> This page is for API.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# Create IdP Group Role Assignment

POST https://%7Baccount-domain%7D.console.eon.io/api/v1/idp-groups
Content-Type: application/json

Maps an identity provider group to one or more Eon roles.

When users authenticate via SAML and belong to the specified group, they're granted the assigned roles.

Reference: https://docs.eon.io/api/api-reference/access-management/id-p-group-role-assignments/create-idp-group

## Authentication

- `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer <token>`, where token is your auth token.

## Request

### Body (application/json)

This endpoint expects a CreateIdpGroupRequest.

- `idpId` (string, required) — [ID of the identity provider](./list-idps) the group belongs to.
- `providerGroupId` (string, required) — Identity-provider-assigned group ID. Must match the exact group ID passed by the identity provider to Eon during SAML sign-on.
- `roleIds` (list of string, required) — List of [role IDs](../roles/list-roles) to assign to the group.
- `displayName` (string, optional, nullable) — Display name for the group role assignment. Not used when matching SAML groups during sign-on.

## Response

### 201

IdP group role assignment created.

- `group` (IdpGroup, required) — IdP group role assignment.

## Errors

### 400 Bad Request Error

Validation error.

- `any`

### 404 Not Found Error

Identity provider not found.

- `any`

### 409 Conflict Error

A group with the same provider-assigned group ID already exists for the specified identity provider.

- `any`

## Types

### IdpGroup

IdP group role assignment.

- `id` (string, required) — Eon-assigned group ID.
- `idpId` (string, required) — [ID of the identity provider](./list-idps) the group belongs to.
- `providerGroupId` (string, required) — Identity-provider-assigned group ID. Must match the exact group ID passed by the identity provider to Eon during SAML sign-on.
- `roleIds` (list of string, required) — List of [role IDs](../roles/list-roles) assigned to the group.
- `displayName` (string, optional) — Display name for the group role assignment. Not used when matching SAML groups during sign-on.

## Examples

**Request**

```json
{
  "idpId": "8f14e45f-ceea-467f-a8dc-e5e47d61e5d7",
  "providerGroupId": "engineering-team",
  "roleIds": [
    "550e8400-e29b-41d4-a716-446655440000",
    "72bc42a0-e169-533f-b95a-4a434574756b"
  ]
}
```

**Response**

```json
{
  "group": {
    "id": "daa42222-6ad2-5d37-bb26-4f2a9cba73da",
    "idpId": "8f14e45f-ceea-467f-a8dc-e5e47d61e5d7",
    "providerGroupId": "engineering-team",
    "roleIds": [
      "550e8400-e29b-41d4-a716-446655440000",
      "72bc42a0-e169-533f-b95a-4a434574756b"
    ],
    "displayName": "Engineering Team"
  }
}
```

**SDK Code**

```python
import requests

url = "https://{account-domain}.console.eon.io/api/v1/idp-groups"

payload = {
    "idpId": "8f14e45f-ceea-467f-a8dc-e5e47d61e5d7",
    "providerGroupId": "engineering-team",
    "roleIds": ["550e8400-e29b-41d4-a716-446655440000", "72bc42a0-e169-533f-b95a-4a434574756b"]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://{account-domain}.console.eon.io/api/v1/idp-groups';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"idpId":"8f14e45f-ceea-467f-a8dc-e5e47d61e5d7","providerGroupId":"engineering-team","roleIds":["550e8400-e29b-41d4-a716-446655440000","72bc42a0-e169-533f-b95a-4a434574756b"]}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://{account-domain}.console.eon.io/api/v1/idp-groups")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"idpId\": \"8f14e45f-ceea-467f-a8dc-e5e47d61e5d7\",\n  \"providerGroupId\": \"engineering-team\",\n  \"roleIds\": [\n    \"550e8400-e29b-41d4-a716-446655440000\",\n    \"72bc42a0-e169-533f-b95a-4a434574756b\"\n  ]\n}")
  .asString();
```