> ## Documentation Index
> Fetch the complete documentation index at: https://docs.idun-group.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Patch Sso



## OpenAPI

````yaml /standalone/openapi.json patch /admin/api/v1/sso
openapi: 3.1.0
info:
  title: Idun Agent Engine Server
  description: A production-ready server for conversational AI agents
  version: 0.6.1
servers: []
security: []
tags:
  - name: Runtime
    description: >-
      Public agent run endpoints, engine operations, and chat-channel webhooks.
      SSE streaming via the AG-UI protocol.
  - name: Agent Configuration
    description: >-
      Singleton admin endpoints for the agent, prompts, memory, guardrails, and
      onboarding wizard.
  - name: Auth & SSO
    description: >-
      Login, sessions, password change, SSO config, and the public SSO discovery
      endpoint.
  - name: Integrations & Tools
    description: MCP server registry and external integration credentials.
  - name: Observability
    description: Tracing/logging provider configuration.
  - name: Traces
    description: >-
      Trace and span storage admin endpoints — list, detail, delete, and
      pipeline-health for the standalone trace store.
  - name: Dashboard
    description: >-
      Operator dashboard widgets — KPIs, time-series, top errors, and
      configuration summary.
paths:
  /admin/api/v1/sso:
    patch:
      tags:
        - Auth & SSO
      summary: Patch Sso
      operationId: patch_sso_admin_api_v1_sso_patch
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StandaloneSsoPatch'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/StandaloneMutationResponse_StandaloneSsoRead_
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    StandaloneSsoPatch:
      properties:
        sso:
          anyOf:
            - $ref: '#/components/schemas/SSOConfig'
            - type: 'null'
      type: object
      title: StandaloneSsoPatch
      description: Body for PATCH /admin/api/v1/sso. All fields optional.
    StandaloneMutationResponse_StandaloneSsoRead_:
      properties:
        data:
          $ref: '#/components/schemas/StandaloneSsoRead'
        reload:
          $ref: '#/components/schemas/StandaloneReloadResult'
      type: object
      required:
        - data
        - reload
      title: StandaloneMutationResponse[StandaloneSsoRead]
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    SSOConfig:
      properties:
        enabled:
          type: boolean
          title: Enabled
          description: Toggle SSO enforcement on protected routes.
          default: true
        issuer:
          type: string
          title: Issuer
          description: >-
            OIDC issuer URL (e.g. https://accounts.google.com). Used to discover
            the JWKS endpoint via .well-known/openid-configuration.
        clientId:
          type: string
          title: Clientid
          description: >-
            OAuth 2.0 client ID. Used as the default audience for JWT validation
            when 'audience' is not set.
        audience:
          anyOf:
            - type: string
            - type: 'null'
          title: Audience
          description: >-
            Expected JWT 'aud' claim. Defaults to client_id if not set. Okta
            client credentials tokens use 'api://default'.
        allowedDomains:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Alloweddomains
          description: >-
            Optional list of allowed email domains (e.g. ['company.com']). When
            set, only tokens whose email claim matches one of these domains are
            accepted.
        allowedEmails:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Allowedemails
          description: >-
            Optional list of specific email addresses allowed access. When set,
            only tokens whose email claim exactly matches one of these values
            are accepted.
      type: object
      required:
        - issuer
        - clientId
      title: SSOConfig
      description: |-
        OIDC Single Sign-On configuration.

        When enabled, the engine validates JWT tokens on protected routes
        (``/agent/invoke``, ``/agent/stream``, ``/agent/copilotkit/stream``)
        against the configured OIDC provider's JWKS endpoint, discovered via
        ``{issuer}/.well-known/openid-configuration``.
    StandaloneSsoRead:
      properties:
        sso:
          $ref: '#/components/schemas/SSOConfig'
        updatedAt:
          type: string
          format: date-time
          title: Updatedat
      type: object
      required:
        - sso
        - updatedAt
      title: StandaloneSsoRead
      description: GET response and the data payload of PATCH responses.
    StandaloneReloadResult:
      properties:
        status:
          $ref: '#/components/schemas/StandaloneReloadStatus'
        message:
          type: string
          title: Message
        error:
          anyOf:
            - type: string
            - type: 'null'
          title: Error
      type: object
      required:
        - status
        - message
      title: StandaloneReloadResult
      description: |-
        Reload outcome attached to every admin mutation response.

        ``reloaded`` means DB committed and runtime now uses the new config.
        ``restart_required`` means DB committed and process restart is needed.
        ``reload_failed`` means DB rolled back and runtime is unchanged.
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
    StandaloneReloadStatus:
      type: string
      enum:
        - reloaded
        - restart_required
        - reload_failed
      title: StandaloneReloadStatus
      description: Outcome of a reload triggered by an admin mutation.

````