🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The updateSamlIdentityProvider() mutation modifies a SAML identity provider configuration in LogScale. Use it when you need to update sign-on URLs, certificates, domains, or other provider settings after initial setup with newSamlIdentityProvider(). Provide the provider's id along with all required fields. The mutation replaces the stored configuration with the values you supply.

Syntax

graphql
updateSamlIdentityProvider(
      id: String!,
      name: String!,
      signOnUrl: String!,
      idpCertificateInBase64: String,
      idpEntityId: String!,
      domains: [String!]!,
      groupMembershipAttribute: String,
      userAttribute: String,
      enableDebug: Boolean = false,
      adminAttribute: String,
      adminAttributeMatch: String,
      defaultIdp: Boolean,
      humioOwned: Boolean,
      lazyCreateUsers: Boolean,
      alternativeIdpCertificateInBase64: String,
      metadataEndpointUrl: String
   ): SamlIdentityProvider!

The required arguments are id, name, signOnUrl, idpEntityId, and domains. All other arguments are optional. The mutation returns a non-null SamlIdentityProvider object reflecting the updated configuration.

Input parameters

Supply the provider id, display name, signOnUrl, idpEntityId, and domains in every call. The remaining parameters are optional and control certificate handling, user provisioning, and debug behavior.

Table: Input parameters and datatypes

Parameter Type Required Default Description
This table contains all input parameters for this mutation.
adminAttribute string     For internal use only.
adminAttributeMatch string     For internal use only.
alternativeIdpCertificateInBase64 string     An alternative certificate for identity provider signature validation. Use this during certificate rollover to maintain authentication continuity while transitioning to a new certificate.
defaultIdp boolean     When multiple identity providers are configured, LogScale redirects unauthenticated users to the default provider. Set to true to designate this provider as the default.
domains [string!] yes   The list of email domains associated with this identity provider. LogScale routes authentication requests for users in these domains to this provider.
enableDebug boolean   false Enables debug logging for SAML authentication flows involving this provider. Use when troubleshooting login failures or certificate validation issues.
groupMembershipAttribute string     The name of the SAML assertion attribute whose values list the user's group memberships. LogScale uses these values to assign the user to matching groups on login.
humioOwned boolean     For internal use only.
id string yes   The unique identifier of the SAML identity provider to update. Retrieve this value with samlIdentityProvider().
idpCertificateInBase64 string     The primary identity provider signing certificate, PEM-encoded and converted to Base64. LogScale uses this certificate to validate the signature on incoming SAML assertions.
idpEntityId string yes   The entity identifier of the identity provider, as defined in the IdP's SAML metadata. This is typically a URL. The value must match exactly what the IdP includes in its SAML assertions.
lazyCreateUsers boolean     When true, LogScale creates a user account automatically on first login if one does not already exist. When false or unset, users must be provisioned before they can log in.
metadataEndpointUrl string     The URL of the SAML metadata endpoint. LogScale fetches the identity provider's signing certificate from this endpoint. Provide this as an alternative to supplying idpCertificateInBase64 directly.
name string yes   The display name of the identity provider as shown in LogScale.
signOnUrl string yes   The HTTP-POST or HTTP-Redirect binding endpoint provided by the IdP. LogScale sends SAML authentication requests to this URL.
userAttribute string     The SAML assertion attribute whose value LogScale uses as the username. When omitted, LogScale uses the assertion's NameID element as the username.

Example

Raw
graphql
mutation {
  updateSamlIdentityProvider(
      id: "abc123",
      name: "Samuel-IDP",
      signOnUrl: "https://my.samlidp.com",
      idpCertificateInBase64: "12345678",
      idpEntityId: "abc123",
      domains: ["humio"]
  )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateSamlIdentityProvider(
      id: \"abc123\",
      name: \"Samuel-IDP\",
      signOnUrl: \"https://my.samlidp.com\",
      idpCertificateInBase64: \"12345678\",
      idpEntityId: \"abc123\",
      domains: [\"humio\"]
  )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateSamlIdentityProvider(
      id: \"abc123\",
      name: \"Samuel-IDP\",
      signOnUrl: \"https://my.samlidp.com\",
      idpCertificateInBase64: \"12345678\",
      idpEntityId: \"abc123\",
      domains: [\"humio\"]
  )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateSamlIdentityProvider( ^
      id: \"abc123\", ^
      name: \"Samuel-IDP\", ^
      signOnUrl: \"https://my.samlidp.com\", ^
      idpCertificateInBase64: \"12345678\", ^
      idpEntityId: \"abc123\", ^
      domains: [\"humio\"] ^
  ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateSamlIdentityProvider(
      id: \"abc123\",
      name: \"Samuel-IDP\",
      signOnUrl: \"https://my.samlidp.com\",
      idpCertificateInBase64: \"12345678\",
      idpEntityId: \"abc123\",
      domains: [\"humio\"]
  )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateSamlIdentityProvider(
      id: \"abc123\",
      name: \"Samuel-IDP\",
      signOnUrl: \"https://my.samlidp.com\",
      idpCertificateInBase64: \"12345678\",
      idpEntityId: \"abc123\",
      domains: [\"humio\"]
  )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateSamlIdentityProvider(
      id: \"abc123\",
      name: \"Samuel-IDP\",
      signOnUrl: \"https://my.samlidp.com\",
      idpCertificateInBase64: \"12345678\",
      idpEntityId: \"abc123\",
      domains: [\"humio\"]
  )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateSamlIdentityProvider(
      id: \"abc123\",
      name: \"Samuel-IDP\",
      signOnUrl: \"https://my.samlidp.com\",
      idpCertificateInBase64: \"12345678\",
      idpEntityId: \"abc123\",
      domains: [\"humio\"]
  )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "updateSamlIdentityProvider": {
      "id": "abc123"
    }
  }
}

Returned values

The mutation returns a SamlIdentityProvider object reflecting the updated state of the provider. The returned fields include sign-on URL, certificate details, domain assignments, and user provisioning settings — useful for confirming the applied changes.

Table: SamlIdentityProvider Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
adminAttributestring  Long-Term This field is for internal use only by LogScale.
adminAttributeMatchstring  Long-Term This field is for internal use only by LogScale.
alternativeIdpCertificateInBase64string  Long-Term An alternative IdP certificate using Base64 encoding.
authenticationMethodAuthenticationMethodAuthyes Long-Term The authentication method used. See AuthenticationMethodAuth.
debugbooleanyes Long-Term Whether debugging is enabled.
defaultIdpbooleanyes Long-Term Whether the identity service provider is the default.
domains[string]yes Long-Term The domains of the SAML identity provider.
groupMembershipAttributestring  Long-Term The saml attribute used to extract groups from when receiving the SamlResponse from the IDP. The groups from the response will be used to synchronize the membership of groups in LogScale. The group name and external provider name of the group are matched in LogScale.
humioManagedbooleanyes Long-Term Where SAML authentication is managed by LogScale.
idstringyes Long-Term The unique identifier for the SAML installation.
idpCertificateInBase64stringyes Long-Term The identity provider's certificated converted to Base64.
idpEntityIdstringyes Long-Term The unique identifier of the IDP entity.
lazyCreateUsersbooleanyes Long-Term Whether to wait to create users until necessary.
metadataEndpointUrlstring  Long-Term The SAML metadata endpoint from where to fetch the IdP signing certificate.
namestringyes Long-Term The name of the SAML identity provider.
signOnUrlstringyes Long-Term The URL of where the sign on page is located.
userAttributestring  Long-Term This is the saml attribute from which to extract username when receiving the SamlResponse from the IDP. If not specified, the default saml:NameID will be used.