# Organizations (/cli/organizations) Manage organization membership, invitations, usage, access requests, and SSO. These commands accept the [global options](/cli/commands#global-options). ## Organizations and workspaces \[#organizations-and-workspaces] ### List organizations \[#list-organizations] OAuth login or personal API key required. ```bash sim organizations list [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--search ` | No | Case-insensitive substring match against the organization name. | | `--sort-by ` | No | Field used to sort the result. Do not rely on case-insensitive ordering when sorting by `name`. Defaults to "name". Accepted values: `name`, `createdAt`. | | `--sort-order ` | No | Sort direction. Defaults to "asc". Accepted values: `asc`, `desc`. | | `--limit ` | No | Maximum items to return (0 for everything). Defaults to `0`. | API request and response schemas: [listOrganizations](/api-reference/organizations/listOrganizations). ### Get organization \[#get-organization] OAuth login or personal API key required. ```bash sim organizations get ``` **Arguments** | Argument | Required | Description | | - | - | - | | `organizationId` | Yes | Organization identifier. | API request and response schemas: [getOrganization](/api-reference/organizations/getOrganization). ### List organization workspaces \[#list-organization-workspaces] OAuth login or personal API key required. ```bash sim organizations workspaces [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--search ` | No | Case-insensitive substring match against the workspace name. | | `--sort-by ` | No | Field used to sort the result. Do not rely on case-insensitive ordering when sorting by `name`. Defaults to "name". Accepted values: `name`, `id`. | | `--sort-order ` | No | Sort direction. Defaults to "asc". Accepted values: `asc`, `desc`. | | `--limit ` | No | Maximum items to return (0 for everything). Defaults to `0`. | API request and response schemas: [listOrganizationWorkspaces](/api-reference/organizations/listOrganizationWorkspaces). ## Members and credit limits \[#members-and-credit-limits] ### List organization members \[#list-organization-members] OAuth login or personal API key required. ```bash sim organizations members list [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--search ` | No | Case-insensitive substring match against member name or email. | | `--sort-by ` | No | Field used to sort the result. Do not rely on case-insensitive ordering when sorting by `name`. Defaults to "name". Accepted values: `name`, `email`, `joinedAt`. | | `--sort-order ` | No | Sort direction. Defaults to "asc". Accepted values: `asc`, `desc`. | | `--limit ` | No | Maximum items to return (0 for everything). Defaults to `0`. | API request and response schemas: [listOrganizationMembers](/api-reference/organizations/listOrganizationMembers). ### Get organization member credit limit \[#get-organization-member-credit-limit] OAuth login or personal API key required. ```bash sim organizations members usage-limit get [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `userId` | Yes | User ID of an organization member or external collaborator with workspace access in this organization. Use List Organization Members or List Workspace Members to find it. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | API request and response schemas: [getOrganizationMemberUsageLimit](/api-reference/organizations/getOrganizationMemberUsageLimit). ### Update organization member \[#update-organization-member] OAuth login or personal API key required. ```bash sim organizations members update [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `userId` | Yes | User identifier of the organization member. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--role ` | Yes | New organization role. Ownership transfers use a separate operation. Accepted values: `member`, `admin`. | API request and response schemas: [updateOrganizationMember](/api-reference/organizations/updateOrganizationMember). ### Update organization member credit limit \[#update-organization-member-credit-limit] OAuth login or personal API key required. ```bash sim organizations members usage-limit update [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `userId` | Yes | User ID of an organization member or external collaborator with workspace access in this organization. Use List Organization Members or List Workspace Members to find it. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--credit-limit ` | Yes | Credit cap for this person. Send null to clear the cap or 0 to prevent further credit-consuming usage. Organization limits still apply. | API request and response schemas: [updateOrganizationMemberUsageLimit](/api-reference/organizations/updateOrganizationMemberUsageLimit). ### Remove organization member \[#remove-organization-member] OAuth login or personal API key required. This removes the member, revokes their organization workspace access, and ends their sessions. ```bash sim organizations members remove [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `userId` | Yes | User identifier of the organization member. