<!-- llms.txt: https://workos.com/llms.txt -->

# SP Signing Certificate

:::code-group{title="Example SamlSpSigningCertificate"}

```json language="curl"
{
  "object": "saml_sp_signing_certificate",
  "id": "saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5",
  "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----",
  "not_before": "2026-01-15T12:00:00.000Z",
  "not_after": "2026-01-15T12:00:00.000Z",
  "created_at": "2026-01-15T12:00:00.000Z"
}
```

:::

## Create an SP signing certificate

Generates a new request signing key pair for the connection and returns its public certificate. WorkOS holds the private key, so the request takes no body — to bring your own key pair, provide `saml_options.sp_signing_key_pair` when creating the connection instead. A connection signs with one key pair at a time: delete the existing certificate before creating its replacement.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request POST \
  --url "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_sp_signing_cert" \
  --header "Authorization: Bearer sk_example_123456789"
```

```json language="json" title="Response" tab="2"
{
  "object": "saml_sp_signing_certificate",
  "id": "saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5",
  "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----",
  "not_before": "2026-01-15T12:00:00.000Z",
  "not_after": "2026-01-15T12:00:00.000Z",
  "created_at": "2026-01-15T12:00:00.000Z"
}
```

:::

## Delete the SP signing certificate

Removes the request signing key pair from the connection, after which SAML requests are sent unsigned. Delete the certificate before creating its replacement when rotating.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request DELETE \
  --url "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_sp_signing_cert/saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5" \
  --header "Authorization: Bearer sk_example_123456789"
```

:::

## Get the SP signing certificate

Returns the public certificate the Identity Provider can use to verify the signature of SAML requests sent by WorkOS. Responds with `404` when the connection has no request signing key pair.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/connections/conn_01E4ZCR3C56J083X43JQXF3JK5/saml_sp_signing_cert" \
  --header "Authorization: Bearer sk_example_123456789"
```

```json language="json" title="Response" tab="2"
{
  "object": "saml_sp_signing_certificate",
  "id": "saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5",
  "value": "-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----",
  "not_before": "2026-01-15T12:00:00.000Z",
  "not_after": "2026-01-15T12:00:00.000Z",
  "created_at": "2026-01-15T12:00:00.000Z"
}
```

:::

### saml_sp_signing_certificate

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `object` | "saml_sp_signing_certificate" | Yes | Distinguishes the SAML Service Provider signing certificate object. |
| `id` | string | Yes | Unique identifier for the Service Provider signing key pair. WorkOS holds the corresponding private key, which is never exposed. |
| `value` | string | Yes | The PEM-encoded public X.509 certificate. |
| `not_before` | string | No | When the certificate becomes valid. |
| `not_after` | string | No | When the certificate expires. |
| `created_at` | string | Yes | An ISO 8601 timestamp. |

### POST /connections/{connectionId}/saml_sp_signing_cert

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `connectionId` | string | Yes | Unique identifier for the Connection. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `saml_sp_signing_certificate` | object | Distinguishes the SAML Service Provider signing certificate object. |

### DELETE /connections/{connectionId}/saml_sp_signing_cert/{certificateId}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `connectionId` | string | Yes | Unique identifier for the Connection. |
| `certificateId` | string | Yes | Unique identifier for the Service Provider signing key pair. WorkOS holds the corresponding private key, which is never exposed. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `empty` | empty | Returns an empty response on success. |

### GET /connections/{connectionId}/saml_sp_signing_cert

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `connectionId` | string | Yes | Unique identifier for the Connection. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `saml_sp_signing_certificate` | object | Distinguishes the SAML Service Provider signing certificate object. |