> ## Documentation Index > Fetch the complete documentation index at: /docs/llms.txt > Use this file to discover all available pages before exploring further. # Update supplied mapping fields > Warning: This API is alpha and can change without notice. Requires Enterprise account-admin access. Mapping changes are atomic and preserve required login and admin mappings. File-managed configurations are read-only. For custom space roles and project roles, the first matching rule for each resource wins in configuration order. Built-in space roles use the most permissive matching built-in role. Updating a mapping preserves its position. For existing users, changes to stored role assignments apply at their next successful SAML login only when sync_user_roles is true. Mapping changes do not revoke current sessions or API keys. ## OpenAPI ````yaml https://api.arize.com/v2/spec.yaml patch /v2/saml-identity-providers/{idp_id}/role-mappings/{mapping_id} openapi: 3.0.3 info: title: Arize REST API version: 2.0.0 description: | API specification for the backend data server. The API is hosted globally at https://api.arize.com/v2 or in your own environment. license: name: Apache-2.0 url: https://www.apache.org/licenses/LICENSE-2.0 servers: - description: Global url: https://api.arize.com - description: Regional url: https://api.{region}.arize.com variables: region: default: eu-west-1a enum: - eu-west-1a - ca-central-1a - description: Custom Host url: https://{host} variables: host: default: api.arize.com security: - bearerAuth: [] tags: - name: AI Integrations description: | AI integrations configure access to external LLM providers (e.g. OpenAI, Azure OpenAI, AWS Bedrock, Vertex AI). Integrations can be scoped to the entire account, a specific organization, or a specific space. - name: Alignment description: > Alignment measures agreement between evaluator labels and human annotations. Tasks define the dataset columns and comparison function. Runs record the resulting score for a dataset version. - name: Annotation Configs description: > Annotation configs allow you to define consistent annotation schemas that can be reused across your workspace, ensuring evaluations are structured and comparable over time. - name: Annotation Queues description: > Annotation queues help you organize and manage human evaluation workflows. Use queues to assign spans or examples to annotators for review and labeling. - name: API Keys description: > API keys are used to authenticate requests to the Arize API. List your keys to view metadata; the raw secret is never returned after creation. - name: Audit Logs description: > Audit logs record authenticated user actions within an account, providing a chronological trail for security and compliance review. Access requires account admin privileges and audit logging to be enabled. - name: Dashboards description: > Dashboards organize charts and summaries that help teams understand their data. - name: Datasets description: | Datasets are structured, version-controlled example collections you use to run, evaluate, and track LLM experiments. - name: Evaluators description: > Evaluators are reusable evaluation configurations used to assess the quality of LLM outputs. They can be template-based (using LLM judges) or code-based. - name: Experiments description: > Experiments let you systematically test prompt/model changes using datasets, tasks, and evaluators. - name: Integrations description: > Integrations configure access to external LLM providers (e.g. OpenAI, Azure OpenAI, AWS Bedrock, Vertex AI), notifications services (e.g. PagerDuty, Slack), and your own agents. Integrations can be scoped to the entire account, a specific organization, or a specific space. - name: Monitors description: > Monitors continuously track a metric over your model or LLM application data and alert you when it crosses a threshold. Each monitor watches a single metric - data quality, model performance, drift, a custom metric, or a tracing metric - and moves between statuses as the metric passes in and out of its healthy range. - name: Organizations description: > Organizations are top-level containers within an Arize AX account for grouping spaces. - name: Projects description: | Projects represent LLM applications being monitored in Arize where you can observe traces and spans. - name: Prompts description: > Prompts are reusable, versioned templates for LLM interactions. Use prompts to standardize and manage how you interact with LLMs across your application. - name: Resource Restrictions description: | Endpoints for restricting and unrestricting resources (projects, models). - name: Role Bindings description: | Role bindings assign a role to a user on a resource. REST currently supports space- and project-scoped bindings. - name: Roles description: > Roles define sets of permissions that can be assigned to users within an account. Create custom roles to tailor access control to your team's needs. - name: SAML description: Enterprise account-admin SAML configuration and role mappings. - name: Spaces description: > Spaces are containers within an organization for grouping related projects, datasets, and experiments, enabling collaboration or isolated experimentation with role-based access control. - name: Spans description: | Spans represent individual operations