PingOne Platform APIs

Step 2: Create a SAML application

   

POST {{apiPath}}/environments/{{envID}}/applications

This example shows the POST {{apiPath}}/environments/{{envID}}/applications operation to create a new SAML application. This app configuration represents (to PingOne) the real application that users will query to sign-on.

In this request:

  • {{envID}} represents the environment ID for your environment.

  • These properties are required in the request body:

    • enabled. The current enabled state of the application.

    • name. The name of the application.

    • type. The application type. In this workflow, the type is WEB_APP.

    • protocol. The protocol used by the application. In this workflow, the protocol is SAML.

    • assertionDuration. The assertion validity duration in seconds.

    • acsUrls. Assertion Consumer Service URLs. The first URL in the list is used as default. There must be at least one URL.

    • sloResponseEndpoint. The endpoint URL to submit the logout response. If a value is not provided, the sloEndpoint property value is used to submit the SLO response.

    • spEntityId. The service provider entity ID used to lookup the application. This is a required property and is unique within the environment.

    • nameIdFormat. The format of the Subject NameID attribute in the SAML assertion.

    • accessControl. The access control configuration for sign-on.

The accessControl.group.groups property specifies the group that controls access to the application. Later in this workflow, you’ll define the group itself, and you’ll create a user filter that adds users to the group automatically if they have a specific type property value.

  • The response returns a Status: 201 created message and shows the new application’s configuration data.

Headers

Authorization      Bearer {{accessToken}}

Content-Type      application/json

Body

raw ( application/json )

{
    "name": "SAMLapp_{{$timestamp}}",
    "description": "this is my SAML application",
    "enabled": true,
    "type": "WEB_APP",
    "protocol": "SAML",
    "assertionDuration": 60,
    "acsUrls": [
        "https://example.com"
    ],
    "sloResponseEndpoint": "https://example.com",
    "sloEndpoint": "https://example.com",
    "spEntityId": "samltest{{$timestamp}}",
    "nameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
    "accessControl": {
        "group": {
            "type": "ANY_GROUP",
            "groups": [
                {
                    "id": "{{samlGroupID}}"
                }
            ]
        }
    }
}

Example Request

  • cURL

  • C#

  • Go

  • HTTP

  • Java

  • jQuery

  • NodeJS

  • Python

  • PHP

  • Ruby

  • Swift

curl --location --globoff '{{apiPath}}/environments/{{envID}}/applications' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{accessToken}}' \
--data '{
    "name": "SAMLapp_{{$timestamp}}",
    "description": "this is my SAML application",
    "enabled": true,
    "type": "WEB_APP",
    "protocol": "SAML",
    "assertionDuration": 60,
    "acsUrls": [
        "https://example.com"
    ],
    "sloResponseEndpoint": "https://example.com",
    "sloEndpoint": "https://example.com",
    "spEntityId": "samltest{{$timestamp}}",
    "nameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
    "accessControl": {
        "group": {
            "type": "ANY_GROUP",
            "groups": [
                {
                    "id": "{{samlGroupID}}"
                }
            ]
        }
    }
}'
var options = new RestClientOptions("{{apiPath}}/environments/{{envID}}/applications")
{
  MaxTimeout = -1,
};
var client = new RestClient(options);
var request = new RestRequest("", Method.Post);
request.AddHeader("Content-Type", "application/json");
request.AddHeader("Authorization", "Bearer {{accessToken}}");
var body = @"{" + "\n" +
@"    ""name"": ""SAMLapp_{{$timestamp}}""," + "\n" +
@"    ""description"": ""this is my SAML application""," + "\n" +
@"    ""enabled"": true," + "\n" +
@"    ""type"": ""WEB_APP""," + "\n" +
@"    ""protocol"": ""SAML""," + "\n" +
@"    ""assertionDuration"": 60," + "\n" +
@"    ""acsUrls"": [" + "\n" +
@"        ""https://example.com""" + "\n" +
@"    ]," + "\n" +
@"    ""sloResponseEndpoint"": ""https://example.com""," + "\n" +
@"    ""sloEndpoint"": ""https://example.com""," + "\n" +
@"    ""spEntityId"": ""samltest{{$timestamp}}""," + "\n" +
@"    ""nameIdFormat"": ""urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress""," + "\n" +
@"    ""accessControl"": {" + "\n" +
@"        ""group"": {" + "\n" +
@"            ""type"": ""ANY_GROUP""," + "\n" +
@"            ""groups"": [" + "\n" +
@"                {" + "\n" +
@"                    ""id"": ""{{samlGroupID}}""" + "\n" +
@"                }" + "\n" +
@"            ]" + "\n" +
@"        }" + "\n" +
@"    }" + "\n" +
@"}";
request.AddStringBody(body, DataFormat.Json);
RestResponse response = await client.ExecuteAsync(request);
Console.WriteLine(response.Content);
package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "{{apiPath}}/environments/{{envID}}/applications"
  method := "POST"

