Skip to content
GitmoapAPIBeta
Organizeteams
PUT/teams/{team_id}/idp-link

Mirror a team's roster from a group in the organization's identity provider.

link_team_idp_group
  • team:manage
    A token needs the team:manage scope: Create, change and delete teams, and change who is on themGranted by write_api.Every operation this scope unlocks
  • Audited · mutation

    x-gitmoap-audit: {"kind":"audited","arg":"mutation"}

From then on the identity provider decides who is on the team: each person is put on it or taken off it when they sign in through the organization's single sign-on, and a place the provider has not confirmed for a while lapses. The organization's sign-on connection must map a groups claim, and another team cannot already mirror the same group. Linking hands the team's access to whoever the provider names, so the caller must manage the organization's teams and be able to give every grant the team holds. A team kept over SCIM cannot be linked.

Parameters

Path
  • team_idTeamId (string · uuid)Team ID

Request body

application/json
  • idp_groupIdpGroupName (string)The group's name as the identity provider's groups claim spells it.
Request body exampleSynthesized example
{
"idp_group": "idp-group-2157"
}

Responses

200The team, its roster now kept by the identity providerapplication/json
  • created_atstring · date-time
  • descriptionstring
  • member_countinteger · int64People on the team, counting any whose place has lapsed but not yet been removed.
  • namestring
  • organization_idGroupId (string · uuid)The organization's top-level group.
  • roster_sourceTeamRosterSourcemanualidentity_providerscimWho keeps a team's roster: people, through the API, or an identity provider.
  • slugEntityName (string)
  • team_idTeamId (string · uuid)
  • updated_atstring · date-time
  • created_byActorSummary or nulloptional
  • idp_groupstring or nulloptionalThe identity provider's group this team mirrors. Absent for a team whose roster is kept by hand.
200 exampleSynthesized example
{
"created_at": "2026-10-17T07:55:57Z",
"description": "Renders each region as density contours of its operations.",
"member_count": 3,
"name": "payments-api",
"organization_id": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69",
"roster_source": "manual",
"slug": "slug-ae70",
"team_id": "8cf60876-fe75-4514-ac0d-e027c291d60d",
"updated_at": "2026-10-11T05:31:10Z",
"created_by": {
"email": "tomas@acme.example",
"id": "id-211c",
"username": "lin",
"avatar_url": "https://gitmoap.example/acme/578d955b"
},
"idp_group": "idp-group-fc57"
}
400Invalid requestapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-a9cf",
"message": "Draw the region map from operation density"
}
}
401Authentication requiredapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-6ebd",
"message": "Label every synthesized example"
}
}
403The caller cannot manage the organization's teams, or cannot give every grant the team holdsapplication/json
Error codes
  • ACCESS_ESCALATIONThe change would give someone more access than you hold yourself
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-6857",
"message": "Inline scalar newtypes but keep their brand"
}
}
404Team not foundapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-ddff",
"message": "Inline scalar newtypes but keep their brand"
}
}
409Another team of the organization already mirrors that group, or the team's people are kept over SCIMapplication/json
Error codes
  • CONFLICTThe request conflicts with the resource's current state; reason says how
  • IDP_GROUP_LINKEDAnother team of the organization already follows that identity-provider group
  • LEGAL_ACCEPTANCE_REQUIREDAccept the current Terms of Service before changing anything; reading stays open
  • TEAM_ROSTER_MANAGED_BY_IDPThe team's members are kept by the identity provider; change the group there
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
409 exampleSynthesized example
{
"error": {
"code": "code-ec49",
"message": "Stream pipeline status into the run header"
}
}
422The organization's SSO connection maps no groups claimapplication/json
Error codes
  • IDP_GROUPS_NOT_MAPPEDThe organization's single sign-on connection sends no groups, so a team cannot follow an identity-provider group
  • UNPROCESSABLE_ENTITYThe request is well-formed but asks for something the resource's rules do not allow; reason says which
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
422 exampleSynthesized example
{
"error": {
"code": "code-a4b8",
"message": "Label every synthesized example"
}
}

CLI

gitmoap teams link-team-idp-group

  • --team-ididTeam ID
  • --idp-groupstringThe group's name as the identity provider's groups claim spells it.

Used in these guides