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `-y, --yes` | Yes | Confirm this operation. | API request and response schemas: [removeOrganizationMember](/api-reference/organizations/removeOrganizationMember). ## Invitations \[#invitations] ### List organization invitations \[#list-organization-invitations] OAuth login or personal API key required. ```bash sim organizations invitations list [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--search ` | No | Case-insensitive substring match against the invitee email. | | `--status ` | No | Filter by current invitation status. Omit to include all statuses. Accepted values: `pending`, `accepted`, `rejected`, `cancelled`, `expired`. | | `--sort-by ` | No | Field used to sort the result. Defaults to "createdAt". Accepted values: `email`, `createdAt`. | | `--sort-order ` | No | Sort direction. Defaults to "desc". Accepted values: `asc`, `desc`. | | `--limit ` | No | Maximum items to return (0 for everything). Defaults to `100`. | | `--cursor ` | No | Continue from nextCursor returned by a previous result. | API request and response schemas: [listOrganizationInvitations](/api-reference/organizations/listOrganizationInvitations). ### Get organization invitation \[#get-organization-invitation] OAuth login or personal API key required. ```bash sim organizations invitations get [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `invitationId` | Yes | Invitation identifier. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | API request and response schemas: [getOrganizationInvitation](/api-reference/organizations/getOrganizationInvitation). ### Create organization invitation \[#create-organization-invitation] OAuth login or personal API key required. ```bash sim organizations invitations create [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--email ` | Yes | Email address of the person to invite. | | `--role ` | No | Organization role to offer. Defaults to member; grants no workspace-specific permissions. Accepted values: `member`, `admin`. | API request and response schemas: [createOrganizationInvitation](/api-reference/organizations/createOrganizationInvitation). ### Resend organization invitation \[#resend-organization-invitation] OAuth login or personal API key required. ```bash sim organizations invitations resend [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `invitationId` | Yes | Invitation identifier. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | API request and response schemas: [resendOrganizationInvitation](/api-reference/organizations/resendOrganizationInvitation). ### Revoke organization invitation \[#revoke-organization-invitation] OAuth login or personal API key required. This cancels the invitation and all its workspace grants, preventing acceptance. ```bash sim organizations invitations revoke [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `invitationId` | Yes | Invitation identifier. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `-y, --yes` | Yes | Confirm this operation. | API request and response schemas: [revokeOrganizationInvitation](/api-reference/organizations/revokeOrganizationInvitation). ### List organization invitation workspaces \[#list-organization-invitation-workspaces] OAuth login or personal API key required. ```bash sim organizations invitations workspaces [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `invitationId` | Yes | Invitation identifier. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--search ` | No | Case-insensitive substring match against the workspace name. | | `--sort-by ` | No | Field used to sort the result. Do not rely on case-insensitive ordering when sorting by `name`. Defaults to "name". Accepted values: `name`, `id`. | | `--sort-order ` | No | Sort direction. Defaults to "asc". Accepted values: `asc`, `desc`. | | `--limit ` | No | Maximum items to return (0 for everything). Defaults to `100`. | | `--cursor ` | No | Continue from nextCursor returned by a previous result. | API request and response schemas: [listOrganizationInvitationWorkspaces](/api-reference/organizations/listOrganizationInvitationWorkspaces). ## Usage \[#usage] ### Get organization usage summary \[#get-organization-usage-summary] OAuth login or personal API key required. ```bash sim organizations usage summary [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--preset ` | No | Reporting window. Custom requires startDate and endDate and is capped at 92 days; other presets reject those bounds. Resolved billing windows are