  payload := strings.NewReader(`{
    "name": "SAMLapp_{{$timestamp}}",
    "description": "this is my SAML application",
    "enabled": true,
    "type": "WEB_APP",
    "protocol": "SAML",
    "assertionDuration": 60,
    "acsUrls": [
        "https://example.com"
    ],
    "sloResponseEndpoint": "https://example.com",
    "sloEndpoint": "https://example.com",
    "spEntityId": "samltest{{$timestamp}}",
    "nameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
    "accessControl": {
        "group": {
            "type": "ANY_GROUP",
            "groups": [
                {
                    "id": "{{samlGroupID}}"
                }
            ]
        }
    }
}`)

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Add("Content-Type", "application/json")
  req.Header.Add("Authorization", "Bearer {{accessToken}}")

  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := io.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}
POST /environments/{{envID}}/applications HTTP/1.1
Host: {{apiPath}}
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
    "name": "SAMLapp_{{$timestamp}}",
    "description": "this is my SAML application",
    "enabled": true,
    "type": "WEB_APP",
    "protocol": "SAML",
    "assertionDuration": 60,
    "acsUrls": [
        "https://example.com"
    ],
    "sloResponseEndpoint": "https://example.com",
    "sloEndpoint": "https://example.com",
    "spEntityId": "samltest{{$timestamp}}",
    "nameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
    "accessControl": {
        "group": {
            "type": "ANY_GROUP",
            "groups": [
                {
                    "id": "{{samlGroupID}}"
                }
            ]
        }
    }
}
OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\n    \"name\": \"SAMLapp_{{$timestamp}}\",\n    \"description\": \"this is my SAML application\",\n    \"enabled\": true,\n    \"type\": \"WEB_APP\",\n    \"protocol\": \"SAML\",\n    \"assertionDuration\": 60,\n    \"acsUrls\": [\n        \"https://example.com\"\n    ],\n    \"sloResponseEndpoint\": \"https://example.com\",\n    \"sloEndpoint\": \"https://example.com\",\n    \"spEntityId\": \"samltest{{$timestamp}}\",\n    \"nameIdFormat\": \"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\",\n    \"accessControl\": {\n        \"group\": {\n            \"type\": \"ANY_GROUP\",\n            \"groups\": [\n                {\n                    \"id\": \"{{samlGroupID}}\"\n                }\n            ]\n        }\n    }\n}");
Request request = new Request.Builder()
  .url("{{apiPath}}/environments/{{envID}}/applications")
  .method("POST", body)
  .addHeader("Content-Type", "application/json")
  .addHeader("Authorization", "Bearer {{accessToken}}")
  .build();
Response response = client.newCall(request).execute();
var settings = {
  "url": "{{apiPath}}/environments/{{envID}}/applications",
  "method": "POST",
  "timeout": 0,
  "headers": {
    "Content-Type": "application/json",
    "Authorization": "Bearer {{accessToken}}"
  },
  "data": JSON.stringify({
    "name": "SAMLapp_{{$timestamp}}",
    "description": "this is my SAML application",
    "enabled": true,
    "type": "WEB_APP",
    "protocol": "SAML",
    "assertionDuration": 60,
    "acsUrls": [
      "https://example.com"
    ],
    "sloResponseEndpoint": "https://example.com",
    "sloEndpoint": "https://example.com",
    "spEntityId": "samltest{{$timestamp}}",
    "nameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
    "accessControl": {
      "group": {
        "type": "ANY_GROUP",
        "groups": [
          {
            "id": "{{samlGroupID}}"
          }
        ]
      }
    }
  }),
};

$.ajax(settings).done(function (response) {
  console.log(response);
});
var request = require('request');
var options = {
  'method': 'POST',
  'url': '{{apiPath}}/environments/{{envID}}/applications',
  'headers': {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer {{accessToken}}'
  },
  body: JSON.stringify({
    "name": "SAMLapp_{{$timestamp}}",
    "description": "this is my SAML application",
    "enabled": true,
    "type": "WEB_APP",
    "protocol": "SAML",
    "assertionDuration": 60,
    "acsUrls": [
      "https://example.com"
    ],
    "sloResponseEndpoint": "https://example.com",
    "sloEndpoint": "https://example.com",
    "spEntityId": "samltest{{$timestamp}}",
    "nameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
    "accessControl": {
      "group": {
        "type": "ANY_GROUP",
        "groups": [
          {
            "id": "{{samlGroupID}}"
          }
        ]
      }
    }
  })

};
request(options, function (error, response) {
  if (error) throw new Error(error);
  console.log(response.body);
});
import requests
import json

url = "{{apiPath}}/environments/{{envID}}/applications"

payload = json.dumps({
  "name": "SAMLapp_{{$timestamp}}",
  "description": "this is my SAML application",
  "enabled": True,
  "type": "WEB_APP",
  "protocol": "SAML",
  "assertionDuration": 60,
  "acsUrls": [
    "https://example.com"
  ],
  "sloResponseEndpoint": "https://example.com",
  "sloEndpoint": "https://example.com",
  "spEntityId": "samltest{{$timestamp}}",
  "nameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
  "accessControl": {
    "group": {
      "type": "ANY_GROUP",
      "groups": [
        {
          "id": "{{samlGroupID}}"
        }
      ]
    }
  }
})
headers = {
  'Content-Type': 'application/json',
  'Authorization': 'Bearer {{accessToken}}'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)
<?php
require_once 'HTTP/Request2.php';
$request = new HTTP_Request2();
$request->setUrl('{{apiPath}}/environments/{{envID}}/applications');
$request->setMethod(HTTP_Request2::METHOD_POST);
$request->setConfig(array(
  'follow_redirects' => TRUE
));
$request->setHeader(array(
  'Content-Type' => 'application/json',
  'Authorization' => 'Bearer {{accessToken}}'
));
$request->setBody('{\n    "name": "SAMLapp_{{$timestamp}}",\n    "description": "this is my SAML application",\n    "enabled": true,\n    "type": "WEB_APP",\n    "protocol": "SAML",\n    "assertionDuration": 60,\n    "acsUrls": [\n        "https://example.com"\n    ],\n    "sloResponseEndpoint": "https://example.com",\n    "sloEndpoint": "https://example.com",\n    "spEntityId": "samltest{{$timestamp}}",\n    "nameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",\n    "accessControl": {\n        "group": {\n            "type": "ANY_GROUP",\n            "groups": [\n                {\n                    "id": "{{samlGroupID}}"\n                }\n            ]\n        }\n    }\n}');
try {
  $response = $request->send();
  if ($response->getStatus() == 200) {
    echo $response->getBody();
  }
  else {
    echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' .
    $response->getReasonPhrase();
  }
}
catch(HTTP_Request2_Exception $e) {
  echo 'Error: ' . $e->getMessage();
}
require "uri"
require "json"
require "net/http"

url = URI("{{apiPath}}/environments/{{envID}}/applications")

