# SSO-Verbindung konfigurieren

`PUT https://{tenant}.stamp.eu/rest/sso/connections/{provider}`

Idempotent upsert — always 200, also on the first write, so the admin
screen has one status code to handle.

## Pfadparameter

| Name | Typ | Pflicht |
| --- | --- | --- |
| `provider` | string | ja |

## Request-Body

| Feld | Typ | Pflicht | Beschreibung |
| --- | --- | --- | --- |
| `enabled` | boolean | nein |  |
| `entra_tenant_id` | string | nein | Entra cannot federate without the directory id; Google has no directory id at all. |
| `allow_guest_accounts` | string | nein |  |
| `allowed_domains` | string[] \| null | nein | An empty list means "any Google account with a verified  address"; a filled one pins the `hd` claim. |

## Antworten

### 200: `SsoConnectionResource`

| Feld | Typ | Pflicht |
| --- | --- | --- |
| `data` | object | ja |
| `data.id` | string \| null | ja |
| `data.provider` | string | ja |
| `data.configured` | boolean | ja |
| `data.entra_tenant_id` | string \| null | ja |
| `data.allowed_domains` | string[] | ja |
| `data.enabled` | boolean | ja |
| `data.allow_guest_accounts` | boolean | ja |
| `data.has_custom_app` | boolean | ja |
| `data.usable` | boolean | ja |
| `data.requires_admin_consent` | boolean | ja |
| `data.consent_granted_at` | string \| null | ja |
| `data.last_login_at` | string \| null | ja |
| `data.last_error` | string \| null | ja |
| `data.redirect_uri` | string | ja |
| `data.updated_at` | string \| null | ja |

### 401: Unauthenticated

| Feld | Typ | Pflicht | Beschreibung |
| --- | --- | --- | --- |
| `message` | string | ja | Error overview. |

### 422: Validation error

| Feld | Typ | Pflicht | Beschreibung |
| --- | --- | --- | --- |
| `message` | string | ja | Errors overview. |
| `errors` | object | ja | A detailed description of each field that failed validation. |