fix: remove required constraints from SamlApplicationSettingsSignOn schema#542
Merged
Conversation
…chema Remove 10 fields from the `required` array in the SamlApplicationSettingsSignOn schema that are not guaranteed to be present in API responses for partially configured SAML applications. Fields removed from required: - audience - authnContextClassRef - destination - digestAlgorithm - idpIssuer - recipient - signatureAlgorithm - ssoAcsUrl - subjectNameIdFormat - subjectNameIdTemplate These fields are absent from the response payload when a SAML app is created with minimal configuration (e.g., only ssoAcsUrl provided). SDKs that enforce strict validation against the spec fail to deserialize the entire paginated List Applications response when any partially configured SAML app is included.
manmohan-shaw-okta
approved these changes
May 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remove required constraints from SamlApplicationSettingsSignOn schema
Problem
The
SamlApplicationSettingsSignOnschema in the Okta Admin Management API spec (/api/v1/apps) marks 16 fields asrequired. However, theGET /api/v1/appsendpoint returns SAML application objects where many of these fields are absent — specifically for partially configured SAML apps, which the API itself allows to be created.SDK that enforces strict schema validation fails to deserialize the entire paginated response when even one partially configured SAML app is present on the page. This is currently blocking customers on the Python SDK.
Customer reference: okta-sdk-python#536
Changes
Removed the following 10 fields from the
requiredarray in theSamlApplicationSettingsSignOnschema:requiredaudienceauthnContextClassRefdestinationdigestAlgorithmidpIssuerrecipientsignatureAlgorithmssoAcsUrlsubjectNameIdFormatsubjectNameIdTemplateThe following 5 boolean fields are retained as
requiredsince the API consistently returns them:allowMultipleAcsEndpointsassertionSignedhonorForceAuthnrequestCompressedresponseSignedHow to reproduce the original issue
ssoAcsUrl).GET /api/v1/apps?limit=200.audience,destination,recipient,idpIssuer, etc.Testing
Closes #536
Closes OKTA-1172501