Create an SSO group
Map a group from your identity provider and grant it its first roles.
Members of the group receive these roles when they log in. At least one role is required: a group exists only for the roles it carries.
Authorizations
Organization API key (sl_…).
Headers
The organization ID the request is scoped to.
Body
The group name, which must match the group as your identity provider reports it. This is also the group's id.
1The roles to grant the group's members. At least one is required — a group exists only for the roles it carries.
1Response
Successful Response
A group from your identity provider, and a carrier for the roles its members receive when they log in.
A group is identified by its name: id and name always hold the same
value. Renaming one therefore changes the other, and the group's URL with it.
The unique identifier of the group, which is its name.
The group name as it appears in your identity provider.
When the group's earliest role was granted — RFC 3339 UTC, e.g. 2026-06-05T10:30:00Z.
When any of the group's roles last changed — RFC 3339 UTC.
Opaque strong ETag for optimistic concurrency.

