> ## Documentation Index > Fetch the complete documentation index at: https://docs.qumo-deploy.com/llms.txt > Use this file to discover all available pages before exploring further. # Replace an organization's SSO policy > Replaces the whole policy. Turning `enforce_sso` on needs the connection `active` (409) and deletes, in the same transaction, the sessions of the organization's managed accounts that its IdP did not create (browser and CLI sessions from Google, GitHub or a TOTP sign-in), except the break-glass administrator's; the answer counts them in `revoked_sessions`. The break-glass administrator must be an Organization Admin of the organization with Qumo TOTP on (422). Needs the organization's plan to include SSO (402) and the organization not to be suspended (403), except for a policy that enforces nothing (`enforce_sso` false and `mfa_policy` `none`). Audited as `organization.sso_policy_update`; turning enforcement off also as `organization.sso_enforcement_disable` and designating a break-glass administrator as `organization.sso_break_glass_designate`, both high severity. ## OpenAPI ````yaml /api-reference/openapi.yaml put /v1/organizations/{id}/sso/policy openapi: 3.1.0 info: title: Qumo Deploy REST API description: > The Qumo Deploy control plane: organizations, projects, signing keys, machine identities, access control, audit and billing. Relay credentials are not issued here: your app signs them with its own [signing keys](/guides/signing-keys). Every operation here is generated against the routes the server registers and checked in CI, so an operation in this reference exists and a route missing from it is deliberately internal (relay mesh, webhooks, probes, operator-only and browser sign-in routes). Errors are JSON objects with one `error` field. What each status code means is in [Error codes](/guides/error-codes); the token scope each permission needs is in [Scopes and permissions](/guides/scopes-permissions). version: 1.0.0 servers: - url: https://api.qumo-deploy.com description: Public API (Bearer tokens only; cookies are ignored) security: [] tags: - name: Account description: The signed-in user's own sessions, tokens, security settings and data. - name: Device flow description: OAuth 2.0 device authorization, used by `qumod login`. - name: Organizations description: Organizations, their members and usage. - name: Projects description: Projects inside an organization. - name: Signing keys description: Keys your app signs relay credentials with. - name: Relays description: Where clients of a broadcast path connect. - name: Identities description: Machine identities, their tokens and IP allowlists. - name: Access control description: Roles, IAM bindings and invitations. - name: Audit description: The audit log and its webhook. - name: Notifications description: Notification policies. - name: Billing description: Plans, usage cost, budgets, invoices and payment methods. - name: Pricing description: Public price list. paths: /v1/organizations/{id}/sso/policy: parameters: - name: id in: path required: true description: The organization's id. schema: type: string format: uuid example: 3f8c2a1e-7b4d-4e9a-9c61-2d5e8f0a1b7c put: tags: - Organizations summary: Replace an organization's SSO policy description: | Replaces the whole policy. Turning `enforce_sso` on needs the connection `active` (409) and deletes, in the same transaction, the sessions of the organization's managed accounts that its IdP did not create (browser and CLI sessions from Google, GitHub or a TOTP sign-in), except the break-glass administrator's; the answer counts them in `revoked_sessions`. The break-glass administrator must be an Organization Admin of the organization with Qumo TOTP on (422). Needs the organization's plan to include SSO (402) and the organization not to be suspended (403), except for a policy that enforces nothing (`enforce_sso` false and `mfa_policy` `none`). Audited as `organization.sso_policy_update`; turning enforcement off also as `organization.sso_enforcement_disable` and designating a break-glass administrator as `organization.sso_break_glass_designate`, both high severity. operationId: putOrganizationSSOPolicy requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SSOPolicyPutRequest' responses: '200': description: The policy was saved. content: application/json: schema: $ref: '#/components/schemas/SSOPolicyPutResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '402': $ref: '#/components/responses/PaymentRequired' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/Conflict' '422': $ref: '#/components/responses/UnprocessableEntity' security: - token: [] - cliSession: [] - sessionCookie: [] csrfToken: [] components: schemas: SSOPolicyPutRequest: type: object description: The whole policy, replacing the stored one. required: - enforce_sso - mfa_policy - accepted_acr_values - break_glass_user_id properties: enforce_sso: type: boolean description: >- Whether to enforce SSO. Turning it on needs the connection `active` (409). example: true mfa_policy: type: string enum: - '' - none - admins - all description: Who must prove MFA at the IdP. An empty string is `none`. example: admins accepted_acr_values: type: array maxItems: 10 items: type: string minLength: 1 maxLength: 256 description: >- The `acr` values that prove MFA, at most 10 of 1 to 256 printable characters. example: - phrh break_glass_user_id: type: - string - 'null' format: uuid description: | The break-glass administrator: an Organization Admin of this organization with Qumo TOTP on (422 otherwise). Null for none. example: 8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e SSOPolicyPutResponse: allOf: - $ref: '#/components/schemas/SSOPolicy' - type: object required: - revoked_sessions properties: revoked_sessions: type: integer format: int64 minimum: 0 description: | How many sessions turning enforcement on deleted: the managed accounts' browser and CLI sessions their IdP did not create, except the break-glass administrator's. 0 when enforcement was already on or stays off. example: 4 SSOPolicy: type: object description: | An organization's single sign-on policy. It is kept on the OIDC connection and applies only while the connection is `active`. required: - enforce_sso - mfa_policy - accepted_acr_values - break_glass_user_id - connection_status properties: enforce_sso: type: boolean description: | Whether the organization's managed accounts must sign in through its IdP. Their Google and GitHub sign-ins are refused, except the break-glass administrator's. example: true mfa_policy: $ref: '#/components/schemas/SSOMFAPolicy' accepted_acr_values: type: array items: type: string description: The `acr` values that prove MFA at this IdP. example: - phrh break_glass_user_id: type: - string - 'null' format: uuid description: | The Organization Admin exempt from enforced SSO, who signs in with Google or GitHub and Qumo TOTP; null for none. example: 8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e connection_status: type: string enum: - draft - active - disabled description: >- The connection's status. The policy applies only while it is `active`. example: active Error: type: object required: - error properties: error: type: string description: A human-readable message. example: organization_id is required SSOMFAPolicy: type: string enum: - none - admins - all description: | Who must prove a second factor at the IdP to sign in through the connection: nobody, Organization Admins, or everyone. Proof is an `amr` value naming a second factor (`mfa`, `mca`, `otp`, `hwk`, `swk`, `sc`, `fpt`, `face`, `iris`, `retina`, `vbm`) or an `acr` in `accepted_acr_values`; missing claims prove nothing. responses: BadRequest: description: >- Malformed request or failed validation. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing or invalid credentials. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' PaymentRequired: description: >- The organization's plan does not include this. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: >- Authenticated but not allowed (permission, token scope, IP allowlist or CSRF). See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: >- Not found, or not visible to the caller. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' Conflict: description: >- Conflicts with the current state. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' UnprocessableEntity: description: >- Well-formed but semantically invalid. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: token: type: http scheme: bearer bearerFormat: qumo_pat_ description: > A personal access token (`POST /v1/auth/tokens`) or a machine identity token (`POST /v1/projects/{project_id}/identities/{identity_id}/tokens`), both prefixed `qumo_pat_`. A token's scopes cap what it can do; see [Scopes and permissions](/guides/scopes-permissions). A personal token names no organization: on a route whose path names no project or organization, pass `?organization_id=`. cliSession: type: http scheme: bearer description: | The session token `qumod login` obtains through the device flow (`POST /v1/auth/device/token`). It acts as the signed-in user, like a console session, and needs no CSRF token. sessionCookie: type: apiKey in: cookie name: __Host-qumo_session description: | The console's browser session. Accepted only on the console origin (`https://console.qumo-deploy.com`), never on `api.qumo-deploy.com`. A request that changes state must also send `X-CSRF-Token`. csrfToken: type: apiKey in: header name: X-CSRF-Token description: | CSRF token paired with `sessionCookie` on POST, PUT, PATCH and DELETE. Bearer requests do not send it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.