# Manage & Operate › Identity & Access Management › Identities › SSO API

> Part of the OVHcloud developer hub. Index of every page and section: https://developers.eu.ovhcloud.com/llms.txt
> The Manage & Operate product's sections: https://developers.eu.ovhcloud.com/reference/manage-operate/llms.txt
> Everything in one file: https://developers.eu.ovhcloud.com/llms-full.txt

> 4 operations of the OVHcloud API. Calls carry `authorization: Bearer $OVH_TOKEN`; the EU host is shown, Canada and the United States answer on api.ca.ovhcloud.com and api.us.ovhcloud.com.

Page: https://developers.eu.ovhcloud.com/reference/manage-operate/identity-access-management/identities/sso/

OpenAPI v1: https://api.eu.ovhcloud.com/1.0/__schemas/developer-hub-navigation/manage-operate/identity-access-management/identities/sso.json?format=openapi3
OpenAPI v2: https://api.eu.ovhcloud.com/v2/__schemas/developer-hub-navigation/manage-operate/identity-access-management/identities/sso.json?format=openapi3

## Operations

- `GET /me/identity/provider` — Get the identity provider linked to this account
- `POST /me/identity/provider` — Define an identity provider (SAML 2.0)
- `PUT /me/identity/provider` — Alter the provider
- `DELETE /me/identity/provider` — Remove the identity provider

## Get the identity provider linked to this account

`GET /1.0/me/identity/provider`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/identity-access-management/identities/sso/#get-me-identity-provider

**Status:** Stable production version  
**IAM actions:** `account:apiovh:me/identity/provider/get`

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | auth.Provider | successful operation |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `creation` | string (date-time) | read-only | Creation date of the identity provider |
| `disableUsers` | boolean |  | Whether account users should still be usable as a login method or not |
| `extensions` | auth.ProviderExtensions |  | SAML Extensions to embed inside the SAML requests |
| `extensions.requestedAttributes` | auth.ProviderRequestedAttributes[] |  | List of SAML RequestedAttribute to add to SAML requests |
| `extensions.requestedAttributes[].isRequired` | boolean | yes | Expresses that this RequestedAttribute is mandatory (remains advisory) |
| `extensions.requestedAttributes[].name` | string | yes | Name of the SAML RequestedAttribute |
| `extensions.requestedAttributes[].nameFormat` | string |  | NameFormat of the SAML RequestedAttribute |
| `extensions.requestedAttributes[].values` | string[] |  | List of AttributeValues allowed for this RequestedAttribute |
| `groupAttributeName` | string |  | SAML Group attribute name |
| `idpSigningCertificates` | auth.Certificate[] | read-only | IdP's signing certificate |
| `idpSigningCertificates[].expiration` | string (date-time) | read-only | Certificate's expiration |
| `idpSigningCertificates[].subject` | string | read-only | Certificate's subject |
| `lastUpdate` | string (date-time) | read-only | Last update of the identity provider |
| `signRequests` | boolean |  | Whether SAML Authn Requests should be signed |
| `ssoServiceUrl` | string | read-only | IdP's Single Sign On Service Url |
| `userAttributeName` | string |  | SAML User attribute name |

```json
{
  "creation": "2024-01-01T12:00:00Z",
  "disableUsers": true,
  "extensions": {
    "requestedAttributes": [
      {
        "isRequired": true,
        "name": "string",
        "nameFormat": "string",
        "values": [
          "string"
        ]
      }
    ]
  },
  "groupAttributeName": "string",
  "idpSigningCertificates": [
    {
      "expiration": "2024-01-01T12:00:00Z",
      "subject": "string"
    }
  ],
  "lastUpdate": "2024-01-01T12:00:00Z",
  "signRequests": true,
  "ssoServiceUrl": "string",
  "userAttributeName": "string"
}
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/1.0/me/identity/provider" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/me/identity/provider")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/me/identity/provider");

print_r($result);
?>
```

## Define an identity provider (SAML 2.0)

`POST /1.0/me/identity/provider`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/identity-access-management/identities/sso/#post-me-identity-provider

