SAML Identity Providers

The saml_identity_providers client methods are currently in ALPHA. The API may change without notice. A one-time warning is emitted on first use.

Manage SAML single sign-on configurations for your account. A configuration pairs one metadata source (an IdP metadata URL or inline XML) with a set of email domains and login defaults, and carries an ordered list of role mappings that translate SAML assertion attributes into Arize roles. These operations require Enterprise account-admin access.

Key Capabilities

List SAML configurations with cursor-based pagination
Create a configuration from a metadata URL or inline metadata XML
Retrieve, update, and delete a configuration by ID
List, add, update, and remove role mappings on a configuration

Request Bodies

Create and update methods take a body argument that is either a typed request model (imported from arize.saml_identity_providers.types) or a plain JSON-compatible mapping with the same fields. Unknown keys in a mapping are rejected before the request is sent.

Type alias	Used by
`CreateRequest`	`create`
`UpdateRequest`	`update`
`CreateMappingRequest`	`add_role_mapping`
`UpdateMappingRequest`	`update_role_mapping`

List SAML Identity Providers

List SAML configurations with cursor-based pagination (up to 100 per page). The returned summaries omit metadata and role mappings — use get for the full configuration.

resp = client.saml_identity_providers.list(limit=50)

for idp in resp.data:
    print(idp.id, idp.email_domains, idp.enforce_saml)

For details on pagination, field introspection, and data conversion (to dict/JSON/DataFrame), see Response Objects.

Create a SAML Identity Provider

Create a configuration with exactly one metadata source (metadata_url or metadata_xml) and valid login defaults. Domain-verification flags are read-only and cannot be supplied. Non-empty space or project assignments require an organization.

from arize.saml_identity_providers.types import CreateRequest

idp = client.saml_identity_providers.create(
    body=CreateRequest(
        email_domains=["example.com"],
        metadata_url="https://idp.example.com/metadata.xml",
        enforce_saml=False,
        sync_user_roles=True,
        sign_authn=True,
        allow_login_with_defaults=True,
        default_organization_id="your-org-id",        # optional
        default_organization_role_id="your-role-id",  # optional
    ),
)

print(idp.id)

The body may also be a plain mapping with the same fields:

idp = client.saml_identity_providers.create(
    body={
        "email_domains": ["example.com"],
        "metadata_xml": "<EntityDescriptor>...</EntityDescriptor>",
        "enforce_saml": False,
        "sync_user_roles": True,
        "sign_authn": True,
        "allow_login_with_defaults": True,
    },
)

Get a SAML Identity Provider

Retrieve a complete configuration by ID, including file-managed configurations.

idp = client.saml_identity_providers.get(idp_id="your-idp-id")

print(idp.id, idp.email_domains)
print(idp.role_mappings)

Update a SAML Identity Provider

Patch only the fields you supply; omitted fields are left unchanged. Omission, False, None, and empty lists stay distinct. Setting allow_login_with_defaults to False clears all default fields.

from arize.saml_identity_providers.types import UpdateRequest

idp = client.saml_identity_providers.update(
    idp_id="your-idp-id",
    body=UpdateRequest(
        enforce_saml=True,
        email_domains=["example.com", "example.org"],
    ),
)

print(idp.enforce_saml)

Delete a SAML Identity Provider

Remove a disabled configuration by ID. Users and their grants remain. Enforced and file-managed configurations cannot be deleted. There is no response from this call.

client.saml_identity_providers.delete(idp_id="your-idp-id")

print("SAML identity provider deleted")

Manage Role Mappings

Role mappings translate SAML assertion attributes into Arize roles. Each mapping matches a set of attributes and grants account-admin status, an organization role, and/or space and project roles.

List Role Mappings

List a configuration’s role mappings in configuration order, with cursor-based pagination (up to 100 per page).

resp = client.saml_identity_providers.list_role_mappings(
    idp_id="your-idp-id",
    limit=50,
)

for mapping in resp.data:
    print(mapping.id, mapping.attributes, mapping.is_account_admin)

For details on pagination, field introspection, and data conversion (to dict/JSON/DataFrame), see Response Objects.

Add a Role Mapping

Add a mapping to a configuration. The server assigns its persistent ID. Non-empty space or project assignments require an organization.

from arize.saml_identity_providers.types import (
    CreateMappingRequest,
    OrganizationAssignment,
    SpaceAssignment,
)

mapping = client.saml_identity_providers.add_role_mapping(
    idp_id="your-idp-id",
    body=CreateMappingRequest(
        attributes={"group": "engineering"},
        is_account_admin=False,
        organization=OrganizationAssignment(
            organization_id="your-org-id",
            role_id="your-org-role-id",
        ),
        space_roles=[
            SpaceAssignment(space_id="your-space-id", role_id="your-space-role-id"),
        ],
    ),
)

print(mapping.id)

Update a Role Mapping

Patch supplied fields while keeping the mapping ID. Omitted fields remain unchanged. None clears the organization only when the resulting mapping is valid; empty role lists clear assignments.

from arize.saml_identity_providers.types import UpdateMappingRequest

mapping = client.saml_identity_providers.update_role_mapping(
    idp_id="your-idp-id",
    mapping_id="your-mapping-id",
    body=UpdateMappingRequest(
        is_account_admin=True,
    ),
)

print(mapping.id, mapping.is_account_admin)

Remove a Role Mapping

Remove a mapping by ID. Required login and admin mappings are retained. There is no response from this call.

client.saml_identity_providers.remove_role_mapping(
    idp_id="your-idp-id",
    mapping_id="your-mapping-id",
)

print("Role mapping removed")

Skills

MCP server

API reference

API clients

Key Capabilities

Request Bodies

List SAML Identity Providers

Create a SAML Identity Provider

Get a SAML Identity Provider

Update a SAML Identity Provider

Delete a SAML Identity Provider

Manage Role Mappings

List Role Mappings

Add a Role Mapping

Update a Role Mapping

Remove a Role Mapping

​Key Capabilities

​Request Bodies

​List SAML Identity Providers

​Create a SAML Identity Provider

​Get a SAML Identity Provider

​Update a SAML Identity Provider

​Delete a SAML Identity Provider

​Manage Role Mappings

​List Role Mappings

​Add a Role Mapping

​Update a Role Mapping

​Remove a Role Mapping

Key Capabilities

Request Bodies

List SAML Identity Providers

Create a SAML Identity Provider

Get a SAML Identity Provider

Update a SAML Identity Provider

Delete a SAML Identity Provider

Manage Role Mappings

List Role Mappings

Add a Role Mapping

Update a Role Mapping

Remove a Role Mapping