Create a SAML group mapping

POST

/api/admin/saml/group-mappings

Maintainer:Not configured

OperationId:admin_create_saml_group_mapping

Maps a group the IdP asserts to a role on a team: at each login, the IdP reconcile gives everyone in the group that role. The ceiling is maintainer. Onto temper-system or the gating team, only watcher is accepted, with or without confirm_elevated (a higher role there is a system admin's native act, and the reconcile clamps any such row to watcher). Elsewhere an owner role, or an owner, maintainer or member role onto a team with the gating team or an auto-join team (live or deleted) beneath it, needs confirm_elevated: true (a watcher mapping never does); without it the request is refused, naming why, and nothing is written. Recorded as saml_group_mapping_changed. The same mapping again records nothing and answers created: false. Requires a system admin.

Request

Authorization

JWT Bearer

Add the parameter

Authorization

to Headers

Example:

Authorization: ********************

Header Params

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

Created, or already so

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

🟠404Record Not Found

🟠409

🟠422Parameter Error

Request Example

Shell

JavaScript

Java

Swift

curl --location '/api/admin/saml/group-mappings' \
--header 'X-Temper-Surface;' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "confirm_elevated": true,
    "group": "string",
    "idp_key": "string",
    "role": "owner",
    "team_id": "810007d0-bec5-486c-b5d1-28fcd8a079ba"
}'

Response Example

200 - Example 1

{
    "confirmed": true,
    "created": true,
    "mapping": {
        "group": "string",
        "idp_key": "string",
        "role": "owner",
        "team_id": "810007d0-bec5-486c-b5d1-28fcd8a079ba"
    }
}

Modified at 2026-11-12 15:20:23

Set an erasure retention policy

Rebind a machine client to a new client ID