capped at 366 days. Defaults to "30d". Accepted values: `current-period`, `previous-period`, `7d`, `30d`, `custom`. | | `--start-date ` | No | First calendar date included, in the selected timezone. Requires preset=custom. | | `--end-date ` | No | Last calendar date included, in the selected timezone. Requires preset=custom. | | `--timezone ` | No | IANA timezone for calendar boundaries; defaults to UTC. | API request and response schemas: [getOrganizationUsageSummary](/api-reference/organizations/getOrganizationUsageSummary). ### Get organization usage breakdown \[#get-organization-usage-breakdown] OAuth login or personal API key required. ```bash sim organizations usage breakdown [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--preset ` | No | Reporting window. Custom requires startDate and endDate and is capped at 92 days; other presets reject those bounds. Resolved billing windows are capped at 366 days. Defaults to "30d". Accepted values: `current-period`, `previous-period`, `7d`, `30d`, `custom`. | | `--start-date ` | No | First calendar date included, in the selected timezone. Requires preset=custom. | | `--end-date ` | No | Last calendar date included, in the selected timezone. Requires preset=custom. | | `--timezone ` | No | IANA timezone for calendar boundaries; defaults to UTC. | | `--dimension ` | Yes | Usage grouping dimension. Accepted values: `member`, `workspace`, `workflow`, `model`, `byok`, `source`. | | `--limit ` | No | Maximum ranked groups to return. Remaining usage is summarized in other. Must be a whole number from 1 to 100. Defaults to 50. | API request and response schemas: [getOrganizationUsageBreakdown](/api-reference/organizations/getOrganizationUsageBreakdown). ### List organization usage events \[#list-organization-usage-events] OAuth login or personal API key required. ```bash sim organizations usage events [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--preset ` | No | Reporting window. Custom requires startDate and endDate and is capped at 92 days; other presets reject those bounds. Resolved billing windows are capped at 366 days. Defaults to "30d". Accepted values: `current-period`, `previous-period`, `7d`, `30d`, `custom`. | | `--start-date ` | No | First calendar date included, in the selected timezone. Requires preset=custom. | | `--end-date ` | No | Last calendar date included, in the selected timezone. Requires preset=custom. | | `--timezone ` | No | IANA timezone for calendar boundaries; defaults to UTC. | | `--source ` | No | Restrict events to one product surface. Accepted values: `workflow`, `wand`, `sim-chat`, `mcp_copilot`, `mothership_block`, `knowledge-base`, `voice-input`, `enrichment`, `voice-output`, `api-tool`. | | `--limit ` | No | Maximum items to return (0 for everything). Defaults to `100`. | | `--cursor ` | No | Continue from nextCursor returned by a previous result. | | `--sort-by ` | No | Field used to sort the result. Defaults to "createdAt". Accepted values: `createdAt`. | | `--sort-order ` | No | Sort direction. Defaults to "desc". Accepted values: `asc`, `desc`. | API request and response schemas: [listOrganizationUsageEvents](/api-reference/organizations/listOrganizationUsageEvents). ## Access requests \[#access-requests] ### Discover organization access requests \[#discover-organization-access-requests] OAuth login or personal API key required. ```bash sim organizations access-requests discover [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--search ` | No | Case-insensitive substring match against the access item label. | | `--target-kind ` | No | Category of access to discover. Accepted values: `feature`, `integration`, `provider`, `model`, `tool`, `knowledge_connector`, `file_share_auth`, `chat_deploy_auth`, `usage_limit`. | | `--state ` | No | Filter by the acting user’s current access. Requestable items can be submitted for review. Accepted values: `allowed`, `requestable`, `unavailable`. | | `--sort-by ` | No | Field used to sort the result. Defaults to "label". Accepted values: `label`. | | `--sort-order ` | No | Sort direction. Defaults to "asc". Accepted values: `asc`, `desc`. | | `--limit ` | No | Maximum items to return (0 for everything). Defaults to `100`. | | `--cursor ` | No | Continue from nextCursor returned by a previous result. | API request and response schemas: [discoverOrganizationAccessRequests](/api-reference/access-requests/discoverOrganizationAccessRequests). ### Create organization access request \[#create-organization-access-request] OAuth login or personal API key required. ```bash sim organizations access-requests create [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--target ` | Yes | Target returned by Discover Workspace Access Requests or Discover Organization Access Requests. The target must currently be requestable. (JSON, or @path / @- to read a file or stdin). | | `--reason ` | No | Why the acting user needs this access. Defaults to "". | API request and response schemas: [createOrganizationAccessRequest](/api-reference/access-requests/createOrganizationAccessRequest). ### List my organization access requests \[#list-my-organization-access-requests] OAuth login or personal API key required. ```bash sim organizations access-requests mine [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--status ` | No | Filter by request status; omit to include all statuses. Accepted values: `pending`, `fulfilled`, `declined`, `cancelled`, `closed`. | | `--sort-by ` | No | Field used to sort the result. Defaults to "createdAt". Accepted values: `createdAt`, `targetLabel`. | | `--sort-order ` | No | Sort direction. Defaults to "desc". Accepted values: `asc`, `desc`. | | `--limit ` | No | Maximum items to return (0 for everything). Defaults to `100`. | | `--cursor ` | No | Continue from nextCursor returned by a previous result. | API request and response schemas: [listMyOrganizationAccessRequests](/api-reference/access-requests/listMyOrganizationAccessRequests). ### Cancel organization access request \[#cancel-organization-access-request] OAuth login or personal API key required. ```bash sim organizations access-requests cancel [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `requestId` | Yes | Access request identifier. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | API request and response schemas: [cancelOrganizationAccessRequest](/api-reference/access-requests/cancelOrganizationAccessRequest). ### List organization access requests \[#list-organization-access-requests] OAuth login or personal API key required. ```bash sim organizations access-requests list [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--status ` | No | Filter by request status; omit to include all statuses. Accepted values: `pending`, `fulfilled`, `declined`, `cancelled`, `closed`. | | `--sort-by ` | No | Field used to sort the result. Defaults to "createdAt". Accepted values: `createdAt`, `targetLabel`. | | `--sort-order ` | No | Sort direction. Defaults to "desc". Accepted values: `asc`, `desc`. | | `--limit ` | No | Maximum items to return (0 for everything). Defaults to `100`. | | `--cursor ` | No | Continue from nextCursor returned by a previous result. | | `--search ` | No | Case-insensitive substring match against the target label or requester name or email. | API request and response schemas: [listOrganizationAccessRequests](/api-reference/access-requests/listOrganizationAccessRequests). ### Preview organization access request \[#preview-organization-access-request] OAuth login or personal API key required. ```bash sim organizations access-requests preview [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `requestId` | Yes | Access request identifier. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | API request and response schemas: [previewOrganizationAccessRequest](/api-reference/access-requests/previewOrganizationAccessRequest). ### Resolve organization access request \[#resolve-organization-access-request] OAuth login or personal API key required. ```bash sim organizations access-requests resolve [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `requestId` | Yes | Access request identifier. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--action ` | Yes | apply: Apply the reviewed change to the governing group or member credit cap. decline: Decline the request without changing permissions or credit limits. Accepted values: `apply`, `decline`. | | `--expected-fingerprint ` | Conditional | Fingerprint from Preview Organization Access Request. Review its changes and impact before applying; a stale preview returns a conflict. Available when action is apply. Required when action is apply. | | `--new-limit-credits ` | Conditional | Required only for a usage-limit request: a whole-number credit cap greater than the current cap. Omit for permission requests. Available when action is apply. | | `--reason ` | Conditional | Required explanation for declining this request. Available when action is decline. Required when action is decline. | API request and response schemas: [resolveOrganizationAccessRequest](/api-reference/access-requests/resolveOrganizationAccessRequest). ### Get organization access request settings \[#get-organization-access-request-settings] OAuth login or personal API key required. ```bash sim organizations access-requests settings get [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | API request and response schemas: [getOrganizationAccessRequestSettings](/api-reference/access-requests/getOrganizationAccessRequestSettings). ### Update organization access request settings \[#update-organization-access-request-settings] OAuth login or personal API key