Inbound SSO API

Use this API to manage your instance Inbound SSO configurations.

Use the below endpoints to query service provider configurations and IdPs for a Medallia Experience Cloud instance via HTTP request to evaluate, assess, and to find the root cause of configuration issues. Additionally, use the available endpoints to modify configuration parameters and mitigate security risks.

Restrictions and limits

The Inbound SSO API can handle up to 10 requests per second and 10,000 requests per day.

Important: The timeout for a request is 600 seconds. The API Gateway discards any request that takes longer than that.

For security reasons, users of this API are only allowed to query events for the company in which they have access and access one at a time. You cannot query more than one company in the same request even if you have access to different instances.

Authentication and authorization

Authentication identifies who is making an API request, and authorization identifies what data the requester may access. OAuth is an industry standard for authorizing limited access to services and data. Applications must obtain a secure token that identifies the application that makes the request. The token is passed to the resource server (API server) with each API request. For more information, see Authenticate APIs with OAuth.

To use the Inbound SSO API:

The application must have an account, see AppID Accounts for details.
The account's role must have permission to access the API.
- Manage inbound SSO
For more information about the permissions, see Administrative permissions and Data access permissions.
API access is authenticated with OAuth. To use OAuth, the application must first obtain an OAuth access token, by requesting one for the application's client ID and secret. For detailed information, see Authenticating APIs with OAuth.

Request/response formats

Requests sent to Medallia Inbound SSO API are HTTP GET, PUT, POST, and DELETE protocols. The information in the requests includes:

A required Content-Type header field describing the content. The acceptable type is: application/json for JSON.

An optional Accept field tells the Audit Framework API how to format the response. The acceptable type is: application/json for JSON.


Parameter	Description	Required	Values
Bearer	Access token	Required	See Authentication and authorization.
Content-Type	Format of request data	Required	application/json.
Accept	Format of response data	Optional	application/json.

No other header fields are expected.
The request URL:
- Always use the base instance for the company's Medallia installation.

Get the service provider configuration

Use this endpoint to get the current service provider configuration of your instance.

Requests are HTTP GET protocol. The API accesses resources from a URL that follows this format to retrieve the configuration:

https://<api-host>/apis/<api-version>/<service>/<endpoint>

Where:

api-host is the server for your company's Experience Cloud instance. For information, see API hosts.
api-version is v0.
service is inbound-sso.
endpoint is service-provider-configuration.

Response

A valid success response will return the current service provider configuration encoded in a JSON array of objects, with each object containing keys and values that match the parameters shown in the following table.


Element	Description	Type	Notes
saml_allowed_referrers	List of allowed referrer URLs.	String	The wildcard "`*`" is supported.
saml_referrer_test	Enables referrer validation against `saml_allowed_referrers`.	Boolean	—
saml_metadata_link	URL to the SAML metadata.	String (URI)	—
saml_extended_sp_issuers	List of extended Service Provider issuer identifiers.	SP issuer ID data object	—
saml_original_url_expiration	Number of seconds the original URL will be remembered for SP-initiated SSO requests.	Integer 32	—
saml_allowed_external_redirect_uris	List of allowed external redirect URIs.	String (URI)	—
saml_sp_issuer	Experience Cloud Service Provider issuer.	String	—
oidc_redirect_uri	Redirect URL that OIDC clients need to use when sending back OIDC responses.	String (URI)	—
oidc_state_information_expiration	Number of seconds the State Information is retained for OIDC requests.	Integer 32	—
display_login_sso_information	Enables showing the Log in with SSO option on the login page.	Boolean	—
suppress_noisy_sso_tickets	Suppresses Event Tickets caused by SSO failures.	Boolean	—
max_session_duration	Maximum session duration in minutes.	Integer 32	If not set, maximum session duration enforcement is disabled.
session_timeout	Session timeout in minutes.	Integer 32	If not set, this value defaults to 30 minutes.
session_expired_message	Message to display when the user's session has expired.	String	—
logout_message	Message to display after logout.	String	—
referrer_null_message	Message to display when no referrer value could be retrieved from the request and the referrer check is enabled.	String	—
referrer_not_permitted_message	Message to display when the referrer is not allowed and the referrer check is enabled.	String	—
parameter_mapping_error_message	Message to display when parameter mapping fails.	String	—
account_not_found_or_inactive_message	Message to display if the username is not found or the account is inactive.	String	—

Sample request

GET https://instance.apis.medallia.com/apis/v0/inbound-sso/service-provider-configuration
Content-Type: application/json

Sample response

{
   "saml_allowed_referrers": [
       "base.medallia.com"
   ],
   "saml_referrer_test": false,
   "saml_metadata_link": "https://instance.apis.medallia.com/sso/company/samlMetadata.do",
   "saml_extended_sp_issuers": [],
   "saml_original_url_expiration": 600,
   "saml_allowed_external_redirect_uris": null,
   "saml_sp_issuer": "https://instance.apis.medallia.com/sso/company",
   "oidc_redirect_uri": "https://instance.apis.medallia.com/sso/company/logonSubmit",
   "oidc_state_information_expiration": 0,
   "display_login_sso_information": false,
   "suppress_noisy_sso_tickets": false,
   "max_session_duration": null,
   "session_timeout": null,
   "session_expired_message": "Session has expired",
   "logout_message": "The account has been logged out",
   "referrer_null_message": "No referrer was found",
   "referrer_not_permitted_message": "Referrer not allowed",
   "parameter_mapping_error_message": "A required request parameter was not found",
   "account_not_found_or_inactive_message": "Account not found or invalid",
   "_links": null,
   "_allowed": []
}

Update the service provider configuration

Use this endpoint to update the current service provider configuration of your instance.

