Lists every Identity Provider signing certificate on the connection, including expired ones, oldest first.
cURL
| curl "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_idp_signing_certs" \ | |
| --header "Authorization: Bearer sk_example_123456789" |
| { | |
| "object": "list", | |
| "data": [ | |
| { | |
| "object": "saml_idp_signing_certificate", | |
| "id": "saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5", | |
| "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----", | |
| "not_before": "2026-01-15T12:00:00.000Z", | |
| "not_after": "2026-01-15T12:00:00.000Z", | |
| "created_at": "2026-01-15T12:00:00.000Z" | |
| } | |
| ] | |
| } |
Feature flagged
GET/connections
Parameters
Returns
Adds an Identity Provider signing certificate to the connection, so SAML responses signed with its key can be verified. Use this to import a new certificate ahead of an Identity Provider rotation – the existing certificates keep working until they are deleted or expire.
cURL
| curl --request POST \ | |
| --url "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_idp_signing_certs" \ | |
| --header "Authorization: Bearer sk_example_123456789" \ | |
| --header "Content-Type: application/json" \ | |
| -d @- <<'BODY' | |
| { | |
| "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----" | |
| } | |
| BODY |
| { | |
| "object": "saml_idp_signing_certificate", | |
| "id": "saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5", | |
| "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----", | |
| "not_before": "2026-01-15T12:00:00.000Z", | |
| "not_after": "2026-01-15T12:00:00.000Z", | |
| "created_at": "2026-01-15T12:00:00.000Z" | |
| } |
Feature flagged
POST/connections
Parameters
Returns
Removes an Identity Provider signing certificate from the connection. The last remaining certificate cannot be deleted. A certificate still published in the Identity Provider metadata may be restored by a metadata refresh.
cURL
| curl --request DELETE \ | |
| --url "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_idp_signing_certs/saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5" \ | |
| --header "Authorization: Bearer sk_example_123456789" |
Feature flagged
DELETE