> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML Identity Providers

> Manage account-scoped SAML single sign-on configurations and their role mappings programmatically with Enterprise account-admin access.

> [!NOTE]
>
> The `saml_identity_providers` client methods are currently in **ALPHA**. The API may change without notice. A one-time warning is emitted on first use.

Manage SAML single sign-on configurations for your account. A configuration pairs one metadata source (an IdP metadata URL or inline XML) with a set of email domains and login defaults, and carries an ordered list of role mappings that translate SAML assertion attributes into Arize roles. These operations require Enterprise account-admin access.

## Key Capabilities

* List SAML configurations with cursor-based pagination
* Create a configuration from a metadata URL or inline metadata XML
* Retrieve, update, and delete a configuration by ID
* List, add, update, and remove role mappings on a configuration

## Request Bodies

Create and update methods take a `body` argument that is either a typed request model (imported from `arize.saml_identity_providers.types`) or a plain JSON-compatible mapping with the same fields. Unknown keys in a mapping are rejected before the request is sent.

| Type alias | Used by |
| - | - |
| `CreateRequest` | `create` |
| `UpdateRequest` | `update` |
| `CreateMappingRequest` | `add_role_mapping` |
| `UpdateMappingRequest` | `update_role_mapping` |

## List SAML Identity Providers

List SAML configurations with cursor-based pagination (up to 100 per page). The returned summaries omit metadata and role mappings — use `get` for the full configuration.

```python theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
resp = client.saml_identity_providers.list(limit=50)

for idp in resp.data:
    print(idp.id, idp.email_domains, idp.enforce_saml)
```

For details on pagination, field introspection, and data conversion (to dict/JSON/DataFrame), see [Response Objects](/docs/api-clients/python/version-8/overview.md#response-objects).

## Create a SAML Identity Provider

Create a configuration with exactly one metadata source (`metadata_url` or `metadata_xml`) and valid login defaults. Domain-verification flags are read-only and cannot be supplied. Non-empty space or project assignments require an organization.

```python theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
from arize.saml_identity_providers.types import CreateRequest

idp = client.saml_identity_providers.create(
    body=CreateRequest(
        email_domains=["example.com"],
        metadata_url="https://idp.example.com/metadata.xml",
        enforce_saml=False,
        sync_user_roles=True,
        sign_authn=True,
        allow_login_with_defaults=True,
        default_organization_id="your-org-id",        # optional
        default_organization_role_id="your-role-id",  # optional
    ),
)

print(idp.id)
```

The `body` may also be a plain mapping with the same fields:

```python theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
idp = client.saml_identity_providers.create(
    body={
        "email_domains": ["example.com"],
        "metadata_xml": "<EntityDescriptor>...</EntityDescriptor>",
        "enforce_saml": False,
        "sync_user_roles": True,
        "sign_authn": True,
        "allow_login_with_defaults": True,
    },
)
```

## Get a SAML Identity Provider

Retrieve a complete configuration by ID, including file-managed configurations.

```python theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
idp = client.saml_identity_providers.get(idp_id="your-idp-id")

print(idp.id, idp.email_domains)
print(idp.role_mappings)
```

## Update a SAML Identity Provider

Patch only the fields you supply; omitted fields are left unchanged. Omission, `False`, `None`, and empty lists stay distinct. Setting `allow_login_with_defaults` to `False` clears all default fields.

```python theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
from arize.saml_identity_providers.types import UpdateRequest

idp = client.saml_identity_providers.update(
    idp_id="your-idp-id",
    body=UpdateRequest(
        enforce_saml=True,
        email_domains=["example.com", "example.org"],
    ),
)

print(idp.enforce_saml)
```

## Delete a SAML Identity Provider

Remove a disabled configuration by ID. Users and their grants remain. Enforced and file-managed configurations cannot be deleted. There is no response from this call.

```python theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
client.saml_identity_providers.delete(idp_id="your-idp-id")

print("SAML identity provider deleted")
```

## Manage Role Mappings

Role mappings translate SAML assertion attributes into Arize roles. Each mapping matches a set of `attributes` and grants account-admin status, an organization role, and/or space and project roles.

### List Role Mappings

List a configuration's role mappings in configuration order, with cursor-based pagination (up to 100 per page).

```python theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
resp = client.saml_identity_providers.list_role_mappings(
    idp_id="your-idp-id",
    limit=50,
)

for mapping in resp.data:
    print(mapping.id, mapping.attributes, mapping.is_account_admin)
```

For details on pagination, field introspection, and data conversion (to dict/JSON/DataFrame), see [Response Objects](/docs/api-clients/python/version-8/overview.md#response-objects).

### Add a Role Mapping

Add a mapping to a configuration. The server assigns its persistent ID. Non-empty space or project assignments require an organization.

```python theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
from arize.saml_identity_providers.types import (
    CreateMappingRequest,
    OrganizationAssignment,
    SpaceAssignment,
)

mapping = client.saml_identity_providers.add_role_mapping(
    idp_id="your-idp-id",
    body=CreateMappingRequest(
        attributes={"group": "engineering"},
        is_account_admin=False,
        organization=OrganizationAssignment(
            organization_id="your-org-id",
            role_id="your-org-role-id",
        ),
        space_roles=[
            SpaceAssignment(space_id="your-space-id", role_id="your-space-role-id"),
        ],
    ),
)

print(mapping.id)
```

### Update a Role Mapping

Patch supplied fields while keeping the mapping ID. Omitted fields remain unchanged. `None` clears the organization only when the resulting mapping is valid; empty role lists clear assignments.

```python theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
from arize.saml_identity_providers.types import UpdateMappingRequest

mapping = client.saml_identity_providers.update_role_mapping(
    idp_id="your-idp-id",
    mapping_id="your-mapping-id",
    body=UpdateMappingRequest(
        is_account_admin=True,
    ),
)

print(mapping.id, mapping.is_account_admin)
```

### Remove a Role Mapping

Remove a mapping by ID. Required login and admin mappings are retained. There is no response from this call.

```python theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
client.saml_identity_providers.remove_role_mapping(
    idp_id="your-idp-id",
    mapping_id="your-mapping-id",
)

print("Role mapping removed")
```