Requests are HTTP PUT protocol. The API accesses resources from a URL that follows this format to update the configuration:

https://<api-host>/apis/<api-version>/<service>/<endpoint>

Where:

api-host is the server for your company's Experience Cloud instance. For detailed information about identifying the host, see API hosts.
api-version is v0
service is inbound-sso.
endpoint is service-provider-configuration.

PUT body

This API is used to update your service provider configuration by sending the parameters associated with the setup in the body of the HTTP PUT request.

The request body should be encoded in a JSON array of objects, with each object containing keys and values that match the parameters shown in the following table


Element	Description	Type	Required	Notes
saml_allowed_referrers	List of allowed referrer URLs.	String	Optional	The wildcard "`*`" is supported.
saml_referrer_test	Enables referrer validation against `saml_allowed_referrers`.	Boolean	Optional	—
saml_metadata_link	URL to the SAML metadata.	String (URI)	Optional	—
saml_extended_sp_issuers	List of extended Service Provider issuer identifiers.	SP issuer ID data object	Optional	—
saml_original_url_expiration	Number of seconds the original URL will be remembered for SP-initiated SSO requests.	Integer 32	Optional	—
saml_allowed_external_redirect_uris	List of allowed external redirect URIs.	String (URI)	Optional	—
saml_sp_issuer	Experience Cloud Service Provider issuer.	String	Optional	—
oidc_redirect_uri	Redirect URL that OIDC clients need to use when sending back OIDC responses.	String (URI)	Optional	—
oidc_state_information_expiration	Number of seconds the State Information is retained for OIDC requests.	Integer 32	Optional	—
display_login_sso_information	Enables showing the Log in with SSO option on the login page.	Boolean	Optional	—
suppress_noisy_sso_tickets	Suppresses Event Tickets caused by SSO failures.	Boolean	Optional	—
max_session_duration	Maximum session duration in minutes.	Integer 32	Optional	If not set, maximum session duration enforcement is disabled.
session_timeout	Session timeout in minutes.	Integer 32	Optional	If not set, this value defaults to 30 minutes.
session_expired_message	Message to display when the user's session has expired.	String	Optional	—
logout_message	Message to display after logout.	String	Optional	—
referrer_null_message	Message to display when no referrer value could be retrieved from the request and the referrer check is enabled.	String	Optional	—
referrer_not_permitted_message	Message to display when the referrer is not allowed and the referrer check is enabled.	String	Optional	—
parameter_mapping_error_message	Message to display when parameter mapping fails.	String	Optional	—
account_not_found_or_inactive_message	Message to display if the username is not found or the account is inactive.	String	Optional	—

Sample successful request

PUT https://instance.apis.medallia.com/inbound-sso/service-provider-configuration
Content-Type: application/json
{
   "saml_allowed_referrers": [
       "base.medallia.com"
   ],
   "saml_referrer_test": false,
   "saml_metadata_link": "https://instance.apis.medallia.com/sso/company/samlMetadata.do",
   "saml_extended_sp_issuers": [],
   "saml_original_url_expiration": 600,
   "saml_allowed_external_redirect_uris": null,
   "saml_sp_issuer": "https://instance.apis.medallia.com/sso/company",
   "oidc_redirect_uri": "https://instance.apis.medallia.com/sso/company/logonSubmit",
   "oidc_state_information_expiration": 0,
   "display_login_sso_information": true,
   "suppress_noisy_sso_tickets": false,
   "max_session_duration": 31,
   "session_timeout": null,
   "session_expired_message": "Session has expired",
   "logout_message": "The account has been logged out",
   "referrer_null_message": "No referrer was found",
   "referrer_not_permitted_message": "Referrer not allowed",
   "parameter_mapping_error_message": "A required request parameter was not found",
   "account_not_found_or_inactive_message": "Account not found or invalid"
}

Sample response

{
   "saml_allowed_referrers": [
       "base.medallia.com"
   ],
   "saml_referrer_test": false,
   "saml_metadata_link": "https://instance.apis.medallia.com/sso/company/samlMetadata.do",
   "saml_extended_sp_issuers": [],
   "saml_original_url_expiration": 600,
   "saml_allowed_external_redirect_uris": null,
   "saml_sp_issuer": "https://instance.apis.medallia.com/sso/company",
   "oidc_redirect_uri": "https://instance.apis.medallia.com/sso/company/logonSubmit",
   "oidc_state_information_expiration": 0,
   "display_login_sso_information": true,
   "suppress_noisy_sso_tickets": false,
   "max_session_duration": 31,
   "session_timeout": null,
   "session_expired_message": "Session has expired",
   "logout_message": "The account has been logged out",
   "referrer_null_message": "No referrer was found",
   "referrer_not_permitted_message": "Referrer not allowed",
   "parameter_mapping_error_message": "A required request parameter was not found",
   "account_not_found_or_inactive_message": "Account not found or invalid",
   "_links": null,
   "_allowed": []
}

