> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Create a SAML identity provider
> Warning: This API is alpha and can change without notice. Requires Enterprise account-admin access. Requests use the authenticated caller's account. File-managed configurations are read-only. Default login requires all four default fields. With default login disabled, supply initial role mappings and omit defaults. Domain verification flags are not accepted. Invalid metadata or an unreachable metadata URL returns 400.
## OpenAPI
````yaml https://api.arize.com/v2/spec.yaml post /v2/saml-identity-providers
openapi: 3.0.3
info:
title: Arize REST API
version: 2.0.0
description: |
API specification for the backend data server. The API is hosted globally
at https://api.arize.com/v2 or in your own environment.
license:
name: Apache-2.0
url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- description: Global
url: https://api.arize.com
- description: Regional
url: https://api.{region}.arize.com
variables:
region:
default: eu-west-1a
enum:
- eu-west-1a
- ca-central-1a
- description: Custom Host
url: https://{host}
variables:
host:
default: api.arize.com
security:
- bearerAuth: []
tags:
- name: AI Integrations
description: |
AI integrations configure access to external LLM providers (e.g. OpenAI,
Azure OpenAI, AWS Bedrock, Vertex AI). Integrations can be scoped to the
entire account, a specific organization, or a specific space.
- name: Alignment
description: >
Alignment measures agreement between evaluator labels and human
annotations.
Tasks define the dataset columns and comparison function. Runs record the
resulting score for a dataset version.
- name: Annotation Configs
description: >
Annotation configs allow you to define consistent annotation schemas that
can be reused across your workspace, ensuring evaluations are structured
and
comparable over time.
- name: Annotation Queues
description: >
Annotation queues help you organize and manage human evaluation workflows.
Use queues to assign spans or examples to annotators for review and
labeling.
- name: API Keys
description: >
API keys are used to authenticate requests to the Arize API. List your
keys
to view metadata; the raw secret is never returned after creation.
- name: Audit Logs
description: >
Audit logs record authenticated user actions within an account, providing
a
chronological trail for security and compliance review. Access requires
account admin privileges and audit logging to be enabled.
- name: Dashboards
description: >
Dashboards organize charts and summaries that help teams understand their
data.
- name: Datasets
description: |
Datasets are structured, version-controlled example collections you use to
run, evaluate, and track LLM experiments.
- name: Evaluators
description: >
Evaluators are reusable evaluation configurations used to assess the
quality
of LLM outputs. They can be template-based (using LLM judges) or
code-based.
- name: Experiments
description: >
Experiments let you systematically test prompt/model changes using
datasets,
tasks, and evaluators.
- name: Integrations
description: >
Integrations configure access to external LLM providers (e.g. OpenAI,
Azure OpenAI, AWS Bedrock, Vertex AI), notifications services (e.g.
PagerDuty, Slack), and
your own agents. Integrations can be scoped to the entire account, a
specific
organization, or a specific space.
- name: Monitors
description: >
Monitors continuously track a metric over your model or LLM application
data
and alert you when it crosses a threshold. Each monitor watches a single
metric - data quality, model performance, drift, a custom metric, or a
tracing metric - and moves between statuses as the metric passes in and
out of its
healthy range.
- name: Organizations
description: >
Organizations are top-level containers within an Arize AX account for
grouping spaces.
- name: Projects
description: |
Projects represent LLM applications being monitored in Arize where you can
observe traces and spans.
- name: Prompts
description: >
Prompts are reusable, versioned templates for LLM interactions. Use
prompts
to standardize and manage how you interact with LLMs across your
application.
- name: Resource Restrictions
description: |
Endpoints for restricting and unrestricting resources (projects, models).
- name: Role Bindings
description: |
Role bindings assign a role to a user on a resource. REST currently
supports space- and project-scoped bindings.
- name: Roles
description: >
Roles define sets of permissions that can be assigned to users within an
account. Create custom roles to tailor access control to your team's
needs.
- name: SAML
description: Enterprise account-admin SAML configuration and role mappings.
- name: Spaces
description: >
Spaces are containers within an organization for grouping related
projects,
datasets, and experiments, enabling collaboration or isolated
experimentation
with role-based access control.
- name: Spans
description: |
Spans represent individual operations within a trace. A span captures the
timing, status, and attributes of a single operation in your application.
- name: Tags
description: |
Tags are reusable labels defined once per space and attached to resources
across the platform, so the same vocabulary can be applied to projects,
datasets, prompts, and more. Tags are shared: renaming or deleting a tag
affects every resource it is attached to.
