MCPBundler Docs
MCPBundler Docs
Back to marketplaceGetting StartedAuthenticationTutorial - Bundle to Connected Agent
API Reference
Auth
Bundler
Bundles
Catalog
Deployments
Discover
LLM
MCP Listing Claims
MCP Listings
OAuth2
Observability
Organisations
Claim Organisation DomainCreate Org Vault EntryCreate OrganisationDelete Org LLM BindingDelete Org Vault EntryDelete OrganisationDelete SSO ConfigDisable SCIMGenerate SCIM TokenGet OrganisationGet SCIM StatusGet SSO ConfigInvite Organisation MemberList Organisation DomainsList Organisation MembersList My OrganisationsList Organisation BundlesList Organisation ListingsList Org LLM BindingsList Org Vault EntriesList SCIM Role MappingsRemove Organisation DomainRemove Organisation MemberReplace SCIM Role MappingsSave SSO ConfigSync SCIM UsersUpdate Member RoleUpdate Org Vault EntryUpdate OrganisationUpdate Organisation PolicyUpsert Org LLM BindingVerify Organisation Domain
Reviews
Roadmap
SCIM
Users
Utils
Vault
Webhooks
API ReferenceOrganisations

Save SSO Config

Enabling SSO for an organisation requires this order:

  1. POST /organisations/{org_id}/domains - claim the identity domain.
  2. POST /organisations/{org_id}/domains/{domain_id}/verify - prove control via a DNS TXT record. SSO cannot be configured until at least one domain is verified.
  3. PUT /organisations/{org_id}/sso (this endpoint) - point at the provider's OIDC issuer; provisions a matching Keycloak identity provider.
  4. Optionally PATCH /organisations/{org_id}/policy with require_sso: true to force every member through SSO - only accepted once an active SSO config exists, so members can never be locked out.
PUT
/v1/organisations/{org_id}/sso

Configure (or reconfigure) SSO for the organisation.

Authorization: caller must be the owner.

Preconditions:

  • The organisation must have at least one verified domain (proves control over the identity domain before delegating auth to it).
  • The issuer URL must expose a valid OIDC discovery document.

Provisions or updates a Keycloak identity provider named after the organisation's slug, then persists the config with the client secret encrypted at rest.

Authorization

OAuth2AuthorizationCodeBearer
AuthorizationBearer <token>

In: header

Path Parameters

org_id*Org Id
Formatuuid

Query Parameters

verify_locally?Verify Locally
Defaulttrue

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X PUT "https://example.com/v1/organisations/497f6eca-6276-4993-bfeb-53cbbbba6f08/sso" \  -H "Content-Type: application/json" \  -d '{    "issuer_url": "string",    "client_id": "string",    "client_secret": "string"  }'
{  "status": "string",  "issuer_url": "string",  "client_id": "string",  "client_secret": "string",  "enabled": false}
{  "detail": [    {      "loc": [        "string"      ],      "msg": "string",      "type": "string"    }  ]}

Replace SCIM Role Mappings

Previous Page

Sync SCIM Users

Next Page

issuer_url*Issuer Url
Length1 <= length <= 512
client_id*Client Id
Length1 <= length <= 256
client_secret*Client Secret
Length1 <= length