http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Post.new(url)
request["Content-Type"] = "application/json"
request["Authorization"] = "Bearer {{accessToken}}"
request.body = JSON.dump({
  "name": "SAMLapp_{{\$timestamp}}",
  "description": "this is my SAML application",
  "enabled": true,
  "type": "WEB_APP",
  "protocol": "SAML",
  "assertionDuration": 60,
  "acsUrls": [
    "https://example.com"
  ],
  "sloResponseEndpoint": "https://example.com",
  "sloEndpoint": "https://example.com",
  "spEntityId": "samltest{{\$timestamp}}",
  "nameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
  "accessControl": {
    "group": {
      "type": "ANY_GROUP",
      "groups": [
        {
          "id": "{{samlGroupID}}"
        }
      ]
    }
  }
})

response = http.request(request)
puts response.read_body
let parameters = "{\n    \"name\": \"SAMLapp_{{$timestamp}}\",\n    \"description\": \"this is my SAML application\",\n    \"enabled\": true,\n    \"type\": \"WEB_APP\",\n    \"protocol\": \"SAML\",\n    \"assertionDuration\": 60,\n    \"acsUrls\": [\n        \"https://example.com\"\n    ],\n    \"sloResponseEndpoint\": \"https://example.com\",\n    \"sloEndpoint\": \"https://example.com\",\n    \"spEntityId\": \"samltest{{$timestamp}}\",\n    \"nameIdFormat\": \"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\",\n    \"accessControl\": {\n        \"group\": {\n            \"type\": \"ANY_GROUP\",\n            \"groups\": [\n                {\n                    \"id\": \"{{samlGroupID}}\"\n                }\n            ]\n        }\n    }\n}"
let postData = parameters.data(using: .utf8)

var request = URLRequest(url: URL(string: "{{apiPath}}/environments/{{envID}}/applications")!,timeoutInterval: Double.infinity)
request.addValue("application/json", forHTTPHeaderField: "Content-Type")
request.addValue("Bearer {{accessToken}}", forHTTPHeaderField: "Authorization")

request.httpMethod = "POST"
request.httpBody = postData

let task = URLSession.shared.dataTask(with: request) { data, response, error in
  guard let data = data else {
    print(String(describing: error))
    return
  }
  print(String(data: data, encoding: .utf8)!)
}

task.resume()

Example Response

201 Created

{
    "_links": {
        "self": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/applications/837a9e5d-4d08-4bfe-90f4-f700aaebfdc5"
        },
        "environment": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
        },
        "attributes": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/applications/837a9e5d-4d08-4bfe-90f4-f700aaebfdc5/attributes"
        },
        "idpSigningKey": {
            "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/keys/42ffcea1-dcff-4098-821a-11654759ffc9"
        }
    },
    "environment": {
        "id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
    },
    "id": "837a9e5d-4d08-4bfe-90f4-f700aaebfdc5",
    "name": "SAMLapp_1684260093",
    "description": "this is my SAML application",
    "enabled": true,
    "hiddenFromAppPortal": false,
    "type": "WEB_APP",
    "accessControl": {
        "group": {
            "type": "ANY_GROUP",
            "groups": [
                {
                    "id": "e73a7276-c4fb-45bc-9c0d-9b10bb520372"
                }
            ]
        }
    },
    "protocol": "SAML",
    "createdAt": "2023-05-16T18:01:33.661Z",
    "updatedAt": "2023-05-16T18:01:33.661Z",
    "spEntityId": "samltest1684260093",
    "nameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
    "sloResponseEndpoint": "https://example.com",
    "responseSigned": false,
    "sloBinding": "HTTP_POST",
    "acsUrls": [
        "https://example.com"
    ],
    "assertionDuration": 60,
    "sloEndpoint": "https://example.com",
    "assertionSigned": true,
    "idpSigning": {
        "key": {
            "id": "42ffcea1-dcff-4098-821a-11654759ffc9"
        },
        "algorithm": "SHA256withRSA"
    }
}