www.w3.org/2001/04/xmlenc#sha256\",\n \"security-logout-request-signed\": false,\n \"security-logout-response-signed\": false,\n \"security-name-id-encrypted\": false,\n \"security-requested-authn-context\": \"[\\\"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport\\\"]\",\n \"security-requested-authn-context-comparison\": \"minimum\",\n \"security-sign-metadata\": null,\n \"security-signature-algorithm\": \"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256\",\n \"security-want-assertions-encrypted\": false,\n \"security-want-assertions-signed\": false,\n \"security-want-messages-signed\": false,\n \"security-want-name-id\": true,\n \"security-want-name-id-encrypted\": false,\n \"source\": \"custom\",\n \"sp-assertion-consumer-service-binding\": \"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\",\n \"sp-default-entity-id\": \"https://my.scalr.io/public/saml/idp-v0ocukdk89c6k8nqs/metadata\",\n \"sp-entity-id\": \"idp-v0ocukdk89c6k8nqs\",\n \"sp-name-id-format\": \"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\",\n \"sp-private-key\": null,\n \"sp-single-logout-service-binding\": \"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\",\n \"sp-x509cert\": null,\n \"sp-x509cert-new\": null,\n \"status\": \"failed\",\n \"strict\": false,\n \"use-identifier-in-urls\": true,\n \"verification-status\": \"pending\"\n },\n \"id\": \"idp-v0ocukdk89c6k8nqs\",\n \"links\": {\n \"self\": \"https://my.scalr.io/api/iacp/v3/integrations/saml/idp-v0ocukdk89c6k8nqs\"\n },\n \"relationships\": {\n \"account\": {\n \"data\": {\n \"id\": \"acc-v0nv4664qnnnrk14l\",\n \"type\": \"accounts\"\n }\n }\n },\n \"type\": \"saml-integration\"\n },\n \"included\": null,\n \"meta\": null\n}" } }, "schema": { "$ref": "#/components/schemas/SamlIntegrationDocument" } } }, "description": "Success." }, "403": { "description": "User unauthorized to perform action." }, "404": { "description": "Account not found or user unauthorized to perform action." }, "422": { "description": "Malformed request body (missing attributes, wrong types, etc.)." }, "4XX": { "description": "Client error." }, "5XX": { "description": "Server error." } }, "summary": "Create SAML Integration", "tags": [ "saml-integrations" ], "x-resource": "SamlIntegration", "x-service": "tf-api" } } }, "security": [ { "API-Key": [] } ], "servers": [ { "url": "https://{Domain}/api/iacp/v3", "variables": { "Domain": { "default": "example.scalr.io", "description": "Domain where Scalr is hosted" } } } ] } ``` # Sibling pages * [List SAML Integrations](https://docs.scalr.io/scalr/reference/list_saml_integrations.md) * [Delete SAML Integration](https://docs.scalr.io/scalr/reference/delete_saml_integration.md) * [Get SAML Integration](https://docs.scalr.io/scalr/reference/get_saml_integration.md) * [Update SAML Integration](https://docs.scalr.io/scalr/reference/update_saml_integration.md)