Update the OIDC broker configuration

put

https://yourServer.jamfcloud.com/api/v3/sso/oidc-broker-config

Full-replacement update of the tenant's selected broker configuration's contents on the
remote authentication service. Omit clientSecret/privateKeyJwt to keep the currently
stored value; supply either to rotate it — except when this request changes
clientAuthMethod, which requires the new method's credential to be supplied, because the
authentication service clears the credential belonging to the method being left. The
configuration is always written as an ADMIN_SSO capability, CONFIDENTIAL client; neither
value is settable through this request.

📋
Required privilege: Update SSO Settings

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

Full-replacement update of the tenant's broker IdP configuration. The config to update is the tenant's stored broker selection; it is not part of this body. Every non-secret field is replaced with the value sent here, so all of them must be supplied on every update; only the secret fields are kept when omitted — except when this request changes clientAuthMethod, which requires the new method's credential to be supplied. The clientType (always CONFIDENTIAL) is set by Jamf Pro, and the capabilities and redirect URIs are carried over from the stored configuration unchanged; none of the three can be supplied here.

clientAuthMethod

string

enum

required

Selects which credential the authentication service stores and which it clears — the credential belonging to the other method is discarded. Changing this value therefore requires the new method's credential in the same request.

Allowed:

productUsernameClaim

string

productUserMapping

string

enum

required

Allowed:

discoveryUrl

string

required

clientId

string

required

scopes

array of strings

required

length ≥ 1

scopes*

clientSecret

password

Omit to keep the currently stored secret; supply to rotate it. Required when this request changes clientAuthMethod to CLIENT_SECRET, or when clientAuthMethod is CLIENT_SECRET and no secret is currently stored.

privateKeyJwt

password

Omit to keep the currently stored key; supply to rotate it. Required when this request changes clientAuthMethod to PRIVATE_KEY_JWT, or when clientAuthMethod is PRIVATE_KEY_JWT and no key is currently stored.

enabled

boolean

required

Required. The authentication service replaces this value on every update, so omitting it would silently re-enable a disabled configuration.

Responses

204

The broker configuration was updated.

Language

Credentials

Loading…

Response

Choose an example:

application/json

400Bad Request. No broker configuration UUID is stored for this tenant; the request changes clientAuthMethod without supplying the credential the new method requires; a required field is missing or invalid; or the authentication service rejected the submitted configuration.

404Not Found. The authentication service no longer holds the broker configuration stored for this tenant.

503Service Unavailable. The update could not be attempted or completed — either a prerequisite is unavailable (the OIDC identity provider configuration feature is disabled, or machine-to-machine credentials are not configured) or the authentication service could not be reached.