Update SAML Connection Certificate Using Metadata URL

A Security Assertion Markup Language (SAML) connection created using a Metadata URL fails authentication due to a thumbprint mismatch after the signing certificate is rotated on the Identity Provider (IdP).

According to Refresh existing connection information with metadata URL, the certificate can be refreshed by using the following PATCH request, but must include all the "options" parameters so they are not overwritten:

PATCH /api/v2/connections/{connection_id}
Body: { "options": { "metadataUrl": "<URL>" } }

However, attempts to refresh the certificate via the Management API fail to update the thumbprint when the full "options" parameter is provided during this request.

• SAML Connections

• Management API

When the connection updates using the complete options object, including signingCert or signingCerts properties, the system does not fetch the certificate from the metadata URL again.

1. Retrieve the existing configuration using the GET /api/v2/connections/{id} endpoint.

2. Remove the signingCert and signingCerts fields from the options payload.

3. Send the options object, including the metadataUrl, via a PATCH request to /api/v2/connections/{connection_id}.

By excluding certificate fields, the system fetches and applies the latest signing certificate and generates new thumbprints based on the metadata URL while retaining all other configuration values.