required. ```bash sim organizations access-requests settings update [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--allow-requests ` | Yes | Allow new requests and approvals. Disabling requests preserves history and still allows cancellation and decline. Accepted values: `true`, `false`. | API request and response schemas: [updateOrganizationAccessRequestSettings](/api-reference/access-requests/updateOrganizationAccessRequestSettings). ## Verified domains \[#verified-domains] ### List organization domains \[#list-organization-domains] OAuth login or personal API key required. ```bash sim organizations domains list [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--limit ` | No | Maximum items to return (0 for everything). Defaults to `0`. | | `--sort-by ` | No | Field used to sort the result. Defaults to "domain". Accepted values: `domain`. | | `--sort-order ` | No | Sort direction. Defaults to "asc". Accepted values: `asc`, `desc`. | API request and response schemas: [listOrganizationDomains](/api-reference/organizations/listOrganizationDomains). ### Add organization domain \[#add-organization-domain] OAuth login or personal API key required. ```bash sim organizations domains add [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--domain ` | Yes | Domain to claim and verify through a DNS TXT record. | API request and response schemas: [addOrganizationDomain](/api-reference/organizations/addOrganizationDomain). ### Verify organization domain \[#verify-organization-domain] OAuth login or personal API key required. ```bash sim organizations domains verify [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `domainId` | Yes | Domain claim owned by this organization. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | API request and response schemas: [verifyOrganizationDomain](/api-reference/organizations/verifyOrganizationDomain). ### Remove organization domain \[#remove-organization-domain] OAuth login or personal API key required. This removes the domain claim and revokes verified SSO authority for its providers. ```bash sim organizations domains remove [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `domainId` | Yes | Domain claim owned by this organization. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `-y, --yes` | Yes | Confirm this operation. | API request and response schemas: [removeOrganizationDomain](/api-reference/organizations/removeOrganizationDomain). ## SSO providers and policy \[#sso-providers-and-policy] ### List SSO providers \[#list-sso-providers] OAuth login or personal API key required. ```bash sim organizations sso providers list [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--limit ` | No | Maximum items to return (0 for everything). Defaults to `0`. | | `--sort-by ` | No | Field used to sort the result. Defaults to "providerId". Accepted values: `providerId`, `domain`. | | `--sort-order ` | No | Sort direction. Defaults to "asc". Accepted values: `asc`, `desc`. | API request and response schemas: [listSsoProviders](/api-reference/organizations/listSsoProviders). ### Get SSO provider \[#get-sso-provider] OAuth login or personal API key required. ```bash sim organizations sso providers get [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `providerId` | Yes | Identity provider identifier. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | API request and response schemas: [getSsoProvider](/api-reference/organizations/getSsoProvider). ### Save SSO provider \[#save-sso-provider] OAuth login or personal API key required. Choose `--provider-type oidc` or `saml`. OIDC requires `--client-id` and `--client-secret`; SAML requires `--entry-point` and `--cert`. Both require an organization-verified domain. The option descriptions state which omitted fields are preserved or cleared. ```bash sim organizations sso providers save [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--provider-type ` | Yes | oidc: Configure an OpenID Connect identity provider. saml: Configure a SAML identity provider. Accepted values: `oidc`, `saml`. | | `--provider-id ` | Yes | Globally unique provider ID; saving an existing provider replaces its supplied configuration. | | `--issuer ` | Yes | Identity provider issuer URL. | | `--domain ` | Yes | Email domain already verified by this organization. | | `--jit-provisioning-enabled` | No | Allow SSO sign-in to provision organization membership, subject to eligibility and available seats. Defaults to true. | | `--no-jit-provisioning-enabled` | No | Send --jit-provisioning-enabled as false. | | `--mapping ` | No | Identity-provider claims mapped to user fields. Defaults to {"id":"sub","email":"email","name":"name","image":"picture"}. (JSON, or @path / @- to read a file or stdin). | | `--client-id ` | Conditional | Identity provider client identifier. Available when providerType