**Status:** Stable production version  
**IAM actions:** `account:apiovh:me/identity/provider/create`

### Request body (required)

Type: `auth.ProviderRequest`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `disableUsers` | boolean |  | Whether account users should still be usable as a login method or not |
| `extensions` | auth.ProviderExtensions |  | SAML Extensions to embed inside the SAML requests |
| `extensions.requestedAttributes` | auth.ProviderRequestedAttributes[] |  | List of SAML RequestedAttribute to add to SAML requests |
| `extensions.requestedAttributes[].isRequired` | boolean | yes | Expresses that this RequestedAttribute is mandatory (remains advisory) |
| `extensions.requestedAttributes[].name` | string | yes | Name of the SAML RequestedAttribute |
| `extensions.requestedAttributes[].nameFormat` | string |  | NameFormat of the SAML RequestedAttribute |
| `extensions.requestedAttributes[].values` | string[] |  | List of AttributeValues allowed for this RequestedAttribute |
| `groupAttributeName` | string |  | SAML Group attribute name |
| `metadata` | string | yes | IdP's signing certificate |
| `signRequests` | boolean |  | Whether SAML Authn Requests should be signed |
| `userAttributeName` | string |  | SAML User attribute name |

```json
{
  "disableUsers": true,
  "extensions": {
    "requestedAttributes": [
      {
        "isRequired": true,
        "name": "string",
        "nameFormat": "string",
        "values": [
          "string"
        ]
      }
    ]
  },
  "groupAttributeName": "string",
  "metadata": "string",
  "signRequests": true,
  "userAttributeName": "string"
}
```

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | auth.Provider | successful operation |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `creation` | string (date-time) | read-only | Creation date of the identity provider |
| `disableUsers` | boolean |  | Whether account users should still be usable as a login method or not |
| `extensions` | auth.ProviderExtensions |  | SAML Extensions to embed inside the SAML requests |
| `extensions.requestedAttributes` | auth.ProviderRequestedAttributes[] |  | List of SAML RequestedAttribute to add to SAML requests |
| `extensions.requestedAttributes[].isRequired` | boolean | yes | Expresses that this RequestedAttribute is mandatory (remains advisory) |
| `extensions.requestedAttributes[].name` | string | yes | Name of the SAML RequestedAttribute |
| `extensions.requestedAttributes[].nameFormat` | string |  | NameFormat of the SAML RequestedAttribute |
| `extensions.requestedAttributes[].values` | string[] |  | List of AttributeValues allowed for this RequestedAttribute |
| `groupAttributeName` | string |  | SAML Group attribute name |
| `idpSigningCertificates` | auth.Certificate[] | read-only | IdP's signing certificate |
| `idpSigningCertificates[].expiration` | string (date-time) | read-only | Certificate's expiration |
| `idpSigningCertificates[].subject` | string | read-only | Certificate's subject |
| `lastUpdate` | string (date-time) | read-only | Last update of the identity provider |
| `signRequests` | boolean |  | Whether SAML Authn Requests should be signed |
| `ssoServiceUrl` | string | read-only | IdP's Single Sign On Service Url |
| `userAttributeName` | string |  | SAML User attribute name |

```json
{
  "creation": "2024-01-01T12:00:00Z",
  "disableUsers": true,
  "extensions": {
    "requestedAttributes": [
      {
        "isRequired": true,
        "name": "string",
        "nameFormat": "string",
        "values": [
          "string"
        ]
      }
    ]
  },
  "groupAttributeName": "string",
  "idpSigningCertificates": [
    {
      "expiration": "2024-01-01T12:00:00Z",
      "subject": "string"
    }
  ],
  "lastUpdate": "2024-01-01T12:00:00Z",
  "signRequests": true,
  "ssoServiceUrl": "string",
  "userAttributeName": "string"
}
```

### Example

```bash
curl -X POST \
  "https://api.eu.ovhcloud.com/1.0/me/identity/provider" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN" \
  -H "content-type: application/json" \
  -d '{ }'
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

# Request body type: auth.ProviderRequest
result = client.post("/me/identity/provider",
	disableUsers = None, # Whether account users should still be usable as a login method or not (type: boolean, nullable)
	extensions = None, # SAML Extensions to embed inside the SAML requests (type: auth.ProviderExtensions)
	groupAttributeName = None, # SAML Group attribute name (type: string, nullable)
	metadata = None, # IdP's signing certificate (type: string)
	signRequests = None, # Whether SAML Authn Requests should be signed (type: boolean, nullable)
	userAttributeName = None, # SAML User attribute name (type: string, nullable)
)

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

// Request body type: auth.ProviderRequest
$result = $ovh->post("/me/identity/provider", array(
	disableUsers => null, // Whether account users should still be usable as a login method or not (type: boolean, nullable)
	extensions => null, // SAML Extensions to embed inside the SAML requests (type: auth.ProviderExtensions)
	groupAttributeName => null, // SAML Group attribute name (type: string, nullable)
	metadata => null, // IdP's signing certificate (type: string)
	signRequests => null, // Whether SAML Authn Requests should be signed (type: boolean, nullable)
	userAttributeName => null, // SAML User attribute name (type: string, nullable)
));

print_r($result);
?>
```