Sample request

PUT https://instance.apis.medallia.com/inbound-sso/service-provider-configuration
Content-Type: application/json
{
   "saml_allowed_referrers": [
       "base.medallia.com"
   ],
   "saml_referrer_test": false,
   "saml_metadata_link": "https://instance.apis.medallia.com/sso/company/samlMetadata.do",
   "saml_extended_sp_issuers": [],
   "saml_original_url_expiration": 600,
   "saml_allowed_external_redirect_uris": null,
   "saml_sp_issuer": "https://instance.apis.medallia.com/sso/company,
   "oidc_redirect_uri": "https://instance.apis.medallia.com/sso/company/logonSubmit",
   "oidc_state_information_expiration": 0,
   "display_login_sso_information": true,
   "suppress_noisy_sso_tickets": false,
   "max_session_duration": 15,
   "session_timeout": null,
   "session_expired_message": "Session has expired",
   "logout_message": "The account has been logged out",
   "referrer_null_message": "No referrer was found",
   "referrer_not_permitted_message": "Referrer not allowed",
   "parameter_mapping_error_message": "A required request parameter was not found",
   "account_not_found_or_inactive_message": "Account not found or invalid"
}

Sample error response

{
   "error_type": null,
   "message": "Invalid value for field `max_session_duration`. Value must be greater than 30 seconds."
}

Get a list of all identity providers

Use this endpoint to get a list of all current identity providers associated with your instance.

Requests are HTTP GET protocol. The API accesses resources from a URL that follows this format to get all IdPs:

https://<api-host>/apis/<api-version>/<service>/<endpoint>

Where:

api-host is the server for your company's Experience Cloud instance. For information, see API hosts.
api-version is v0.
service is inbound-sso.
endpoint is identity-providers.

Response

A valid success response will returns the current service provider configuration encoded in a JSON array of objects, with each object containing keys and values that match the parameters shown in the following table.


Element	Description	Type	Notes
id	UUID of the identity provider.	String	—
type	Type of IdP.	String	Supported values: saml-identity-provider openid-connect-identity-provider
name	Name of the IdP.	String	—
is_active	Indicates the IdP status.	Boolean	—
is_internal	Indicates if the IdP is internal.	Boolean	—
display_order	Controls the order in which the IdP appears on the selection page.	Integer32	—
description	Description of the IdP.	String	—
auto_select_for_mobile	Indicates whether this IdP must be used for mobile devices.	Boolean	When "true", this IdP is automatically used when requests come from mobile devices. It implicitly sets or overrides the HTTP Header selection criteria value to `User-Agent= Mobi` (detect mobile requests).
http_header_selection_criteria	Specifies the HTTP-request-based selection criteria.	String	Used if `auto_select_for_mobile` value is "false". Currently HTTP header based criteria of the form `HeaderName=RegEx` are supported.
clock_skew	Clock skew in seconds.	Integer32	When set to a value equal or greater than 0, it will be used instead of the default clock skew.
ip_allowlist	List of IP addresses and/or CIDR net masks that are allowed to access the the configured IdP.	Array of IP addresses and/or CIDR net masks	IP addresses can be given as either a full IP address (e.g.: `10.0.0.1`) or a subset if addresses (e.g.: `10.0.0.0/24` to allow `10.0.0.*`). An empty list means that no restrictions apply.
find_by_username	Indicates the search criteria for account search.	Boolean	When "true", Experience Cloud uses SAML assertion attribute/OIDC claims value as the username instead of the client account identifier when searching for an account.
autoimporter_spec_id	Import specification used to process the SSO request.	Integer 32	For information, see Auto Importer Processors.

The API response shows different parameters for each type of identity provider.

SAML


Element	Description	Type	Notes
sso_endpoint	Single Sign-On URL to which the SAML authentication request is sent.	String (URI)	—
issuer_name	IdP issuer identifier value that will be sent in the SAML response.	String	—
certificates	List of X.509 certificates for the IdP.	String	Each certificate is a base64 encoded string in CER format.
use_http_post_binding	Enables HTTP POST binding for sending authentication requests.	Boolean	When "true", HTTP POST binding is used for authentication requests. Otherwise, HTTP redirect binding is used.
process_encrypted_assertions	Enable processing of encrypted assertions.	Boolean	When "true", processing of encrypted assertions is enabled: if the received assertion is encrypted, it will be decrypted and processed. Otherwise, it will be processed as plain text.
sign_saml_requests	Defines whether requests sent to the IdP will be signed by the signature algorithm.	Boolean	When enabled, requests sent to the IDP will be signed by the algorithm specified in `signing_algorithm`.
signing_algorithm	Signature algorithm used to sign requests sent to the IdP.	Enumeration	Supported values: rsa_sha1 rsa_sha256 rsa_sha384 rsa_sha512
saml_sso_profile	Profile for SAML SSO.	Enumeration	Supported values: standard_web_sso holder_of_key
hok_sso_url	Single Sign-on URL of the IdP with holder of key profile to which the SAML authentication request is sent.	String (URI)	—
add_assertion_consumer_service_url_attribute	Defines whether to add the assertion consumer URL to SAML requests.	Boolean	When "true", it adds the `AssertionConsumerServiceURL` attribute to SAML requests.
assertion_attribute_name	The name of the attribute in the SAML response that identifies the user by matching the account username.	String	—
assertion_values_separator	Separator used to concatenate multiple values in an assertion attribute.	String	maxLength: 1
error_redirect_url	URL to redirect to in case of an error during SSO authentication.	String (URI)	—
logout_redirect_url	The URL to which the user will be redirected by the Logout link.	String (URI)	—
disable_sp_initiated_flow	Defines whether the user is redirected to the IdP dashboard.	Boolean	When "true", the user is redirected to the IdP dashboard instead of performing a SAML SP-initiated flow. For this to work properly, set a URL for the `idp_home_url` attribute.
idp_home_url	URL for IdP home, which contains all applications accessible to the user.	String (URI)	—
force_one_time_use_assertions	Defines whether received assertions are processed only once.	Boolean	When "true", each received assertion is processed only once and will fail if another authentication attempt is made with an already processed assertion.

