> ## Documentation Index
> Fetch the complete documentation index at: https://api-docs.select.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an SSO group

> Map a group from your identity provider and grant it its first roles.

Members of the group receive these roles when they log in. At least one role
is required: a group exists only for the roles it carries.



## OpenAPI

````yaml https://api.select.dev/v2/openapi.json post /sso-groups
openapi: 3.1.0
info:
  title: SELECT API (v2)
  version: 0.1.0
servers:
  - url: https://api.select.dev/v2
    description: SELECT API v2
security: []
paths:
  /sso-groups:
    post:
      tags:
        - sso-groups
      summary: Create an SSO group
      description: >-
        Map a group from your identity provider and grant it its first roles.


        Members of the group receive these roles when they log in. At least one
        role

        is required: a group exists only for the roles it carries.
      operationId: create_sso_group_route_sso_groups_post
      parameters:
        - name: x-tenant-id
          in: header
          required: true
          schema:
            type: string
            description: The organization ID the request is scoped to.
            title: X-Tenant-Id
          description: The organization ID the request is scoped to.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SsoGroupCreateV2'
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SsoGroupV2'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
components:
  schemas:
    SsoGroupCreateV2:
      properties:
        name:
          type: string
          minLength: 1
          title: Name
          description: >-
            The group name, which must match the group as your identity provider
            reports it. This is also the group's id.
        roles:
          items:
            $ref: '#/components/schemas/SsoGroupRoleGrantCreateV2'
          type: array
          minItems: 1
          title: Roles
          description: >-
            The roles to grant the group's members. At least one is required — a
            group exists only for the roles it carries.
      additionalProperties: false
      type: object
      required:
        - name
        - roles
      title: SsoGroupCreateV2
    SsoGroupV2:
      properties:
        id:
          type: string
          title: Id
          description: The unique identifier of the group, which is its name.
          readOnly: true
          x-terraform-computed: true
        name:
          type: string
          title: Name
          description: The group name as it appears in your identity provider.
        create_time:
          type: string
          title: Create Time
          description: >-
            When the group's earliest role was granted — RFC 3339 UTC, e.g.
            2026-06-05T10:30:00Z.
          readOnly: true
          x-terraform-computed: true
        update_time:
          type: string
          title: Update Time
          description: When any of the group's roles last changed — RFC 3339 UTC.
          readOnly: true
          x-terraform-computed: true
        etag:
          type: string
          title: Etag
          description: Opaque strong ETag for optimistic concurrency.
          readOnly: true
          x-terraform-computed: true
      type: object
      required:
        - id
        - name
        - create_time
        - update_time
        - etag
      title: SsoGroup
      description: >-
        A group from your identity provider, and a carrier for the roles its

        members receive when they log in.


        A group is identified by its name: ``id`` and ``name`` always hold the
        same

        value. Renaming one therefore changes the other, and the group's URL
        with it.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    SsoGroupRoleGrantCreateV2:
      properties:
        role:
          $ref: '#/components/schemas/AccessRole'
          description: The role to grant the group's members.
        scope:
          anyOf:
            - $ref: '#/components/schemas/RoleGrantScope'
            - type: 'null'
          description: >-
            The resource the role applies to. Omit to grant it across the whole
            organization.
      additionalProperties: false
      type: object
      required:
        - role
      title: SsoGroupRoleGrantCreateV2
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
    AccessRole:
      type: string
      enum:
        - admin
        - editor
        - monitor_editor
        - viewer
        - team_creator
      title: AccessRole
      description: The permission level a role grant confers.
    RoleGrantScope:
      properties:
        type:
          $ref: '#/components/schemas/RoleGrantScopeType'
          description: The kind of resource this grant applies to.
        id:
          anyOf:
            - type: string
            - type: 'null'
          title: Id
          description: >-
            Identifier of the resource — the Snowflake organization name,
            Snowflake account UUID, Databricks account id, Databricks connection
            id, BigQuery connection id, AWS account id, Tableau site LUID, or
            usage group id. Required for every scope type except organization.
      additionalProperties: false
      type: object
      required:
        - type
      title: RoleGrantScope
      description: The resource a role grant applies to.
    RoleGrantScopeType:
      type: string
      enum:
        - organization
        - snowflake_organization
        - snowflake_account
        - databricks_account
        - databricks_connection
        - bigquery_connection
        - aws_account
        - tableau_site
        - usage_group
      title: RoleGrantScopeType
      description: The kind of resource a role grant applies to.
  securitySchemes:
    HTTPBearer:
      type: http
      description: Organization API key (sl_…).
      scheme: bearer

````