## Alter the provider

`PUT /1.0/me/identity/provider`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/identity-access-management/identities/sso/#put-me-identity-provider

**Status:** Stable production version  
**IAM actions:** `account:apiovh:me/identity/provider/edit`

### Request body (required)

Type: `auth.Provider`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `creation` | string (date-time) | read-only | Creation date of the identity provider |
| `disableUsers` | boolean |  | Whether account users should still be usable as a login method or not |
| `extensions` | auth.ProviderExtensions |  | SAML Extensions to embed inside the SAML requests |
| `extensions.requestedAttributes` | auth.ProviderRequestedAttributes[] |  | List of SAML RequestedAttribute to add to SAML requests |
| `extensions.requestedAttributes[].isRequired` | boolean | yes | Expresses that this RequestedAttribute is mandatory (remains advisory) |
| `extensions.requestedAttributes[].name` | string | yes | Name of the SAML RequestedAttribute |
| `extensions.requestedAttributes[].nameFormat` | string |  | NameFormat of the SAML RequestedAttribute |
| `extensions.requestedAttributes[].values` | string[] |  | List of AttributeValues allowed for this RequestedAttribute |
| `groupAttributeName` | string |  | SAML Group attribute name |
| `idpSigningCertificates` | auth.Certificate[] | read-only | IdP's signing certificate |
| `idpSigningCertificates[].expiration` | string (date-time) | read-only | Certificate's expiration |
| `idpSigningCertificates[].subject` | string | read-only | Certificate's subject |
| `lastUpdate` | string (date-time) | read-only | Last update of the identity provider |
| `signRequests` | boolean |  | Whether SAML Authn Requests should be signed |
| `ssoServiceUrl` | string | read-only | IdP's Single Sign On Service Url |
| `userAttributeName` | string |  | SAML User attribute name |

```json
{
  "disableUsers": true,
  "extensions": {
    "requestedAttributes": [
      {
        "isRequired": true,
        "name": "string",
        "nameFormat": "string",
        "values": [
          "string"
        ]
      }
    ]
  },
  "groupAttributeName": "string",
  "signRequests": true,
  "userAttributeName": "string"
}
```

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | — | successful operation |

### Example

```bash
curl -X PUT \
  "https://api.eu.ovhcloud.com/1.0/me/identity/provider" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN" \
  -H "content-type: application/json" \
  -d '{ }'
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

# Request body type: auth.Provider
result = client.put("/me/identity/provider",
	disableUsers = None, # Whether account users should still be usable as a login method or not (type: boolean, nullable)
	extensions = None, # SAML Extensions to embed inside the SAML requests (type: auth.ProviderExtensions)
	groupAttributeName = None, # SAML Group attribute name (type: string)
	signRequests = None, # Whether SAML Authn Requests should be signed (type: boolean, nullable)
	userAttributeName = None, # SAML User attribute name (type: string)
)

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

// Request body type: auth.Provider
$result = $ovh->put("/me/identity/provider", array(
	disableUsers => null, // Whether account users should still be usable as a login method or not (type: boolean, nullable)
	extensions => null, // SAML Extensions to embed inside the SAML requests (type: auth.ProviderExtensions)
	groupAttributeName => null, // SAML Group attribute name (type: string)
	signRequests => null, // Whether SAML Authn Requests should be signed (type: boolean, nullable)
	userAttributeName => null, // SAML User attribute name (type: string)
));

print_r($result);
?>
```

## Remove the identity provider

`DELETE /1.0/me/identity/provider`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/identity-access-management/identities/sso/#delete-me-identity-provider

**Status:** Stable production version  
**IAM actions:** `account:apiovh:me/identity/provider/delete`

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | — | successful operation |

### Example

```bash
curl -X DELETE \
  "https://api.eu.ovhcloud.com/1.0/me/identity/provider" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.delete("/me/identity/provider")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->delete("/me/identity/provider");

print_r($result);
?>
```