OIDC


Element	Description	Type	Notes
client_id	Client identifier to be used for OpenID communication with the identity provider (IDP).	String	The value for client ID is provided by the IdP.
client_secret	Secret associated with the Client ID used to prove the client's identity to the IdP.	String	The value for client secret is provided by the IdP.
discovery_endpoint	Returns a JSON object containing advanced configuration endpoints required for communication with the IdP.	String (URI)	If the value is not empty, this endpoint will be used instead of the individual fields to fetch the OpenID Connect metadata. The value for discovery endpoint is provided by the IdP.
issuer	Root URL for the IDP.	String (URI)	—
jwks_url	URL for IdP endpoint that returns the JSON Web Key Set object used to verify security signatures in OIDC.	String (URI)	—
authorization_endpoint	URL for IdP endpoint that is used to interact with the resource owner and to obtain an authorization grant.	String (URI)	—
token_endpoint	URL for IdP endpoint that returns access and ID tokens when presented with authorization grants or refresh tokens.	String (URI)	—
userinfo_endpoint	URL for IdP endpoint that returns user profile information when presented with an access token	String (URI)	—
email_scope_enabled	Defines whether the email scope is enabled.	Boolean	—
profile_scope_enabled	Defines whether the profile scope is enabled	Boolean	—
custom_request_scopes	Custom scopes to be used in the authentication request.	String	Scopes must be separated by spaces.
user_claim_name	Claim name in the ID Token that identifies the user by matching the account username or company account ID.	String	—
connection_read_timeout	Connection timeout in seconds.	Integer 32	When it is not set, the default value is 15 seconds.

Sample request

GET https://instance.apis.medallia.com/apis/v0/inbound-sso/identity-providers
Content-Type: application/json

Sample response

{
   "_links": {
       "self": {
           "href": "https://instance.apis.medallia.com/apis/v0/inbound-sso/identity-providers",
           "rel": "self"
       },
       "canonical": {
           "href": "https://instance.apis.medallia.com/apis/v0/inbound-sso/identity-providers",
           "rel": "canonical"
       },
       "prev": null,
       "next": null
   },
   "items": [
      {
           "id": "3fd9b331-9dde-47db-9a83-63fefudc7ebc",
           "name": "Keycloak",
           "is_active": true,
           "is_internal": false,
           "display_order": 1000,
           "description": null,
           "auto_select_for_mobile": false,
           "http_header_selection_criteria": null,
           "clock_skew": 10,
           "ip_allowlist": [],
           "find_by_username": true,
           "autoimporter_spec_id": null,
           "_links": null,
           "_system_properties": {
               "modified_on": "2026-04-23T21:45:25.408Z",
               "created_on": "2026-04-23T21:45:25.408Z",
               "modified_by": "user",
               "created_by": "user"
           },
           "_allowed": [],
           "client_id": "client_oidc",
           "client_secret": null,
           "discovery_endpoint": "https://idp.medallia.com/auth/realms/security/well-known/openid-configuration",
           "issuer": "https://idp.medallia.com/auth/realms/security",
           "jwks_url": "https://idp.medallia.com/auth/realms/security/protocol/openid-connect/certs",
           "authorization_endpoint": "https://idp.medallia.com/auth/realms/security/protocol/openid-connect/auth",
           "token_endpoint": "https://idp.medallia.com/auth/realms/security/protocol/openid-connect/token",
           "userinfo_endpoint": "https://idp.medallia.com/auth/realms/security/protocol/openid-connect/userinfo",
           "email_scope_enabled": true,
           "profile_scope_enabled": true,
           "custom_request_scopes": null,
           "user_claim_name": "username",
           "connection_read_timeout": 15
       },
       {
           "id": "f2a04181-3dee-4637-b115-1253ee946dfu",
           "name": "Okta",
           "is_active": false,
           "is_internal": false,
           "display_order": 1000,
           "description": null,
           "auto_select_for_mobile": false,
           "http_header_selection_criteria": null,
           "clock_skew": 10,
           "ip_allowlist": [],
           "find_by_username": true,
           "autoimporter_spec_id": null,
           "_links": null,
           "_system_properties": {
               "modified_on": "2026-04-23T21:44:18.450Z",
               "created_on": "2026-04-23T21:44:18.450Z",
               "modified_by": "user",
               "created_by": "user"
           },
           "_allowed": [],
           "sso_endpoint": "https://instance.apis.medallia.com/exj3d1x3dp0LUk3r2d2/sso/saml",
           "issuer_name": "http://www.okta.com/exj3d1x3dp0LUk3r2d2",
           "certificates": [
               "..."
           ],
           "use_http_post_binding": true,
           "process_encrypted_assertions": false,
           "sign_saml_requests": false,
           "signing_algorithm": "rsa_sha1",
           "saml_sso_profile": "standard_web_sso",
           "hok_sso_url": null,
           "add_assertion_consumer_service_url_attribute": false,
           "assertion_attribute_name": "uid",
           "assertion_values_separator": null,
           "error_redirect_url": null,
           "logout_redirect_url": null,
           "disable_sp_initiated_flow": false,
           "idp_home_url": null,
           "force_one_time_use_assertions": false
       }
   ],
   "_total": 2
}

