Internal Users

Set an internal user's SSO id

PUT/internal-users/{userId}/sso-id
internal-users:writeset_internal_user_sso_idDestructiveIdempotentDeprecatedSunset 2027-06-30

Sets (or clears, with null) the user's SSO id. A dedicated idempotent endpoint for SSO-provisioning integrations; writes the field read as sso_id by GET /internal-users/{id}, which PATCH cannot change.

Deprecated: withdrawn on 2027-06-30. POST /internal-users/{id}/actions/set-sso-id replaces it; every answer carries a Link header with rel="successor-version". This route keeps its old body and answer. An id that another user holds returns 422 unique.

Path parameters

  • userIdstring (uuid)Required#

    The user's public guid.

Request body

application/json, required

  • ssoIdstring | nullRequired#
{
  "ssoId": "okta|00u1a2b3c4d5e6f7g8h9"
}

Responses

200

OK

User
{
  "data": {
    "id": "6f1c2e8a-1b2c-4d5e-8f90-1a2b3c4d5e6f",
    "first_name": "Ada",
    "last_name": "Lovelace",
    "email": "ada.lovelace@example.com",
    "type": "investor",
    "status": "active",
    "created_at": "2026-06-15T10:30:00+00:00",
    "updated_at": "2026-06-15T10:30:00+00:00"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error
404

Resource not found (error.code = not_found).

Error
409

The user is provisioned by SCIM (error.code = scim_managed), so this change must be made through the identity provider instead.

Error
422

Request validation failed (HTTP 422). The body is either the Laravel validation envelope (message + field-keyed errors) or the API error envelope for domain rejections (e.g. form_type_not_supported, folder_locked, parent_not_found, folder_not_empty).

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X PUT https://your-org-domain/kong/core/api/v2/internal-users/{userId}/sso-id\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "ssoId": "okta|00u1a2b3c4d5e6f7g8h9"
}'