- name: Tasks
description: |
Tasks are configurable units of work that tie one or more evaluators to a
data source (project or dataset). Use tasks to automate evaluation of LLM
outputs, with support for continuous evaluation and backfill runs.
- name: Traces
description: |
A trace is the collection of spans sharing a trace ID, representing a
single end-to-end request through an LLM application. Use the Traces
endpoint to retrieve traces with all of their spans in one call.
- name: Users
description: >
Users represent members of an account. The Users endpoints allow creating,
listing, updating (display name), and removing users from the account
programmatically.
- name: Webhooks
description: >
Webhooks are organization-owned destinations that receive event deliveries
over HTTPS. Deliveries are authenticated with a bearer token or signed
with
an HMAC signing secret — the secret is returned exactly once, when the
webhook is created. Delivery attempts are recorded and can be listed for
debugging. To choose which events a webhook receives, manage its
subscriptions through the prompt and evaluator webhook-subscription
endpoints.
paths:
/v2/saml-identity-providers:
post:
tags:
- SAML
summary: Create a SAML identity provider
description: >-
Warning: This API is alpha and can change without notice. Requires
Enterprise account-admin access. Requests use the authenticated caller's
account. File-managed configurations are read-only. Default login
requires all four default fields. With default login disabled, supply
initial role mappings and omit defaults. Domain verification flags are
not accepted. Invalid metadata or an unreachable metadata URL returns
400.
operationId: create_saml_identity_provider
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/CreateSamlIdentityProviderRequest'
example:
email_domains:
- example.com
metadata_xml: >-
enforce_saml: false
sync_user_roles: true
sign_authn: true
allow_login_with_defaults: false
role_mappings:
- attributes:
groups: admins
is_account_admin: true
organization: null
space_roles: []
responses:
'201':
description: Successful response.
content:
application/json:
schema:
$ref: '#/components/schemas/SamlIdentityProvider'
example:
email_domains:
- example.com
metadata_xml: >-
enforce_saml: false
sync_user_roles: true
sign_authn: true
allow_login_with_defaults: false
role_mappings:
- id: 4fb901ac-5281-4bfb-99f5-848c4d66a95c
attributes:
groups: admins
is_account_admin: true
organization: null
space_roles: []
project_roles: null
id: example.com
metadata_url: null
default_organization_id: null
default_space_id: null
default_organization_role_id: null
default_space_role_id: null
is_managed_by_file: false
created_at: '2026-10-12T00:00:00Z'
updated_at: '2026-10-12T00:00:00Z'
domain_verification:
- domain: example.com
validated: false
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'409':
$ref: '#/components/responses/Conflict'
'422':
$ref: '#/components/responses/UnprocessableEntity'
'429':
$ref: '#/components/responses/RateLimitExceeded'
components:
schemas:
CreateSamlIdentityProviderRequest:
type: object
required:
- email_domains
- enforce_saml
- sync_user_roles
- sign_authn
- allow_login_with_defaults
additionalProperties: false
properties:
email_domains:
type: array
minItems: 1
uniqueItems: true
items:
type: string
minLength: 1
description: Unique email domains served by this identity provider.
metadata_url:
type: string
format: uri
minLength: 1
description: HTTPS metadata URL. Supply this or metadata_xml.
metadata_xml:
type: string
minLength: 1
maxLength: 1048576
description: Metadata XML, at most 1 MiB. Supply this or metadata_url.
default_organization_id:
type: string
nullable: true
description: Default organization ID, or null when default login is disabled.
default_space_id:
type: string
nullable: true
description: Default space ID, or null when default login is disabled.
default_organization_role_id:
type: string
nullable: true
description: >-
Default organization role ID, or null when default login is
disabled.
default_space_role_id:
type: string
nullable: true
description: Default space role ID, or null when default login is disabled.
enforce_saml:
type: boolean
description: Whether users must authenticate through SAML.
sync_user_roles:
type: boolean
description: Whether login applies role mappings to existing users.
sign_authn:
type: boolean
description: >-
Whether Arize signs SAML authentication requests sent to the
identity provider.
allow_login_with_defaults:
type: boolean
description: Whether users without a matching role mapping receive default roles.
role_mappings:
type: array
items:
$ref: '#/components/schemas/CreateSamlRoleMappingRequest'
description: Role mappings for this identity provider.
description: >-
Supply exactly one metadata source: metadata_url or metadata_xml.
Supplying both or neither returns 422.
