# C1 documentation: API Endpoints SSO ## SSO - [List](https://www.c1.ai/docs/api-reference/sso/list.md): List returns the SSO applications configured for an application, one page at a time. - [Create](https://www.c1.ai/docs/api-reference/sso/create.md): Create an SSO application for an application in your catalog. The entitlement that governs sign-in is created alongside it. OIDC creation also server-mints the required initial client and returns its secret once when the client is confidential. SAML creation has no OAuth-client step. - [Get](https://www.c1.ai/docs/api-reference/sso/get.md): Get returns a single SSO application by app_id + id. - [Update](https://www.c1.ai/docs/api-reference/sso/update.md): Update changes an SSO application's mutable display, lifetime, enablement, OIDC claim/signing settings, or SAML endpoint/signing/encryption settings. Protocol, subject type, sector, SAML entity ID, and NameID format remain immutable; requests that would change them are rejected. - [Delete](https://www.c1.ai/docs/api-reference/sso/delete.md): Delete retires an SSO application and its sign-in entitlement, stopping OIDC and SAML sign-in through it. OAuth clients and locator bindings remain so administrators can list and delete retained clients; the bindings are inert while their parent application is deleted. - [List Clients](https://www.c1.ai/docs/api-reference/sso/list-clients.md): ListClients returns the App-owned OAuth clients minted for an OIDC application, one page at a time. Results hydrate from the PostgreSQL projection, so a newly created client may appear after a brief delay. - [Create Client](https://www.c1.ai/docs/api-reference/sso/create-client.md): CreateClient mints an additional App-owned OAuth client for an OIDC application. C1 generates the client ID and any confidential-client secret. - [Delete Client](https://www.c1.ai/docs/api-reference/sso/delete-client.md): DeleteClient deletes one App-owned OAuth client and its sign-in binding. - [Rotate Client Secret](https://www.c1.ai/docs/api-reference/sso/rotate-client-secret.md): RotateClientSecret replaces a confidential App-owned client's secret and returns the new value once. The old secret stops working immediately; for an overlap window, create a second client, migrate, then delete the first. Public clients have no secret to rotate. - [Update Client](https://www.c1.ai/docs/api-reference/sso/update-client.md): UpdateClient replaces mutable client configuration. The authentication method and generated ID are immutable; private-key JWKS may rotate and a legacy PKCE policy may tighten to required. - [List History](https://www.c1.ai/docs/api-reference/sso/list-history.md): ListHistory returns the change history (newest first) for a single SSO application — each entry is a snapshot plus who/when metadata. - [Batch Delete Subject Compatibility](https://www.c1.ai/docs/api-reference/sso/batch-delete-subject-compatibility.md): Deletes one bounded batch of compatibility bindings. Imported and user-attribute-derived bindings are recoverable so corrected source data can be applied on the next import or sign-in. Correct attribute source data before deleting its binding so a concurrent sign-in cannot recreate the stale val… - [Batch Import Subject Compatibility](https://www.c1.ai/docs/api-reference/sso/batch-import-subject-compatibility.md): Validates or imports one bounded batch of compatibility-subject bindings. Clients parse source files and submit at most 50 rows per request so they can expose progress and retry from a known boundary. - [Search](https://www.c1.ai/docs/api-reference/sso/search.md): Search SSO applications across the tenant. Supports filtering by the applications in your catalog and by display-name or description text. - [Get](https://www.c1.ai/docs/api-reference/sso/get-1.md): Get returns the tenant's SSO provider settings. - [Update](https://www.c1.ai/docs/api-reference/sso/update-1.md): Update changes the tenant's SSO provider settings. Supply the settings object and an update mask listing the fields to change; only masked fields are applied. Editable paths: enabled, default_subject_type, default_assertion_lifetime, default_id_token_signed_response_alg. - [List History](https://www.c1.ai/docs/api-reference/sso/list-history-1.md): ListHistory returns the SSO settings change history, newest first. - [Parse Saml Service Provider Metadata](https://www.c1.ai/docs/api-reference/sso/parse-saml-service-provider-metadata.md): ParseSAMLServiceProviderMetadata parses one uploaded SAML service-provider metadata document and returns the SAML configuration it implies, without creating or changing anything. The document is not stored. Use it to preview an SP's capabilities before creating a SAML application; edit the retur… ## OpenAPI Specs - [my-source-with-code-samples](https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples)