🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The newSamlIdentityProvider() mutation registers a new SAML identity provider in LogScale, enabling SAML-based single sign-on for your organization. Provide the provider name, entity ID, sign-on URL, and one or more associated domains to create the configuration. After creating the provider, use updateSamlIdentityProvider() to modify its settings. To retrieve an existing provider's configuration, use the samlIdentityProvider() query.

Syntax

graphql
newSamlIdentityProvider(
      id: String,
      name: String!,
      signOnUrl: String!,
      idpCertificateInBase64: String,
      idpEntityId: String!,
      domains: [String!]!,
      groupMembershipAttribute: String,
      userAttribute: String,
      enableDebug: Boolean = false,
      adminAttribute: String,
      adminAttributeMatch: String,
      defaultIdp: Boolean,
      humioOwned: Boolean,
      lazyCreateUsers: Boolean,
      alternativeIdpCertificateInBase64: String,
      metadataEndpointUrl: String
   ): SamlIdentityProvider!

The required arguments are name, idpEntityId, domains, and signOnUrl. All remaining arguments are optional. See the Input Parameters section for details on each argument.

The mutation returns a non-null SamlIdentityProvider object. The returned object includes the generated identifier for the new configuration, which you can pass to subsequent mutations such as updateSamlIdentityProvider(). See the Returned Values section for the full list of available fields.

Example

Raw
graphql
mutation {
  newSamlIdentityProvider(
     name: "Samuel-IDP",
     signOnUrl: "https://my.samlidp.com",
     idpCertificateInBase64: "12345678",
     idpEntityId: "abc123",
     domains: ["humio"]
  )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  newSamlIdentityProvider(
     name: \"Samuel-IDP\",
     signOnUrl: \"https://my.samlidp.com\",
     idpCertificateInBase64: \"12345678\",
     idpEntityId: \"abc123\",
     domains: [\"humio\"]
  )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  newSamlIdentityProvider(
     name: \"Samuel-IDP\",
     signOnUrl: \"https://my.samlidp.com\",
     idpCertificateInBase64: \"12345678\",
     idpEntityId: \"abc123\",
     domains: [\"humio\"]
  )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  newSamlIdentityProvider( ^
     name: \"Samuel-IDP\", ^
     signOnUrl: \"https://my.samlidp.com\", ^
     idpCertificateInBase64: \"12345678\", ^
     idpEntityId: \"abc123\", ^
     domains: [\"humio\"] ^
  ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  newSamlIdentityProvider(
     name: \"Samuel-IDP\",
     signOnUrl: \"https://my.samlidp.com\",
     idpCertificateInBase64: \"12345678\",
     idpEntityId: \"abc123\",
     domains: [\"humio\"]
  )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  newSamlIdentityProvider(
     name: \"Samuel-IDP\",
     signOnUrl: \"https://my.samlidp.com\",
     idpCertificateInBase64: \"12345678\",
     idpEntityId: \"abc123\",
     domains: [\"humio\"]
  )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  newSamlIdentityProvider(
     name: \"Samuel-IDP\",
     signOnUrl: \"https://my.samlidp.com\",
     idpCertificateInBase64: \"12345678\",
     idpEntityId: \"abc123\",
     domains: [\"humio\"]
  )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  newSamlIdentityProvider(
     name: \"Samuel-IDP\",
     signOnUrl: \"https://my.samlidp.com\",
     idpCertificateInBase64: \"12345678\",
     idpEntityId: \"abc123\",
     domains: [\"humio\"]
  )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    id: "def456"
    }
  }
}

Input Parameters

The required parameters are name, idpEntityId, domains, and signOnUrl. The following table describes all available input parameters:

