> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corepillar.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Save the Okta SSO configuration

> Creates or updates the Okta configuration. The client secret is encrypted at rest and never returned. It's required the first time; on later saves, omit it to keep the stored secret.

**Auth:** session. **Permission:** `manage_sso`.



## OpenAPI

````yaml /api-reference/openapi.json put /orgs/{orgId}/sso-config
openapi: 3.1.0
info:
  title: CorePillar API
  version: 1.0.0
  description: >-
    REST API for AgentHub and ModelHub. Ingestion endpoints authenticate with a
    project tracing key; all other endpoints use the signed-in user's browser
    session.
servers:
  - url: https://pillarforge.corepillar.ai/api/v1
    description: AgentHub
security: []
tags:
  - name: Ingestion
    description: 'Send traces with a tracing key: JSON ingest and OpenTelemetry (OTLP).'
  - name: Traces
    description: Read traces and spans.
  - name: Evaluations
    description: Evaluate traces with evaluator collections.
  - name: Evaluators
    description: Built-in and custom evaluators.
  - name: Evaluator collections
    description: Ordered groups of evaluators.
  - name: Organizations
    description: Organizations you belong to.
  - name: Members
    description: Organization members, invites and roles.
  - name: Projects
    description: Projects inside an organization.
  - name: SSO
    description: Okta SSO configuration.
  - name: Tracing keys
    description: Create, list and revoke project tracing keys.
  - name: Cost calculator
    description: Estimate, generate and execute scenario runs.
  - name: Synthetic
    description: Synthetic agent and data setup from source material.
  - name: Chat
    description: ModelHub chat. Served at https://modelhub.corepillar.ai/api/v1.
  - name: Auth
    description: Sign-in helpers.
  - name: E2E
    description: Internal end-to-end encryption key directory.
paths:
  /orgs/{orgId}/sso-config:
    put:
      tags:
        - SSO
      summary: Save the Okta SSO configuration
      description: >-
        Creates or updates the Okta configuration. The client secret is
        encrypted at rest and never returned. It's required the first time; on
        later saves, omit it to keep the stored secret.


        **Auth:** session. **Permission:** `manage_sso`.
      operationId: putSsoConfig
      parameters:
        - name: orgId
          in: path
          required: true
          description: Organization id.
          schema:
            type: string
            format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - okta_domain
                - client_id
              properties:
                okta_domain:
                  type: string
                  description: Your Okta domain, for example `yourcompany.okta.com`.
                client_id:
                  type: string
                client_secret:
                  type: string
                  description: Required when no configuration exists yet.
                default_role:
                  type: string
                  enum:
                    - admin
                    - member
                    - viewer
                  default: member
                  description: Role for users whose Okta groups match no mapping.
                group_role_mapping:
                  type: object
                  additionalProperties:
                    type: string
                  description: Okta group name to role.
                enforced:
                  type: boolean
                  default: false
                  description: When true, members must sign in through Okta.
      responses:
        '200':
          description: Saved.
          content:
            application/json:
              schema:
                type: object
                required:
                  - data
                properties:
                  data:
                    type: object
                    properties:
                      id:
                        type: string
                        format: uuid
        '400':
          description: >-
            Missing domain or client ID, invalid default role, invalid mapping,
            or missing client secret (`VALIDATION_ERROR`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '401':
          description: Not signed in (`UNAUTHORIZED`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: >-
            Not a member of the organization, or missing the required permission
            (`FORBIDDEN`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '500':
          description: Unexpected server error (`INTERNAL_ERROR`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - session: []
components:
  schemas:
    ErrorEnvelope:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
              description: Stable machine-readable code. Branch on this, not on `message`.
              examples:
                - VALIDATION_ERROR
            message:
              type: string
              description: Human-readable description. May change.
            details:
              type: object
              additionalProperties: true
              description: Extra context; often empty.
  securitySchemes:
    session:
      type: apiKey
      in: cookie
      name: session
      description: >-
        The session cookie set when you sign in to AgentHub or ModelHub in a
        browser. The cookie name shown here is illustrative. There are no API
        tokens for these endpoints.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.