Fetch information for a single identity provider

Use this endpoint to get the information for a specific IdP.

Requests are HTTP GET protocol. The API accesses resources from a URL that follows this format to retrieve the configuration:

https://<api-host>/apis/<api-version>/<service>/<endpoint>/<identity_provider_id>

Where:

api-host is the server for your company's Experience Cloud instance. For information, see API hosts.
api-version is v0.
service is inbound-sso.
endpoint is identity-providers.
identity_provider_id identifies the specific IdP.

Response

A valid success response will returns the service provider configuration encoded in a JSON array of objects, with each object containing keys and values that match the parameters shown in the tables above for IdPs.

Sample request

GET https://instance.apis.medallia.com/apis/v0/inbound-sso/identity-providers/3fu9b331-9dde-47db-9a83-63fufudc7ebc
Content-Type: application/json

Sample response

{
   "type": "openid-connect-identity-provider",
   "id": "3fu9b331-9dde-47db-9a83-63fufudc7ebc",
   "name": "Keycloak",
   "is_active": true,
   "is_internal": false,
   "display_order": 1000,
   "description": null,
   "auto_select_for_mobile": false,
   "http_header_selection_criteria": null,
   "clock_skew": 10,
   "ip_allowlist": [],
   "find_by_username": true,
   "autoimporter_spec_id": null,
   "_links": null,
   "_system_properties": {
       "modified_on": "2026-04-23T21:45:25.408Z",
       "created_on": "2026-04-23T21:45:25.408Z",
       "modified_by": "user",
       "created_by": "user"
   },
   "_allowed": [],
   "client_id": "idp_oidc",
   "client_secret": null,
   "discovery_endpoint": "https://idp.medallia.com/auth/realms/security/well-known/openid-configuration",
   "issuer": "https://idp.medallia.com/auth/realms/security",
   "jwks_url": "https://idp.medallia.com/auth/realms/security/protocol/openid-connect/certs",
   "authorization_endpoint": "https://idp.medallia.com/auth/realms/security/protocol/openid-connect/auth",
   "token_endpoint": "https://idp.medallia.com/auth/realms/security/protocol/openid-connect/token",
   "userinfo_endpoint": "https://idp.medallia.com/auth/realms/security/protocol/openid-connect/userinfo",
   "email_scope_enabled": true,
   "profile_scope_enabled": true,
   "custom_request_scopes": null,
   "user_claim_name": "username",
   "connection_read_timeout": 15
}

Create new identity provider

Use this endpoint to create a new identity provider for your instance.

Requests are HTTP POST protocol. The API accesses resources from a URL that follows this format to create a new IdP:

https://<api-host>/apis/<api-version>/<service>/<endpoint>

Where:

api-host is the server for your company's Experience Cloud instance. For detailed information about identifying the host, see API hosts.
api-version is v0
service is inbound-sso.
endpoint is identity-providers.

POST body

This API is used to create a new IdP configuration by sending the parameters associated with the setup in the body of the HTTP POST request.

The request body should be encoded in a JSON array of objects, with each object containing keys and values that match the parameters shown in the following table.


Element	Description	Type	Notes
id	UUID of the identity provider.	String	—
type	Type of IdP.	String	Supported values: saml-identity-provider openid-connect-identity-provider
name	Name of the IdP.	String	—
is_active	Indicates the IdP status.	Boolean	—
is_internal	Indicates if the IdP is internal.	Boolean	—
display_order	Controls the order in which the IdP appears on the selection page.	Integer32	—
description	Description of the IdP.	String	—
auto_select_for_mobile	Indicates whether this IdP must be used for mobile devices.	Boolean	When "true", this IdP is automatically used when requests come from mobile devices. It implicitly sets or overrides the HTTP Header selection criteria value to `User-Agent= Mobi` (detect mobile requests).
http_header_selection_criteria	Specifies the HTTP-request-based selection criteria.	String	Used if `auto_select_for_mobile` value is "false". Currently HTTP header based criteria of the form `HeaderName=RegEx` are supported.
clock_skew	Clock skew in seconds.	Integer32	When set to a value equal or greater than 0, it will be used instead of the default clock skew.
ip_allowlist	List of IP addresses and/or CIDR net masks that are allowed to access the the configured IdP.	Array of IP addresses and/or CIDR net masks	IP addresses can be given as either a full IP address (e.g.: `10.0.0.1`) or a subset if addresses (e.g.: `10.0.0.0/24` to allow `10.0.0.*`). An empty list means that no restrictions apply.
find_by_username	Indicates the search criteria for account search.	Boolean	When "true", Experience Cloud uses SAML assertion attribute/OIDC claims value as the username instead of the client account identifier when searching for an account.
autoimporter_spec_id	Import specification used to process the SSO request.	Integer 32	For information, see Auto Importer Processors.