SamlIdentityProvider:
type: object
required:
- id
- email_domains
- domain_verification
- enforce_saml
- sync_user_roles
- sign_authn
- allow_login_with_defaults
- is_managed_by_file
- role_mappings
additionalProperties: false
properties:
email_domains:
type: array
minItems: 1
uniqueItems: true
items:
type: string
minLength: 1
description: Unique email domains served by this identity provider.
metadata_url:
type: string
nullable: true
description: Configured metadata URL, or null when XML is used.
metadata_xml:
type: string
nullable: true
description: Configured metadata XML, or null when a URL is used.
default_organization_id:
type: string
nullable: true
description: Default organization ID, or null when default login is disabled.
default_space_id:
type: string
nullable: true
description: Default space ID, or null when default login is disabled.
default_organization_role_id:
type: string
nullable: true
description: >-
Default organization role ID, or null when default login is
disabled.
default_space_role_id:
type: string
nullable: true
description: Default space role ID, or null when default login is disabled.
enforce_saml:
type: boolean
description: Whether users must authenticate through SAML.
sync_user_roles:
type: boolean
description: Whether login applies role mappings to existing users.
sign_authn:
type: boolean
description: >-
Whether Arize signs SAML authentication requests sent to the
identity provider.
allow_login_with_defaults:
type: boolean
description: Whether users without a matching role mapping receive default roles.
id:
type: string
minLength: 1
description: Identity provider ID.
is_managed_by_file:
type: boolean
description: >-
Whether configuration comes from a file. File configurations are
read-only.
created_at:
type: string
format: date-time
nullable: true
description: Creation time in UTC, or null for file-managed configuration.
updated_at:
type: string
format: date-time
nullable: true
description: Last update time in UTC, or null for file-managed configuration.
domain_verification:
type: array
items:
$ref: '#/components/schemas/SamlDomainVerification'
description: Current email domain verification state.
role_mappings:
type: array
items:
$ref: '#/components/schemas/SamlRoleMapping'
description: Role mappings for this identity provider.
x-forward-compatible: true
CreateSamlRoleMappingRequest:
type: object
required:
- attributes
- is_account_admin
additionalProperties: false
properties:
attributes:
type: object
additionalProperties:
type: string
minLength: 1
minProperties: 1
description: SAML attribute names and exact values that select this mapping.
is_account_admin:
type: boolean
description: Whether matching users receive account administrator access.
organization:
allOf:
- $ref: '#/components/schemas/SamlOrganizationAssignment'
nullable: true
description: >-
Organization role assignment, or null when no organization role is
assigned.
space_roles:
type: array
items:
$ref: '#/components/schemas/SamlSpaceAssignment'
description: >-
Space role assignments for matching users. An empty array grants no
space roles. Non-empty assignments require organization.
project_roles:
type: array
items:
$ref: '#/components/schemas/SamlProjectAssignment'
nullable: true
description: >-
Project role assignments. Omit to use the default unmanaged state on
create. Null leaves this mapping unmanaged. An empty array manages
project roles with no assignments. Non-empty assignments require
organization. If any mapping in this identity provider supplies an
array (including an empty array), SAML replaces all project role
bindings for users at login when sync_user_roles is enabled, using
their matched mappings. This also replaces manually assigned project
roles. Null leaves this mapping unmanaged; manual project roles are
preserved only when every mapping is unmanaged.
SamlDomainVerification:
type: object
required:
- domain
- validated
additionalProperties: false
properties:
domain:
type: string
description: Email domain.
validated:
type: boolean
description: Whether ownership of this domain is verified.
x-forward-compatible: true
SamlRoleMapping:
type: object
required:
- id
- attributes
- is_account_admin
- space_roles
- project_roles
additionalProperties: false
properties:
attributes:
type: object
additionalProperties:
type: string
description: SAML attribute names and exact values that select this mapping.
is_account_admin:
type: boolean
description: Whether matching users receive account administrator access.
organization:
allOf:
- $ref: '#/components/schemas/SamlOrganizationAssignment'
nullable: true
description: >-
Organization role assignment, or null when no organization role is
assigned.
space_roles:
type: array
items:
$ref: '#/components/schemas/SamlSpaceAssignment'
description: >-
Space role assignments for matching users. An empty array grants no
space roles.
