Returns the public certificate the Identity Provider can use to verify the signature of SAML requests sent by WorkOS. Responds with 404 when the connection has no request signing key pair.
cURL
| curl "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_sp_signing_cert" \ | |
| --header "Authorization: Bearer sk_example_123456789" |
| { | |
| "object": "saml_sp_signing_certificate", | |
| "id": "saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5", | |
| "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----", | |
| "not_before": "2026-01-15T12:00:00.000Z", | |
| "not_after": "2026-01-15T12:00:00.000Z", | |
| "created_at": "2026-01-15T12:00:00.000Z" | |
| } |
Feature flagged
GET/connections
Parameters
Returns
Generates a new request signing key pair for the connection and returns its public certificate. WorkOS holds the private key, so the request takes no body – to bring your own key pair, provide saml_options.sp_signing_key_pair when creating the connection instead. A connection signs with one key pair at a time: delete the existing certificate before creating its replacement.
cURL
| curl --request POST \ | |
| --url "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_sp_signing_cert" \ | |
| --header "Authorization: Bearer sk_example_123456789" |
| { | |
| "object": "saml_sp_signing_certificate", | |
| "id": "saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5", | |
| "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----", | |
| "not_before": "2026-01-15T12:00:00.000Z", | |
| "not_after": "2026-01-15T12:00:00.000Z", | |
| "created_at": "2026-01-15T12:00:00.000Z" | |
| } |
Feature flagged
POST/connections
Parameters
Returns
Removes the request signing key pair from the connection, after which SAML requests are sent unsigned. Delete the certificate before creating its replacement when rotating.
cURL
| curl --request DELETE \ | |
| --url "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_sp_signing_cert/saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5" \ | |
| --header "Authorization: Bearer sk_example_123456789" |
Feature flagged
DELETE