within a trace. A span captures the timing, status, and attributes of a single operation in your application. - name: Tags description: | Tags are reusable labels defined once per space and attached to resources across the platform, so the same vocabulary can be applied to projects, datasets, prompts, and more. Tags are shared: renaming or deleting a tag affects every resource it is attached to. - name: Tasks description: | Tasks are configurable units of work that tie one or more evaluators to a data source (project or dataset). Use tasks to automate evaluation of LLM outputs, with support for continuous evaluation and backfill runs. - name: Traces description: | A trace is the collection of spans sharing a trace ID, representing a single end-to-end request through an LLM application. Use the Traces endpoint to retrieve traces with all of their spans in one call. - name: Users description: > Users represent members of an account. The Users endpoints allow creating, listing, updating (display name), and removing users from the account programmatically. - name: Webhooks description: > Webhooks are organization-owned destinations that receive event deliveries over HTTPS. Deliveries are authenticated with a bearer token or signed with an HMAC signing secret — the secret is returned exactly once, when the webhook is created. Delivery attempts are recorded and can be listed for debugging. To choose which events a webhook receives, manage its subscriptions through the prompt and evaluator webhook-subscription endpoints. paths: /v2/saml-identity-providers/{idp_id}/role-mappings/{mapping_id}: patch: tags: - SAML summary: Update supplied mapping fields description: >- Warning: This API is alpha and can change without notice. Requires Enterprise account-admin access. Mapping changes are atomic and preserve required login and admin mappings. File-managed configurations are read-only. For custom space roles and project roles, the first matching rule for each resource wins in configuration order. Built-in space roles use the most permissive matching built-in role. Updating a mapping preserves its position. For existing users, changes to stored role assignments apply at their next successful SAML login only when sync_user_roles is true. Mapping changes do not revoke current sessions or API keys. operationId: update_saml_role_mapping parameters: - name: idp_id in: path required: true schema: type: string minLength: 1 description: Identity provider ID returned by the list operation. - name: mapping_id in: path required: true schema: type: string minLength: 1 description: Mapping ID returned by list or add. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateSamlRoleMappingRequest' examples: renameAttributes: summary: Change matching attributes value: attributes: groups: admins-renamed clearAssignments: summary: Clear role assignments and retain account-admin access value: is_account_admin: true organization: null space_roles: [] project_roles: [] disableProjectRoleManagement: summary: Leave this mapping's project roles unmanaged value: project_roles: null responses: '200': description: Successful response. content: application/json: schema: $ref: '#/components/schemas/SamlRoleMapping' example: id: 4fb901ac-5281-4bfb-99f5-848c4d66a95c attributes: groups: admins is_account_admin: true organization: null space_roles: [] project_roles: null '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/Conflict' '422': $ref: '#/components/responses/UnprocessableEntity' '429': $ref: '#/components/responses/RateLimitExceeded' components: schemas: UpdateSamlRoleMappingRequest: type: object additionalProperties: false properties: attributes: type: object additionalProperties: type: string minLength: 1 minProperties: 1 description: SAML attribute names and exact values that select this mapping. is_account_admin: type: boolean description: Whether matching users receive account administrator access. organization: allOf: - $ref: '#/components/schemas/SamlOrganizationAssignment' nullable: true description: >- Organization role assignment, or null when no organization role is assigned. space_roles: type: array items: $ref: '#/components/schemas/SamlSpaceAssignment' description: >- Space role assignments for matching users. An empty array grants no space roles. project_roles: type: array items: $ref: '#/components/schemas/SamlProjectAssignment' description: >- Omit to leave this mapping unchanged. An array manages project roles; an empty array clears this mapping's project assignments. Null leaves this mapping unmanaged. With role sync enabled, any managed mapping enables project-role synchronization for the identity provider. Login replaces project roles using matched mappings, including removal of manual grants. Manual project roles are preserved only when every mapping is unmanaged. nullable: true minProperties: 1 description: >- Omitted fields remain unchanged. Attributes and assignment lists replace their complete values. Empty lists clear assignments. organization:null clears the organization only if the resulting mapping remains valid. project_roles:null leaves this mapping unmanaged; manual project roles are preserved only when every mapping is unmanaged. SamlRoleMapping: type: object required: - id - attributes - is_account_admin - space_roles - project_roles additionalProperties: false properties: attributes: type: object additionalProperties: type: string description: SAML attribute names and exact values that select this mapping. is_account_admin: type: boolean description: Whether matching users receive account administrator access. organization: allOf: - $ref: '#/components/schemas/SamlOrganizationAssignment' nullable: true description: >- Organization role assignment, or null when no organization role is assigned. space_roles: type: array items: $ref: '#/components/schemas/SamlSpaceAssignment' description: >- Space role assignments for matching users. An empty array grants no space roles. project_roles: type: array items: $ref: '#/components/schemas/SamlProjectAssignment' description: >- Configured project role assignments, or null when this mapping is unmanaged. If any mapping in this identity provider supplies an array (including an empty array), SAML replaces all project role bindings for users at login when sync_user_roles is enabled, using their matched mappings. This also replaces manually assigned project roles. Null leaves this mapping unmanaged; manual project roles are preserved only when every mapping is unmanaged. nullable: true id: type: string nullable: true description: >- Persistent server-generated mapping ID. File-managed mapping IDs identify the current file configuration. If a successful write returns null, read the configuration again before using the mapping ID. x-forward-compatible: true SamlOrganizationAssignment: type: object required: - organization_id - role_id additionalProperties: false properties: organization_id: type: string minLength: 1 description: Organization ID in the caller account. role_id: type: string minLength: 1 description: Role ID for this resource. SamlSpaceAssignment: type: object required: - space_id - role_id additionalProperties: false properties: space_id: type: string minLength: 1 description: Space ID in the selected organization. role_id: type: string minLength: 1 description: Role ID for this resource. SamlProjectAssignment: type: object required: - project_id - role_id additionalProperties: false properties: project_id: type: string minLength: 1 description: Project ID in the selected organization. role_id: type: string minLength: 1 description: Role ID for this resource. Problem: type: object description: RFC 9457 Problem Details properties: title: type: string description: A short, human-readable summary of the problem type status: type: integer description: >- The HTTP status code generated by the origin server for this occurrence of the problem type: type: string format: uri-reference description: A URI reference that identifies the problem type detail: type: string description: >- A human-readable explanation specific to this occurrence of the problem instance: type: string format: uri-reference description: >- A URI reference that identifies the specific occurrence of the problem required: - title - status additionalProperties: false x-forward-compatible: true responses: Unauthorized: description: Authentication is required content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: status: 401 title: Authentication required detail: You must be authenticated to access this resource. instance: /resource type: >- https://arize.com/docs/ax/rest-reference/errors#authentication-required Forbidden: description: Insufficient permissions to access this resource content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: status: 403 title: Access forbidden detail: You do not have permission to access this resource. instance: /resource/12345 type: https://arize.com/docs/ax/rest-reference/errors#access-forbidden NotFound: description: Not found content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: status: 404 title: Resource not found detail: The requested resource with ID '12345' was not found. instance: /resource/12345 type: https://arize.com/docs/ax/rest-reference/errors#resource-not-found Conflict: description: Resource conflict content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: status: 409 title: Resource conflict detail: A resource with the given identifier already exists. instance: /resource type: https://arize.com/docs/ax/rest-reference/errors#resource-conflict UnprocessableEntity: description: Unprocessable entity content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: status: 422 title: Unprocessable Entity detail: One or more fields failed validation. instance: /resource/12345 type: >- https://arize.com/docs/ax/rest-reference/errors#unprocessable-entity RateLimitExceeded: description: Rate limit exceeded headers: Retry-After: description: | When throttled (429), how long to wait before retrying. Value is either a delta-seconds integer. schema: type: integer minimum: 0 example: 42 content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: status: 429 title: Rate limit exceeded detail: >- You have exceeded the allowed number of requests. Please try again later. instance: /resource type: >- https://arize.com/docs/ax/rest-reference/errors#rate-limit-exceeded securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: description: > Most Arize AI endpoints require authentication. For those endpoints that require authentication, include your API key in the request header using the format ``` Authorization: Bearer ``` ````