> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Update SAML Connection

> Update a SAML SSO connection using the Stytch React SDK

export const action_0 = "update";

export const resource_0 = "stytch.sso";

export const organization = "Represents an instance or tenant in your application, typically mapping to each of your top-level customers.";

export const member = "Represents an individual end user's account within a given Organization, uniquely identified within that Organization by their email address.";

`sso.saml.updateConnection` wraps the [Update SAML Connection](/api-reference/b2b/api/sso/saml/update-saml-connection) API endpoint. The `organization_id` will be automatically inferred from the logged-in <Tooltip tip={member}>Member's</Tooltip> session. This method cannot be used to update SAML connections in other <Tooltip tip={organization}>Organizations</Tooltip>.

<Note>
  **RBAC Enforced Method**

  This method requires a valid Session for a member with permission to perform the **{action_0} Action** on the **{resource_0} Resource**.

  Before using this method, enable **Member actions & organization modifications** in the [Frontend SDK page](https://stytch.com/dashboard/sdk-configuration). To learn more, see our [RBAC guide](/multi-tenant-auth/enterprise-ready/rbac/create-rbac-policy).
</Note>

## Parameters

<ParamField path="connection_id" type="string" required>
  Globally unique UUID that identifies a specific SSO `connection_id` for a Member.
</ParamField>

<ParamField path="identity_provider" type="string" required>
  Name of the IdP. Enum with possible values: `classlink`, `cyberark`, `duo`, `google-workspace`, `jumpcloud`, `keycloak`, `miniorange`, `microsoft-entra`, `okta`, `onelogin`, `pingfederate`, `rippling`, `salesforce`, `shibboleth`, or `generic`.

  Specifying a known provider allows Stytch to handle any provider-specific logic.
</ParamField>

<ParamField path="idp_entity_id" type="string" required>
  A globally unique name for the IdP. This will be provided by the IdP.
</ParamField>

A globally unique name for the IdP. This will be provided by the IdP.

<ParamField path="display_name" type="string" required>
  A human-readable display name for the connection.
</ParamField>

<ParamField path="attribute_mapping" type="object">
  An object that represents the attributes used to identify a Member. This object will map the IdP-defined User attributes to Stytch-specific values. Required attributes: `email` and one of `full_name` or `first_name` and `last_name`.
</ParamField>

<ParamField path="idp_sso_url" type="string" required>
  The URL for which assertions for login requests will be sent. This will be provided by the IdP.
</ParamField>

<ParamField path="x509_certificate" type="string" required>
  A certificate that Stytch will use to verify the sign-in assertion sent by the IdP, in [PEM](https://en.wikipedia.org/wiki/Privacy-Enhanced%5FMail) format.
</ParamField>

<ParamField path="saml_connection_implicit_role_assignments" type="array" required>
  An array of implicit role assignments granted to members in this organization who log in with this SAML connection. See our [RBAC guide](/multi-tenant-auth/enterprise-ready/rbac/saml) for more information about role assignment.

  <Expandable title="properties">
    <ParamField path="role_id" type="string" required>
      The unique identifier of the RBAC Role, provided by the developer and intended to be human-readable.
    </ParamField>
  </Expandable>
</ParamField>

<ParamField path="saml_group_implicit_role_assignments" type="array" required>
  An array of implicit role assignments granted to members in this organization who log in with this SAML connection and belong to the specified group. Before adding any group implicit role assignments, you must add a `groups` key to your SAML connection's `attribute_mapping`. Make sure that your IdP is configured to correctly send the group information. See our [RBAC guide](/multi-tenant-auth/enterprise-ready/rbac/saml) for more information about role assignment.

  <Expandable title="properties">
    <ParamField path="role_id" type="string" required>
      The unique identifier of the RBAC Role, provided by the developer and intended to be human-readable.
    </ParamField>

    <ParamField path="group" type="string" required>
      The name of the group that grants the specified role assignment.
    </ParamField>
  </Expandable>
</ParamField>

<ParamField path="saml_encryption_private_key" type="string" required>
  A PKCS1 format RSA private key used to decrypt encrypted SAML assertions. Only PKCS1 format (starting with `-----BEGIN RSA PRIVATE KEY-----`) is supported.
</ParamField>

<ParamField path="signing_private_key" type="string" required>
  A private key in PEM format that Stytch will use to decrypt encrypted SAML assertions.
</ParamField>

## Response

<ResponseField name="connection" type="object">
  The [SAML Connection object](/api-reference/b2b/api/sso/saml-connection-object) updated by this API call.
</ResponseField>

<ResponseField name="request_id" type="string">
  Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we
  may ask for this value to help identify a specific API call when helping you debug an issue.
</ResponseField>

<ResponseField name="status_code" type="number">
  The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values
  equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
</ResponseField>

<Panel>
  <RequestExample>
    ```jsx theme={null}
    import { useStytchB2BClient } from '@stytch/react/b2b';

    export const UpdateSAMLConnection = () => {
      const stytch = useStytchB2BClient();

      const updateConnection = async () => {
        const response = await stytch.sso.saml.updateConnection({
          connection_id: 'saml-connection-test-d89ff7a0-e86f-4b4d-b6a3-9a74d967528e',
          display_name: 'Updated SAML Connection',
          identity_provider: 'okta',
          idp_entity_id: 'https://idp.example.com/entity',
          idp_sso_url: 'https://idp.example.com/sso',
          x509_certificate: '-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----',
        });
        console.log('Updated connection:', response.connection);
      };

      return <button onClick={updateConnection}>Update SAML Connection</button>;
    };
    ```
  </RequestExample>
</Panel>