is oidc. Required when providerType is oidc. | | `--client-secret ` | Conditional | Write-only OIDC client secret; the redacted marker from providers get preserves an existing secret. Passing it inline exposes it to shell history and process listings. Required when --provider-type is oidc (@path / @- reads a file or stdin verbatim, including trailing newlines; @@value for a literal leading @). | | `--scopes ` | No | OIDC scopes; offline\_access is omitted. Available when providerType is oidc. Defaults to \["openid","profile","email"]. (JSON, or @path / @- to read a file or stdin). | | `--pkce` | No | Use PKCE for the authorization flow. Available when providerType is oidc. Defaults to true. | | `--no-pkce` | No | Send --pkce as false. | | `--authorization-endpoint ` | No | Optional authorization endpoint; otherwise resolved through issuer discovery. Available when providerType is oidc. | | `--token-endpoint ` | No | Optional token endpoint; otherwise resolved through issuer discovery. Available when providerType is oidc. | | `--user-info-endpoint ` | No | Optional UserInfo endpoint. Available when providerType is oidc. | | `--skip-user-info-endpoint` | No | Read identity claims from the ID token instead of calling UserInfo. Available when providerType is oidc. Defaults to false. | | `--no-skip-user-info-endpoint` | No | Send --skip-user-info-endpoint as false. | | `--jwks-endpoint ` | No | Optional signing-key endpoint; otherwise resolved through issuer discovery. Available when providerType is oidc. | | `--entry-point ` | Conditional | Identity provider SAML sign-in endpoint. Available when providerType is saml. Required when providerType is saml. | | `--cert ` | Conditional | Identity provider signing certificate. Available when providerType is saml. Required when providerType is saml. | | `--callback-url ` | No | SAML callback URL; defaults to this provider’s Sim callback. Available when providerType is saml. | | `--audience ` | No | SAML audience; omission preserves the saved value. Available when providerType is saml. | | `--want-assertions-signed` | No | Require signed assertions; omission preserves the saved value. Available when providerType is saml. | | `--no-want-assertions-signed` | No | Send --want-assertions-signed as false. | | `--signature-algorithm ` | No | Signature algorithm accepted by the SAML configuration validator; omission preserves the saved value. Available when providerType is saml. | | `--digest-algorithm ` | No | Digest algorithm accepted by the SAML configuration validator; omission preserves the saved value. Available when providerType is saml. | | `--identifier-format ` | No | SAML NameID format; omission clears the saved value. Available when providerType is saml. | | `--idp-metadata ` | No | Identity provider metadata XML; omission clears the saved document. Available when providerType is saml. | API request and response schemas: [saveSsoProvider](/api-reference/organizations/saveSsoProvider). ### Set primary SSO provider \[#set-primary-sso-provider] OAuth login or personal API key required. ```bash sim organizations sso providers primary [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `providerId` | Yes | Identity provider identifier. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | API request and response schemas: [setPrimarySsoProvider](/api-reference/organizations/setPrimarySsoProvider). ### Delete SSO provider \[#delete-sso-provider] OAuth login or personal API key required. This removes the identity provider used for SSO sign-in; linked accounts remain. ```bash sim organizations sso providers delete [options] ``` **Arguments** | Argument | Required | Description | | - | - | - | | `providerId` | Yes | Identity provider identifier. | **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `-y, --yes` | Yes | Confirm this operation. | API request and response schemas: [deleteSsoProvider](/api-reference/organizations/deleteSsoProvider). ### Get SSO policy \[#get-sso-policy] OAuth login or personal API key required. ```bash sim organizations sso policy get [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | API request and response schemas: [getSsoPolicy](/api-reference/organizations/getSsoPolicy). ### Update SSO policy \[#update-sso-policy] OAuth login or personal API key required. ```bash sim organizations sso policy update [options] ``` **Options** | Option | Required | Description | | - | - | - | | `--organization ` | Yes | Organization identifier. | | `--require-sso ` | Yes | Require organization SSO on future sign-ins; existing sessions remain active. Accepted values: `true`, `false`. | API request and response schemas: [updateSsoPolicy](/api-reference/organizations/updateSsoPolicy). ## Related docs \[#related-docs] - [Organizations](/platform/organization) - [Permissions](/platform/permissions)