Response

Sample request — Create new SAML IdP

POST https://instance.apis.medallia.com/inbound-sso/identity-providers
Content-Type: application/json
{
   "type": "saml-identity-provider",
   "name": "Azure",
   "is_active": true,
   "is_internal": false,
   "display_order": 1001,
   "description": "Azure",
   "auto_select_for_mobile": false,
   "http_header_selection_criteria": null,
   "clock_skew": 10,
   "ip_allowlist": [],
   "find_by_username": true,
   "autoimporter_spec_id": 42,
   "sso_endpoint": "https://dev-65784967.microsoft.com/app/dev-65784967_coffeetoffee_1/azkmz4xl2wxPTIql34r3/sso/saml",
   "issuer_name": "http://www.idp.microsoft.com/azkmz4xl2wxPTIql34r3",
   "certificates": [
       "..."
   ],
   "use_http_post_binding": true,
   "process_encrypted_assertions": false,
   "sign_saml_requests": false,
   "signing_algorithm": "rsa_sha1",
   "saml_sso_profile": "standard_web_sso",
   "hok_sso_url": null,
   "add_assertion_consumer_service_url_attribute": false,
   "assertion_attribute_name": "uid",
   "assertion_values_separator": null,
   "error_redirect_url": null,
   "logout_redirect_url": null,
   "disable_sp_initiated_flow": false,
   "idp_home_url": null,
   "force_one_time_use_assertions": false
}

Sample response

{
   "type": "saml-identity-provider",
   "id": "6806a802-9838-43f3-b03c-7f70b5910e82",
   "name": "Azure",
   "is_active": true,
   "is_internal": false,
   "display_order": 1001,
   "description": "Azure",
   "auto_select_for_mobile": false,
   "http_header_selection_criteria": null,
   "clock_skew": 10,
   "ip_allowlist": [
       ""
   ],
   "find_by_username": true,
   "autoimporter_spec_id": 42,
   "_links": null,
   "_system_properties": {
       "modified_on": "2026-04-24T21:15:11.588Z",
       "created_on": "2026-04-24T21:15:11.588Z",
       "modified_by": "_sdileo",
       "created_by": "_sdileo"
   },
   "_allowed": [],
   "sso_endpoint": "https://dev-65784967.microsoft.com/app/dev-65784967_coffeetoffee_1/azkmz4xl2wxPTIql34r3/sso/saml",
   "issuer_name": "http://www.idp.microsoft.com/azkmz4xl2wxPTIql34r3",
   "certificates": [
       "..."
   ],
   "use_http_post_binding": true,
   "process_encrypted_assertions": false,
   "sign_saml_requests": false,
   "signing_algorithm": "rsa_sha1",
   "saml_sso_profile": "standard_web_sso",
   "hok_sso_url": null,
   "add_assertion_consumer_service_url_attribute": false,
   "assertion_attribute_name": "uid",
   "assertion_values_separator": null,
   "error_redirect_url": null,
   "logout_redirect_url": null,
   "disable_sp_initiated_flow": false,
   "idp_home_url": null,
   "force_one_time_use_assertions": false
}

Sample request — Create new OIDC IdP

POST https://instance.apis.medallia.com/inbound-sso/identity-providers
Content-Type: application/json
{
   "type": "openid-connect-identity-provider",
   "name": "IdentityMaster",
   "is_active": true,
   "is_internal": false,
   "display_order": 1002,
   "description": "",
   "auto_select_for_mobile": false,
   "http_header_selection_criteria": null,
   "clock_skew": 10,
   "ip_allowlist": [],
   "find_by_username": true,
   "autoimporter_spec_id": null,
   "client_id": "identitymaster",
   "client_secret": "arandomsecret123",
   "discovery_endpoint": "https://identitymaster.com/auth/mec/.well-known/openid-configuration",
   "issuer": "https://identitymaster.com/auth/mec",
   "jwks_url": "https://identitymaster.com/auth/mec/protocol/openid-connect/certs",
   "authorization_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/auth",
   "token_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/token",
   "userinfo_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/userinfo",
   "email_scope_enabled": true,
   "profile_scope_enabled": true,
   "custom_request_scopes": null,
   "user_claim_name": "username",
   "connection_read_timeout": 15
}

Sample response

{
   "type": "openid-connect-identity-provider",
   "id": "8fecbf91-7183-4e5b-a4b8-aca0d7391773",
   "name": "IdentityMaster",
   "is_active": true,
   "is_internal": false,
   "display_order": 1002,
   "description": "",
   "auto_select_for_mobile": false,
   "http_header_selection_criteria": null,
   "clock_skew": 10,
   "ip_allowlist": [
       ""
   ],
   "find_by_username": true,
   "autoimporter_spec_id": null,
   "_links": null,
   "_system_properties": {
       "modified_on": "2026-04-24T21:29:39.651Z",
       "created_on": "2026-04-24T21:29:39.651Z",
       "modified_by": "_sdileo",
       "created_by": "_sdileo"
   },
   "_allowed": [],
   "client_id": "identitymaster",
   "client_secret": "arandomsecret123",
   "discovery_endpoint": "https://identitymaster.com/auth/mec/.well-known/openid-configuration",
   "issuer": "https://identitymaster.com/auth/mec",
   "jwks_url": "https://identitymaster.com/auth/mec/protocol/openid-connect/certs",
   "authorization_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/auth",
   "token_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/token",
   "userinfo_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/userinfo",
   "email_scope_enabled": true,
   "profile_scope_enabled": true,
   "custom_request_scopes": null,
   "user_claim_name": "username",
   "connection_read_timeout": 15
}