Table: Input Parameters & Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this mutation.
adminAttribute string     The SAML attribute name used for admin role assignment. This parameter is for internal use only.
adminAttributeMatch string     The value of the admin attribute that grants admin access. This parameter is for internal use only.
alternativeIdpCertificateInBase64 string     An alternative certificate for identity provider signature validation, encoded in Base64. Supply this parameter during certificate rollover to maintain authentication continuity while rotating signing certificates.
defaultIdp boolean     When multiple identity providers are configured, the provider marked as default handles login redirects. Set to true to make this provider the default. Omitting this parameter leaves the existing default unchanged.
domains [string] yes   The list of email domains associated with this identity provider. LogScale uses these domains to route users to the correct provider at login.
enableDebug boolean   false Enables debug logging for SAML authentication exchanges. Set to true to capture detailed SAML request and response data for troubleshooting.
groupMembershipAttribute string     The SAML attribute name that carries group membership information. LogScale reads this attribute from the SAML assertion to assign users to groups.
humioOwned boolean     Marks the provider as owned by LogScale. This parameter is for internal use only.
id string     An optional externally specified identifier for the provider. Requires root-level permissions. If omitted, LogScale generates an identifier automatically.
idpCertificateInBase64 string     The identity provider's X.509 signing certificate, encoded in Base64. LogScale uses this certificate to validate SAML assertions from the provider.
idpEntityId string yes   The globally unique identifier for the identity provider entity, as defined in the provider's SAML metadata. This value must match the EntityID in the IdP's metadata document.
lazyCreateUsers boolean     Automatically creates a LogScale user account on first successful login when no matching account exists. When set to false or omitted, only pre-provisioned users can authenticate.
metadataEndpointUrl string     The URL of the SAML metadata endpoint. LogScale fetches the IdP signing certificate from this endpoint. Provide this parameter as an alternative to supplying idpCertificateInBase64.
name string yes   A human-readable display name for the SAML identity provider. This name appears in the LogScale authentication configuration and in user-facing login selections.
signOnUrl string yes   The URL of the identity provider's single sign-on endpoint. LogScale redirects authentication requests to this URL to initiate the SAML flow.
userAttribute string     The SAML attribute name that carries the username. When provided, LogScale reads this attribute from the SAML assertion to identify the authenticated user instead of using the default NameID.

Returned Values

The mutation returns a SamlIdentityProvider object representing the newly created provider. The returned fields include the generated provider identifier, the sign-on URL, certificate data, domain list, and configuration flags. Use the returned identifier with subsequent mutations such as updateSamlIdentityProvider().

Table: SamlIdentityProvider Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
adminAttributestring  Long-Term This field is for internal use only by LogScale.
adminAttributeMatchstring  Long-Term This field is for internal use only by LogScale.
alternativeIdpCertificateInBase64string  Long-Term An alternative IdP certificate using Base64 encoding.
authenticationMethodAuthenticationMethodAuthyes Long-Term The authentication method used. See AuthenticationMethodAuth.
debugbooleanyes Long-Term Whether debugging is enabled.
defaultIdpbooleanyes Long-Term Whether the identity service provider is the default.
domains[string]yes Long-Term The domains of the SAML identity provider.
groupMembershipAttributestring  Long-Term The saml attribute used to extract groups from when receiving the SamlResponse from the IDP. The groups from the response will be used to synchronize the membership of groups in LogScale. The group name and external provider name of the group are matched in LogScale.
humioManagedbooleanyes Long-Term Where SAML authentication is managed by LogScale.
idstringyes Long-Term The unique identifier for the SAML installation.
idpCertificateInBase64stringyes Long-Term The identity provider's certificated converted to Base64.
idpEntityIdstringyes Long-Term The unique identifier of the IDP entity.
lazyCreateUsersbooleanyes Long-Term Whether to wait to create users until necessary.
metadataEndpointUrlstring  Long-Term The SAML metadata endpoint from where to fetch the IdP signing certificate.
namestringyes Long-Term The name of the SAML identity provider.
signOnUrlstringyes Long-Term The URL of where the sign on page is located.
userAttributestring  Long-Term This is the saml attribute from which to extract username when receiving the SamlResponse from the IDP. If not specified, the default saml:NameID will be used.