> ## Documentation Index > Fetch the complete documentation index at: https://docs.prelude.so/llms.txt > Use this file to discover all available pages before exploring further. # Update enterprise OAuth connection > Update an enterprise OIDC SSO connection. The config type is immutable, and the `enterprise` block's `email_domain_allowlist` must stay non-empty and must not overlap another connection's. ## OpenAPI ````yaml put /v2/session/apps/{appID}/config/login/oauth/{provider}/{connectionID} openapi: 3.1.1 info: title: Prelude Session Management API version: 0.0.1 summary: The Prelude API for Session Management description: The Prelude API for Session Management. contact: email: support@prelude.so url: https://prelude.so servers: - url: https://api.prelude.dev description: Production server security: - Authorization: [] tags: - name: Mode description: Manage the mode (dev/prod) of your application. - name: Tokens description: Mint development tokens for your application. - name: Users description: Manage the users of your application. - name: Webhooks description: Manage the webhooks of your application. - name: Domains description: Manage the domains of your application. - name: Config - Scopes description: Manage the scope configuration of your application. - name: Config - Groups description: >- Manage the group configuration of your application. A group owns a set of scopes; users assigned to a group are granted the group's scopes. - name: Config - Claims description: Manage the claims mapping configuration of your application. - name: Config - Step-up description: Manage the step-up authentication configuration of your application. - name: Config - Migration description: Manage the user migration configuration of your application. - name: Config - Login OTP description: Manage the OTP login configuration of your application. - name: Config - Login OAuth description: Manage the OAuth login configuration of your application. - name: Config - Login SAML description: Manage the SAML 2.0 SSO connections of your application. - name: Config - Login Password description: Manage the password login configuration of your application. - name: Config - Passkey description: Manage the WebAuthn passkey configuration of your application. - name: Config - OAuth Server description: >- Configure your application as an OAuth 2.0 authorization server so MCP clients and other third-party apps can sign your users in. paths: /v2/session/apps/{appID}/config/login/oauth/{provider}/{connectionID}: parameters: - $ref: '#/components/parameters/appIDParam' - $ref: '#/components/parameters/providerParam' - $ref: '#/components/parameters/oauthConnectionIDParam' put: tags: - Config - Login OAuth summary: Update enterprise OAuth connection description: | Update an enterprise OIDC SSO connection. The config type is immutable, and the `enterprise` block's `email_domain_allowlist` must stay non-empty and must not overlap another connection's. operationId: updateEnterpriseOauthConnection requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PutLoginOauthConfigRequest' responses: '200': description: OK content: application/json: schema: type: object properties: config: $ref: '#/components/schemas/LoginOauthConfigResponse' required: - config '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/InvalidRequestError' '404': description: Not Found content: application/json: schema: oneOf: - $ref: '#/components/schemas/AppNotFoundError' - $ref: '#/components/schemas/OAuthConfigNotFoundError' '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/OAuthEmailDomainConflictError' components: parameters: appIDParam: in: path name: appID required: true description: The id of the app the request refers to. schema: $ref: '#/components/schemas/AppID' providerParam: in: path name: provider required: true description: The OAuth provider identifier. schema: type: string examples: - google - apple - github - microsoft - okta - facebook - linkedin oauthConnectionIDParam: in: path name: connectionID required: true description: The enterprise OAuth connection identifier (prefixed with `ocon_`). schema: type: string examples: - ocon_01jqebhswje1ka1z7ahr9rfsgt schemas: PutLoginOauthConfigRequest: type: object properties: type: $ref: '#/components/schemas/OauthConfigType' client_id: type: string examples: - 123456789.apps.googleusercontent.com client_secret: type: string examples: - GOCSPX-abc123def456 enabled: type: boolean examples: - true scopes: type: array items: type: string examples: - openid - email - profile description: Scopes requested from the OAuth provider (IdP). granted_scopes: type: array items: type: string description: >- Prelude session scopes attached to the session when a login completes through this social provider (for example `prld:pwd:write`). Distinct from `scopes`, which are requested from the IdP. examples: - - prld:pwd:write options: $ref: '#/components/schemas/OauthOptions' apple: $ref: '#/components/schemas/AppleOauthConfig' okta: $ref: '#/components/schemas/OktaOauthConfig' enterprise: allOf: - $ref: '#/components/schemas/EnterpriseOauthConfig' description: >- Required when `type` is `enterprise`. The config type is immutable across updates. required: - client_id LoginOauthConfigResponse: type: object properties: provider_id: type: string examples: - google type: $ref: '#/components/schemas/OauthConfigType' connection_id: type: string description: >- Present only for enterprise configs; the connection this config addresses. examples: - ocon_01jqebhswje1ka1z7ahr9rfsgt client_id: type: string examples: - 123456789.apps.googleusercontent.com enabled: type: boolean examples: - true scopes: type: array items: type: string examples: - openid - email - profile description: Scopes requested from the OAuth provider (IdP). granted_scopes: type: array items: type: string description: >- Prelude session