Sample request — Create new OIDC IdP (empty client_id attribute)

POST https://instance.apis.medallia.com/inbound-sso/identity-providers
Content-Type: application/json
{
  "type": "openid-connect-identity-provider",
  "name": "IdentityMaster3",
  "is_active": true,
  "is_internal": false,
  "display_order": 1002,
  "description": "",
  "auto_select_for_mobile": false,
  "http_header_selection_criteria": null,
  "clock_skew": 10,
  "ip_allowlist": [],
  "find_by_username": true,
  "autoimporter_spec_id": null,
  "client_id": "",
  "client_secret": "arandomsecret123",
  "discovery_endpoint": "https://identitymaster.com/auth/mec/.well-known/openid-configuration",
  "issuer": "https://identitymaster.com/auth/mec",
  "jwks_url": "https://identitymaster.com/auth/mec/protocol/openid-connect/certs",
  "authorization_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/auth",
  "token_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/token",
  "userinfo_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/userinfo",
  "email_scope_enabled": true,
  "profile_scope_enabled": true,
  "custom_request_scopes": null,
  "user_claim_name": "username",
  "connection_read_timeout": 15
}

Sample error response

{
   "error_type": "invalid_input",
   "message": "client_id cannot be blank"
}

Update identity providers

Use this endpoint to update the parameters of an identity provider of your instance.

Requests are HTTP PUT protocol. The API accesses resources from a URL that follows this format to update IdP parameters:

https://<api-host>/apis/<api-version>/<service>/<endpoint>/<identity_provider_id>

Where:

api-host is the server for your company's Experience Cloud instance. For detailed information about identifying the host, see API hosts.
api-version is v0
service is inbound-sso.
endpoint is identity-providers.
identity_provider_id identifies the specific IdP.

PUT body

This API is used to update IdP configuration by sending the parameters associated with the setup in the body of the HTTP PUT request.

The request body should be encoded in a JSON array of objects, with each object containing keys and values that match the parameters shown in the following table.


Element	Description	Type	Notes
id	UUID of the identity provider.	String	—
type	Type of IdP.	String	Supported values: saml-identity-provider openid-connect-identity-provider
name	Name of the IdP.	String	—
is_active	Indicates the IdP status.	Boolean	—
is_internal	Indicates if the IdP is internal.	Boolean	—
display_order	Controls the order in which the IdP appears on the selection page.	Integer32	—
description	Description of the IdP.	String	—
auto_select_for_mobile	Indicates whether this IdP must be used for mobile devices.	Boolean	When "true", this IdP is automatically used when requests come from mobile devices. It implicitly sets or overrides the HTTP Header selection criteria value to `User-Agent= Mobi` (detect mobile requests).
http_header_selection_criteria	Specifies the HTTP-request-based selection criteria.	String	Used if `auto_select_for_mobile` value is "false". Currently HTTP header based criteria of the form `HeaderName=RegEx` are supported.
clock_skew	Clock skew in seconds.	Integer32	When set to a value equal or greater than 0, it will be used instead of the default clock skew.
ip_allowlist	List of IP addresses and/or CIDR net masks that are allowed to access the the configured IdP.	Array of IP addresses and/or CIDR net masks	IP addresses can be given as either a full IP address (e.g.: `10.0.0.1`) or a subset if addresses (e.g.: `10.0.0.0/24` to allow `10.0.0.*`). An empty list means that no restrictions apply.
find_by_username	Indicates the search criteria for account search.	Boolean	When "true", Experience Cloud uses SAML assertion attribute/OIDC claims value as the username instead of the client account identifier when searching for an account.
autoimporter_spec_id	Import specification used to process the SSO request.	Integer 32	For information, see Auto Importer Processors.

Response

Sample request

PUT https://instance.apis.medallia.com/inbound-sso/identity-providers/3fu9b331-9dde-47db-9a83-63fufudc7ebc
Content-Type: application/json
{
  "type": "openid-connect-identity-provider",
  "name": "IdentityMaster",
  "is_active": true,
  "is_internal": false,
  "display_order": 1002,
  "description": "",
  "auto_select_for_mobile": false,
  "http_header_selection_criteria": null,
  "clock_skew": 10,
  "ip_allowlist": [],
  "find_by_username": true,
  "autoimporter_spec_id": 5,
  "client_id": "identitymaster",
  "discovery_endpoint": "https://identitymaster.com/auth/mec/.well-known/openid-configuration",
  "issuer": "https://identitymaster.com/auth/mec",
  "jwks_url": "https://identitymaster.com/auth/mec/protocol/openid-connect/certs",
  "authorization_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/auth",
  "token_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/token",
  "userinfo_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/userinfo",
  "email_scope_enabled": true,
  "profile_scope_enabled": true,
  "custom_request_scopes": null,
  "user_claim_name": "username",
  "connection_read_timeout": 15
}

