<!-- llms.txt: https://workos.com/llms.txt -->

# IdP Signing Certificate

:::code-group{title="Example SamlIdpSigningCertificate"}

```json language="curl"
{
  "object": "saml_idp_signing_certificate",
  "id": "saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5",
  "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----",
  "not_before": "2026-01-15T12:00:00.000Z",
  "not_after": "2026-01-15T12:00:00.000Z",
  "created_at": "2026-01-15T12:00:00.000Z"
}
```

:::

## Create an IdP signing certificate

Adds an Identity Provider signing certificate to the connection, so SAML responses signed with its key can be verified. Use this to import a new certificate ahead of an Identity Provider rotation — the existing certificates keep working until they are deleted or expire.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request POST \
  --url "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_idp_signing_certs" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----"
    }
BODY
```

```json language="json" title="Response" tab="2"
{
  "object": "saml_idp_signing_certificate",
  "id": "saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5",
  "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----",
  "not_before": "2026-01-15T12:00:00.000Z",
  "not_after": "2026-01-15T12:00:00.000Z",
  "created_at": "2026-01-15T12:00:00.000Z"
}
```

:::

## Delete an IdP signing certificate

Removes an Identity Provider signing certificate from the connection. The last remaining certificate cannot be deleted. A certificate still published in the Identity Provider metadata may be restored by a metadata refresh.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request DELETE \
  --url "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_idp_signing_certs/saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5" \
  --header "Authorization: Bearer sk_example_123456789"
```

:::

## List IdP signing certificates

Lists every Identity Provider signing certificate on the connection, including expired ones, oldest first.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_idp_signing_certs" \
  --header "Authorization: Bearer sk_example_123456789"
```

```json language="json" title="Response" tab="2"
{
  "object": "list",
  "data": [
    {
      "object": "saml_idp_signing_certificate",
      "id": "saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5",
      "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----",
      "not_before": "2026-01-15T12:00:00.000Z",
      "not_after": "2026-01-15T12:00:00.000Z",
      "created_at": "2026-01-15T12:00:00.000Z"
    }
  ]
}
```

:::

### saml_idp_signing_certificate

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `object` | "saml_idp_signing_certificate" | Yes | Distinguishes the SAML Identity Provider signing certificate object. |
| `id` | string | Yes | Unique identifier for the Identity Provider signing certificate. |
| `value` | string | Yes | The PEM-encoded public X.509 certificate. |
| `not_before` | string | No | When the certificate becomes valid. |
| `not_after` | string | No | When the certificate expires. |
| `created_at` | string | Yes | An ISO 8601 timestamp. |

### POST /connections/{connectionId}/saml_idp_signing_certs

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `value` | string | Yes | The PEM-encoded X.509 certificate. |

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `connectionId` | string | Yes | Unique identifier for the Connection. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `saml_idp_signing_certificate` | object | Distinguishes the SAML Identity Provider signing certificate object. |

### DELETE /connections/{connectionId}/saml_idp_signing_certs/{certificateId}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `connectionId` | string | Yes | Unique identifier for the Connection. |
| `certificateId` | string | Yes | Unique identifier for the Identity Provider signing certificate. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `empty` | empty | Returns an empty response on success. |

### GET /connections/{connectionId}/saml_idp_signing_certs

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `connectionId` | string | Yes | Unique identifier for the Connection. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `list` | object |  |