project_roles:
type: array
items:
$ref: '#/components/schemas/SamlProjectAssignment'
description: >-
Configured project role assignments, or null when this mapping is
unmanaged. If any mapping in this identity provider supplies an
array (including an empty array), SAML replaces all project role
bindings for users at login when sync_user_roles is enabled, using
their matched mappings. This also replaces manually assigned project
roles. Null leaves this mapping unmanaged; manual project roles are
preserved only when every mapping is unmanaged.
nullable: true
id:
type: string
nullable: true
description: >-
Persistent server-generated mapping ID. File-managed mapping IDs
identify the current file configuration. If a successful write
returns null, read the configuration again before using the mapping
ID.
x-forward-compatible: true
Problem:
type: object
description: RFC 9457 Problem Details
properties:
title:
type: string
description: A short, human-readable summary of the problem type
status:
type: integer
description: >-
The HTTP status code generated by the origin server for this
occurrence of the problem
type:
type: string
format: uri-reference
description: A URI reference that identifies the problem type
detail:
type: string
description: >-
A human-readable explanation specific to this occurrence of the
problem
instance:
type: string
format: uri-reference
description: >-
A URI reference that identifies the specific occurrence of the
problem
required:
- title
- status
additionalProperties: false
x-forward-compatible: true
SamlOrganizationAssignment:
type: object
required:
- organization_id
- role_id
additionalProperties: false
properties:
organization_id:
type: string
minLength: 1
description: Organization ID in the caller account.
role_id:
type: string
minLength: 1
description: Role ID for this resource.
SamlSpaceAssignment:
type: object
required:
- space_id
- role_id
additionalProperties: false
properties:
space_id:
type: string
minLength: 1
description: Space ID in the selected organization.
role_id:
type: string
minLength: 1
description: Role ID for this resource.
SamlProjectAssignment:
type: object
required:
- project_id
- role_id
additionalProperties: false
properties:
project_id:
type: string
minLength: 1
description: Project ID in the selected organization.
role_id:
type: string
minLength: 1
description: Role ID for this resource.
responses:
BadRequest:
description: Invalid request
content:
application/problem+json:
schema:
$ref: '#/components/schemas/Problem'
example:
status: 400
title: Invalid request parameters
detail: The 'name' field is required and must be a non-empty string.
instance: /resource
type: https://arize.com/docs/ax/rest-reference/errors#invalid-request
Unauthorized:
description: Authentication is required
content:
application/problem+json:
schema:
$ref: '#/components/schemas/Problem'
example:
status: 401
title: Authentication required
detail: You must be authenticated to access this resource.
instance: /resource
type: >-
https://arize.com/docs/ax/rest-reference/errors#authentication-required
Forbidden:
description: Insufficient permissions to access this resource
content:
application/problem+json:
schema:
$ref: '#/components/schemas/Problem'
example:
status: 403
title: Access forbidden
detail: You do not have permission to access this resource.
instance: /resource/12345
type: https://arize.com/docs/ax/rest-reference/errors#access-forbidden
NotFound:
description: Not found
content:
application/problem+json:
schema:
$ref: '#/components/schemas/Problem'
example:
status: 404
title: Resource not found
detail: The requested resource with ID '12345' was not found.
instance: /resource/12345
type: https://arize.com/docs/ax/rest-reference/errors#resource-not-found
Conflict:
description: Resource conflict
content:
application/problem+json:
schema:
$ref: '#/components/schemas/Problem'
example:
status: 409
title: Resource conflict
detail: A resource with the given identifier already exists.
instance: /resource
type: https://arize.com/docs/ax/rest-reference/errors#resource-conflict
UnprocessableEntity:
description: Unprocessable entity
content:
application/problem+json:
schema:
$ref: '#/components/schemas/Problem'
example:
status: 422
title: Unprocessable Entity
detail: One or more fields failed validation.
instance: /resource/12345
type: >-
https://arize.com/docs/ax/rest-reference/errors#unprocessable-entity
RateLimitExceeded:
description: Rate limit exceeded
headers:
Retry-After:
description: |
When throttled (429), how long to wait before retrying. Value is
either a delta-seconds integer.
schema:
type: integer
minimum: 0
example: 42
content:
application/problem+json:
schema:
$ref: '#/components/schemas/Problem'
example:
status: 429
title: Rate limit exceeded
detail: >-
You have exceeded the allowed number of requests. Please try again
later.
instance: /resource
type: >-
https://arize.com/docs/ax/rest-reference/errors#rate-limit-exceeded
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat:
description: >
Most Arize AI endpoints require authentication. For those endpoints that
require authentication, include your API key in the request header using
the format
``` Authorization: Bearer
```
````