Sample response

{
   "type": "openid-connect-identity-provider",
   "id": "3fu9b331-9dde-47db-9a83-63fufudc7ebc",
   "name": "IdentityMaster",
   "is_active": true,
   "is_internal": false,
   "display_order": 1002,
   "description": "",
   "auto_select_for_mobile": false,
   "http_header_selection_criteria": null,
   "clock_skew": 10,
   "ip_allowlist": [
       ""
   ],
   "find_by_username": true,
   "autoimporter_spec_id": 5,
   "_links": null,
   "_system_properties": {
       "modified_on": "2026-04-27T16:11:46.615Z",
       "created_on": "2026-04-24T21:29:39.651Z",
       "modified_by": "_sdileo",
       "created_by": "_sdileo"
   },
   "_allowed": [],
   "client_id": "identitymaster",
   "client_secret": null,
   "discovery_endpoint": "https://identitymaster.com/auth/mec/.well-known/openid-configuration",
   "issuer": "https://identitymaster.com/auth/mec",
   "jwks_url": "https://identitymaster.com/auth/mec/protocol/openid-connect/certs",
   "authorization_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/auth",
   "token_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/token",
   "userinfo_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/userinfo",
   "email_scope_enabled": true,
   "profile_scope_enabled": true,
   "custom_request_scopes": null,
   "user_claim_name": "username",
   "connection_read_timeout": 15
}

Sample — Failed request

PUT https://instance.apis.medallia.com/inbound-sso/identity-providers/3fu9b331-9dde-47db-9a83-63fufudc7ecd
Content-Type: application/json
{
  "type": "openid-connect-identity-provider",
  "name": "IdentityMaster",
  "is_active": true,
  "is_internal": false,
  "display_order": 1002,
  "description": "",
  "auto_select_for_mobile": false,
  "http_header_selection_criteria": null,
  "clock_skew": 10,
  "ip_allowlist": [],
  "find_by_username": true,
  "autoimporter_spec_id": 5,
  "client_id": "identitymaster",
  "client_secret": "arandomsecret123",
  "discovery_endpoint": "https://identitymaster.com/auth/mec/.well-known/openid-configuration",
  "issuer": "https://identitymaster.com/auth/mec",
  "jwks_url": "https://identitymaster.com/auth/mec/protocol/openid-connect/certs",
  "authorization_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/auth",
  "token_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/token",
  "userinfo_endpoint": "https://identitymaster.com/auth/mec/protocol/openid-connect/userinfo",
  "email_scope_enabled": true,
  "profile_scope_enabled": true,
  "custom_request_scopes": null,
  "user_claim_name": "username",
  "connection_read_timeout": 15
}

Sample error response

{
   "error_type": "invalid_input",
   "message": "client_secret cannot be updated through this endpoint. Please remove it from the request body."
}

Delete IdPs

Use this endpoint to remove an identity provider from your instance.

Requests are HTTP DELETE protocol. The API accesses resources from a URL that follows this format to delete the specified IdP:

https://<api-host>/apis/<api-version>/<service>/<endpoint>/<identity_provider_id>

Where:

api-host is the server for your company's Experience Cloud instance. For detailed information about identifying the host, see API hosts.
api-version is v0
service is inbound-sso.
endpoint is identity-providers.
identity_provider_id identifies the specific IdP.

Response

A valid success response returns a HTTP 204 status code. This indicates that the request has succeeded, but the server returns an empty response body.

Sample request

DELETE https://instance.apis.medallia.com/inbound-sso/identity-providers/3fu9b331-9dde-47db-9a83-63fufudc7ebc
Content-Type: application/json

Set OIDC IdPs' client secret

Use this endpoint to set the client secret of an OpenID Connect identity provider on your instance.

Requests are HTTP POST protocol. The API accesses resources from a URL that follows this format to set the client secret:

https://<api-host>/apis/<api-version>/<service>/<endpoint>/<OIDC_identity_provider_id>/client-secret

Where:

api-host is the server for your company's Experience Cloud instance. For detailed information about identifying the host, see API hosts.
api-version is v0
service is inbound-sso.
endpoint is identity-providers.
OIDC_identity_provider_id identifies the specific OIDC IdP.

POST body

This API is used to set the IdP client secret by sending its value in the body of the HTTP POST request.

The request body should be encoded in a JSON array of objects, with each object containing keys and values that match the parameters shown in the following table.


Element	Description	Type	Notes
client_secret	New client secret value for the OIDC identity provider	String	—

Response

A valid success response returns a HTTP 204 status code. This indicates that the request has succeeded, but the server returns an empty response body.

Sample request

POST https://instance.apis.medallia.com/inbound-sso/identity-providers/3fu9b331-9dde-47db-9a83-63fufudc7ecd/client-secret
Content-Type: application/json
{
  "client_secret": "anewsecret"
}

Error handling

There are several types of errors that can happen when calling the API:

Client problems e.g., rate-limited, unauthorized, etc. (4xx HTTP codes).
The user-supplied parameters or context are bad (cannot find the specified service provider configuration or IdP).

For the errors above, the application gets an HTTP error, the response will not be an Inbound SSO API response because the error happened before processing the request.