Updating a Specified SAML Provider

Function

This API is used to update the metadata document, SAML encryption settings, and private key of an existing SAML provider. To rotate the private key, add a new private key in a separate request and then remove the old private key.

Authorization Information

Each account root user has all the permissions required to call all APIs, but IAM users must be assigned the following required identity policy-based permissions. For details about the required permissions, see Permissions Policies and Supported Actions.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
iam:samlProviders:updateV5	Write	samlProvider *	g:ResourceTag/<tag-key>	-	-

URI

PUT /v5/saml-providers/{provider_id}

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
provider_id	Yes	String	Definition Provider ID. Constraints N/A Range The value must contain 1 to 64 characters, including only letters, digits, and hyphens (-). Default Value N/A

Request Parameters

**Table 2** Request body parameters
Parameter	Mandatory	Type	Description
saml_metadata_document	No	String	Definition XML document generated by an identity provider (IdP) that supports SAML 2.0. The document contains the issuer's name, expiration information, and a key that can be used to verify the SAML authentication response (assertion) received from the IdP. Constraints Length range: 1,000 to 512,000. Range N/A Default Value N/A
assertion_encryption_mode	No	String	Definition Encryption settings of the SAML provider. Constraints N/A Range The value can be "Required" or "Allowed". Default Value N/A
add_private_key	No	String	Definition Private key for decrypting SAML assertions. The private key must be an RSA private key in PEM format. When receiving an encrypted SAML assertion, IAM uses the private key to decrypt the symmetric key used to encrypt the SAML assertion, based on the RSA-OAEP algorithm. Then, IAM uses the symmetric key to decrypt the SAML assertion into plaintext based on the AES-GCM or AES-CBC encryption algorithm. Constraints Length range: 1 to 16,384 Range A string must consist of one or more of the following characters: spaces, visible ASCII characters, Latin-1 extended characters, tabs, newlines, and carriage returns. Default Value N/A
remove_private_key	No	String	Definition ID of the private key for decrypting SAML assertions. Constraints The value contains 22 to 64 characters. Range The string can contain only uppercase letters and digits. Default Value N/A
description	No	String	Definition Description of an identity provider. Constraints Length range: 0 to 255. Range The value cannot contain the following special characters: @#%&<>$^. Default Value* N/A

Response Parameters

Status code: 200

**Table 3** Response body parameters
Parameter	Type	Description
saml_provider	saml_provider object	Definition SAML provider. Range N/A

**Table 4** saml_provider
Parameter	Type	Description
provider_id	String	Definition ID of the SAML identity provider. Range The value must contain 1 to 64 characters, including only letters, digits, and hyphens (-).
name	String	Definition Name of the SAML identity provider. Range The value must contain 1 to 64 characters, including only letters, digits, underscores (_), and hyphens (-).
description	String	Definition Description of an identity provider. Range The value can contain 0 to 255 characters and cannot contain the following special characters: @#%&<>$^*.
urn	String	Definition Uniform resource name. Range The value must contain 16 to 1,500 characters, including letters, digits, slashes (/), equal signs (=), underscores (_), colons (:), and hyphens (-).
saml_metadata_document	String	Definition XML document of an IdP that supports SAML 2.0. Range Length range: 1,000 to 512,000.
assertion_encryption_mode	String	Definition Encryption settings of the SAML identity provider. Range The value can be "Required" or "Allowed".
private_keys	Array of private_keys objects	Definition Private key used to decrypt SAML assertions. Range N/A
created_at	String	Definition Time when the SAML identity provider was created. Range N/A
expires_at	String	Definition Time when the SAML identity provider expires. Range N/A

**Table 5** private_keys
Parameter	Type	Description
key_id	String	Definition ID of the private key for decrypting SAML assertions. Range N/A
timestamp	String	Definition Time when the private key for decrypting SAML assertions was uploaded. The value must comply with the ISO 8601 format. Range N/A

Status code: 400

**Table 6** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Status code: 403

**Table 7** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A
encoded_authorization_message	String	Definition : Encrypted details returned when the authentication fails, which are used to locate authentication problems. The STS5 decryption API can be used for decryption. For details, see API link. Range: N/A.

Status code: 404

**Table 8** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Status code: 409

**Table 9** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Example Requests

Updating a specified SAML provider

PUT https://{endpoint}/v5/saml-providers/{provider_id}

{
  "saml_metadata_document" : "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<md:EntityDescriptor entityID=\"http://***.***.com/****************************\"\n                     xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\">\n\t<md:IDPSSODescriptor WantAuthnRequestsSigned=\"false\"\n\t                     protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\">\n\t\t<md:KeyDescriptor use=\"signing\">\n\t\t\t<ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n\t\t\t\t<ds:X509Data>\n\t\t\t\t\t<ds:X509Certificate>example************************************************************************************************************************************************************************************************************************************************************************************************************************************************example</ds:X509Certificate>\n\t\t\t\t</ds:X509Data>\n\t\t\t</ds:KeyInfo>\n\t\t</md:KeyDescriptor>\n\t\t<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>\n\t\t<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>\n\t\t<md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\"\n\t\t                        Location=\"https://***************.okta.com/app/***************_oktaaws_1/****************************/sso/saml\"/>\n\t\t<md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\"\n\t\t                        Location=\"https://***************.okta.com/app/***************_oktaaws_1/****************************/sso/saml\"/>\n\t</md:IDPSSODescriptor>\n</md:EntityDescriptor>",
  "description" : "string"
}

Example Responses

Status code: 200

Request succeeded.

{
  "saml_provider" : {
    "provider_id" : "string",
    "name" : "string",
    "urn" : "iam::accountid:user:name",
    "description" : "string",
    "saml_metadata_document" : "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<md:EntityDescriptor entityID=\"http://***.***.com/****************************\"\n                     xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\">\n\t<md:IDPSSODescriptor WantAuthnRequestsSigned=\"false\"\n\t                     protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\">\n\t\t<md:KeyDescriptor use=\"signing\">\n\t\t\t<ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n\t\t\t\t<ds:X509Data>\n\t\t\t\t\t<ds:X509Certificate>example************************************************************************************************************************************************************************************************************************************************************************************************************************************************example</ds:X509Certificate>\n\t\t\t\t</ds:X509Data>\n\t\t\t</ds:KeyInfo>\n\t\t</md:KeyDescriptor>\n\t\t<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>\n\t\t<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>\n\t\t<md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\"\n\t\t                        Location=\"https://***************.okta.com/app/***************_oktaaws_1/****************************/sso/saml\"/>\n\t\t<md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\"\n\t\t                        Location=\"https://***************.okta.com/app/***************_oktaaws_1/****************************/sso/saml\"/>\n\t</md:IDPSSODescriptor>\n</md:EntityDescriptor>",
    "assertion_encryption_mode" : "Allowed",
    "private_keys" : [ ],
    "created_at" : "2026-06-22T12:00:06.412Z",
    "expires_at" : "2126-05-29T12:00:06.376Z"
  }
}