scopes attached to the session when a login completes through this social provider (for example `prld:pwd:write`). Distinct from `scopes`, which are requested from the IdP. examples: - - prld:pwd:write options: $ref: '#/components/schemas/OauthOptions' apple: $ref: '#/components/schemas/AppleOauthConfig' okta: $ref: '#/components/schemas/OktaOauthConfig' enterprise: $ref: '#/components/schemas/EnterpriseOauthConfig' created_at: type: string format: date-time examples: - '2025-03-15T10:30:00Z' updated_at: type: string format: date-time examples: - '2025-03-15T12:00:00Z' required: - provider_id - type - client_id - enabled - scopes - options - created_at - updated_at InvalidRequestError: type: object properties: code: type: string enum: - invalid_request examples: - invalid_request status: type: string enum: - bad_request examples: - bad_request message: type: string examples: - The request body is invalid. required: - code - status - message AppNotFoundError: type: object properties: code: type: string enum: - app_not_found examples: - app_not_found status: type: string enum: - not_found examples: - not_found message: type: string examples: - The application was not found. required: - code - status - message OAuthConfigNotFoundError: type: object properties: code: type: string enum: - oauth_config_not_found examples: - oauth_config_not_found status: type: string enum: - not_found examples: - not_found message: type: string examples: - The OAuth configuration was not found. required: - code - status - message OAuthEmailDomainConflictError: type: object properties: code: type: string enum: - oauth_email_domain_conflict examples: - oauth_email_domain_conflict status: type: string enum: - conflict examples: - conflict message: type: string examples: - An email domain is already claimed by another OAuth connection. required: - code - status - message AppID: type: string description: An application's unique identifier. examples: - 54e9ujn - fvua38g OauthConfigType: type: string enum: - personal - enterprise default: personal description: | `personal` is the classic social-login config (at most one per provider, addressed as `…/oauth/{provider}`). `enterprise` is a per-connection OIDC SSO config (any number per provider, addressed as `…/oauth/{provider}/{connectionID}`). Defaults to `personal`. examples: - enterprise OauthOptions: type: object properties: use_email_as_identifier: type: boolean examples: - true description: | When `true`, creates an email identifier on new OAuth users whose email is verified by the IdP (or via the `verify_email` OTP flow). allow_email_account_merge: type: boolean examples: - false description: | When `true`, links the OAuth identifier to an existing user that already owns the same email address (verified by the IdP or via `verify_email`). Without this flag, an email collision with an existing account is rejected with `email_in_use`. verify_email: type: boolean examples: - false description: | When `true`, kicks in only if the IdP returns an unverified email. The OAuth callback redirects with `status=otp_required` and the `challenge_token` query parameter; the SDK sends an OTP to the email and the user must validate ownership before the OAuth identifier is attached to (or creates) an account. Requires `use_email_as_identifier=true` and at least one email OTP login config — these preconditions are checked at write time. When `verify_email=true` but `use_email_as_identifier` is later disabled, the OTP step is skipped at runtime and the account is created with only the OAuth identifier. AppleOauthConfig: type: object properties: team_id: type: string examples: - ABCDEF1234 key_id: type: string examples: - KEY123456 p8_key: type: string examples: - |- -----BEGIN PRIVATE KEY----- MIGT...base64...== -----END PRIVATE KEY----- OktaOauthConfig: type: object properties: issuer_url: type: string format: uri examples: - https://dev-123456.okta.com/oauth2/default EnterpriseOauthConfig: type: object description: >- Per-connection enterprise (OIDC SSO) fields. Present only for enterprise configs. properties: issuer_url: type: string format: uri description: >- The IdP's OIDC issuer (https). For Okta, the authorization server URL. examples: - https://acme.okta.com/oauth2/default email_domain_allowlist: type: array items: type: string description: | Email domains this connection covers. Required and non-empty for enterprise configs. It is the domain→connection binding used for email-resolved login, and every login's IdP-asserted email must fall within it. examples: - - acme.com jit_provisioning: type: boolean description: When `true`, just-in-time provisions a new user on first login. examples: - true allow_email_account_merge: type: boolean description: >- When `true`, links the OIDC identifier to an existing user that owns the same email. examples: - true enforce_login: type: boolean description: Reserved for future parity with SAML SSO enforcement. examples: - false sync_profile_on_login: type: boolean description: >- When `true`, refreshes name, given_name, family_name, and picture from the IdP on every login. examples: - true default_redirect_uri: type: string description: >- Redirect URI used when a login flow omits `redirect_uri`. Must be allowlisted for the app. examples: - https://acme.yourapp.com/callback claim_mapping: $ref: '#/components/schemas/OauthClaimMapping' required: - issuer_url - email_domain_allowlist OauthClaimMapping: type: object description: Overrides for the id_token claim names used to read profile fields. properties: email: type: string examples: - email given_name: type: string examples: - given_name family_name: type: string examples: - family_name custom: type: object additionalProperties: type: string description: Maps logical profile keys to arbitrary id_token claim names. securitySchemes: Authorization: type: http scheme: bearer ````