> ## Documentation Index > Fetch the complete documentation index at: https://docs.prisme.ai/llms.txt > Use this file to discover all available pages before exploring further. # Rotate SAML Signing Certificate > Generate a new key pair and self-signed certificate used to sign the AuthnRequests of a SAML provider. Requires a stored signing key (400 otherwise) and leaves signAuthnRequests unchanged. The previous certificate stops working as soon as this returns, so the new one must be registered on the IdP. ## OpenAPI ````yaml /api-reference/swagger.yml post /v2/orgs/{orgSlug}/auth/sso/{slug}/saml/signing-cert openapi: 3.0.0 info: version: 1.0.0 title: Prisme.ai APIs description: Prisme.ai APIs specifications termsOfService: https://www.prisme.ai/mentions-legales contact: name: Prisme.ai Support Team email: support@prisme.ai url: https://www.prisme.ai license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0.html servers: - url: https://api.studio.prisme.ai description: Prisme.ai Cloud - url: https://{customDomain} description: Self-hosted Prisme.ai instance variables: customDomain: default: api.your-prisme-instance.com description: API hostname of your self-hosted Prisme.ai deployment - url: http://localhost:3001 description: Local development security: - BearerAuth: [] - OrgApiKeyAuth: [] - BearerAuth: [] OrgApiKeyAuth: [] tags: - name: API Gateway description: >- Authentication, session management, SSO providers, and user profile endpoints. - name: Prisme.ai Workspaces description: >- CRUD operations for workspaces and their resources (pages, apps, automations, imports, variables). - name: Prisme.ai Runtime description: Execute workspace automations and manage their runtime lifecycle. - name: Prisme.ai Events description: Event ingestion, delivery, and subscription filtering across the platform. - name: Organizations description: >- Manage organizations, members, roles, invites, groups, and org-level service accounts. - name: Subscriptions description: >- Manage organization subscription plans and tier assignments (SuperAdmin only). - name: Secrets description: Read and patch encrypted key-value secrets scoped to a workspace. - name: ApiKeys description: Create, list, rotate, and validate workspace-scoped API keys. - name: Permissions description: >- Share or unshare resources (workspaces, pages, …) with users via roles or fine-grained rules. - name: Monitoring description: Platform readiness checks across services (SuperAdmin only). - name: AuthProviders - name: OIDC description: >- Endpoints of the embedded OpenID Connect provider, mounted under /oidc. The protocol endpoints follow OpenID Connect Core / OAuth 2.0 and are best resolved from GET /oidc/.well-known/openid-configuration; the /oidc/interaction/* routes are Prisme.ai-specific and covered by no standard. paths: /v2/orgs/{orgSlug}/auth/sso/{slug}/saml/signing-cert: post: tags: - API Gateway summary: Rotate SAML Signing Certificate description: >- Generate a new key pair and self-signed certificate used to sign the AuthnRequests of a SAML provider. Requires a stored signing key (400 otherwise) and leaves signAuthnRequests unchanged. The previous certificate stops working as soon as this returns, so the new one must be registered on the IdP. operationId: rotateSamlSigningCert parameters: - name: orgSlug in: path description: Organization slug required: true schema: type: string - name: slug in: path description: Provider slug required: true schema: type: string responses: '200': description: Success Response content: application/json: schema: $ref: '#/components/schemas/AuthProvider' '400': description: Bad parameters content: application/json: schema: $ref: '#/components/schemas/BadParametersError' '401': description: AuthenticationError content: application/json: schema: $ref: '#/components/schemas/AuthenticationError' '403': description: >- The provider is declared in the configuration file and cannot be updated via API content: application/json: schema: $ref: '#/components/schemas/ForbiddenError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ObjectNotFoundError' components: schemas: AuthProvider: type: object required: - slug - type - config properties: id: type: string slug: type: string description: Unique provider identifier (e.g. "google", "okta-saml") name: type: string description: Display name for the provider (e.g. "Google", "Corporate SSO") icon: type: string description: Icon URL or identifier for the provider type: $ref: '#/components/schemas/AuthProviderType' description: Authentication protocol type config: type: object additionalProperties: true description: Provider-specific configuration (OIDC or SAML settings) anyOf: - $ref: '#/components/schemas/AuthProviderOidcConfig' - $ref: '#/components/schemas/AuthProviderSamlConfig' attributesMapping: type: object additionalProperties: type: string properties: firstName: type: string lastName: type: string email: type: string description: Maps provider claims to user fields (e.g. firstName, email) source: type: string enum: - file - database description: Where this provider is configured (read-only, returned by GET) enabled: type: boolean description: >- Whether this provider is active (default true). Disabled providers are not registered as passport strategies. meta: type: object additionalProperties: true description: Free-form metadata JSON domains: type: array items: type: string description: Associated domain names orgSlug: type: string description: Associated organization slug BadParametersError: type: object properties: error: type: string example: BadParameters message: type: string details: {} AuthenticationError: type: object properties: error: type: string example: AuthenticationError message: type: string example: Unauthenticated ForbiddenError: type: object properties: error: type: string example: ForbiddenError message: type: string example: Forbidden ObjectNotFoundError: type: object properties: error: type: string example: ObjectNotFound message: type: string AuthProviderType: type: string enum: - oidc - saml AuthProviderOidcConfig: type: object required: - client_id - authorization_endpoint - token_endpoint - jwks_uri properties: client_id: type: string client_secret: type: string authorization_endpoint: type: string token_endpoint: type: string scopes: type: array items: type: string state: type: boolean jwks_uri: type: string userinfo_endpoint: type: string description: >- Optional OIDC userinfo endpoint. When set, it is called with the access token right after the code exchange, and its claims fill the gaps left by the id_token — for IdPs that expose profile attributes (name, email, …) only there. id_token claims always win on conflict, since only those are signature-verified. Pair with `attributesMapping` when the IdP uses non-standard claim names. pkce: type: boolean issuer: type: string description: >- Expected `iss` claim of tokens issued by this provider. Required when `allowTokenExchange` is true — critical for IdPs whose `jwks_uri` is shared across tenants (Entra ID `common`, Google, …), where the `iss` claim is the only field discriminating our tenant from any other tenant of the same IdP. allowTokenExchange: type: boolean description: >- Opt-in flag. When true, an id_token issued by this provider can be exchanged for a Prisme access token via POST /v2/login/token-exchange (no browser redirect). Defaults to false. Requires `issuer` to be set. tokenExchangeAudiences: type: array items: type: string description: >- Accepted `aud` claim value(s) for id_tokens presented via POST /v2/login/token-exchange. Typically the `client_id` of the native/mobile/headless app registration(s), which is distinct from the web `client_id` used for the browser redirect flow. Defaults to `[client_id]` when omitted — matches only tokens minted for the same OAuth client as the web flow. AuthProviderSamlConfig: type: object properties: idp_metadata_filepath: type: string description: Absolute path to the SAML XML config file in the container idp_metadata_xml: type: string description: Raw SAML XML config issuer: type: string description: Required audience: type: string description: Required, should match issuer skipRequestCompression: type: boolean wantAuthnResponseSigned: type: boolean identifierFormat: type: string description: >- Required if neither idp_metadata_xml or idp_metadata_filepath are configured identityProviderUrl: type: string description: >- Required if neither idp_metadata_xml or idp_metadata_filepath are configured entryPoint: type: string description: >- Required if neither idp_metadata_xml or idp_metadata_filepath are configured logoutUrl: type: string idpCert: type: string description: >- Required if neither idp_metadata_xml or idp_metadata_filepath are configured signAuthnRequests: type: boolean description: >- Sign the AuthnRequests sent to the IdP (required by IdPs with WantAuthnRequestsSigned). Requests are signed only when true. When true and no privateKey is stored yet, a key pair and a self-signed certificate are generated on save. privateKey: type: string nullable: true writeOnly: true description: >- PEM RSA private key used to sign AuthnRequests. Never returned by the API: omit it on update to keep the stored key, send null to remove it. publicCert: type: string description: >- PEM X.509 certificate matching privateKey, to register on the IdP. Required with a privateKey you provide; generated along with the key otherwise. signatureAlgorithm: type: string enum: - sha256 - sha512 description: >- AuthnRequest signature algorithm. Defaults to sha256 when a privateKey is set. hasPrivateKey: type: boolean description: >- Read-only, ignored on write: true when a signing private key is stored signingCertExpiresAt: type: string format: date-time description: 'Read-only, ignored on write: expiration date of publicCert' securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT OrgApiKeyAuth: type: apiKey in: header name: x-prismeai-api-key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.