Lists the public certificates the Identity Provider can use to encrypt SAML responses sent to WorkOS, including expired ones, oldest first.
| curl "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_sp_encryption_certs" \ | |
| --header "Authorization: Bearer sk_example_123456789" |
| { | |
| "object": "list", | |
| "data": [ | |
| { | |
| "object": "saml_sp_encryption_certificate", | |
| "id": "saml_enc_key_pair_01E4ZCR3C56J083X43JQXF3JK5", | |
| "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----", | |
| "not_before": "2026-01-15T12:00:00.000Z", | |
| "not_after": "2026-01-15T12:00:00.000Z", | |
| "created_at": "2026-01-15T12:00:00.000Z" | |
| } | |
| ] | |
| } |
GET/connections
Parameters
Returns
Generates a new encryption key pair for the connection and returns its public certificate. WorkOS holds the private key, so the request takes no body – to bring your own key pairs, provide saml_options.sp_encryption_key_pairs when creating the connection instead. Creating a certificate appends rather than replaces: every active private key is tried when decrypting, which lets a rotation overlap the old and new certificates.
| curl --request POST \ | |
| --url "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_sp_encryption_certs" \ | |
| --header "Authorization: Bearer sk_example_123456789" |
| { | |
| "object": "saml_sp_encryption_certificate", | |
| "id": "saml_enc_key_pair_01E4ZCR3C56J083X43JQXF3JK5", | |
| "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----", | |
| "not_before": "2026-01-15T12:00:00.000Z", | |
| "not_after": "2026-01-15T12:00:00.000Z", | |
| "created_at": "2026-01-15T12:00:00.000Z" | |
| } |
POST/connections
Parameters
Returns
Removes an encryption key pair from the connection. SAML responses encrypted with its certificate can no longer be decrypted, so remove the certificate from the Identity Provider first when rotating.
| curl --request DELETE \ | |
| --url "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_sp_encryption_certs/saml_enc_key_pair_01E4ZCR3C56J083X43JQXF3JK5" \ | |
| --header "Authorization: Bearer sk_example_123456789" |
DELETE