Set the org's allowed sign-in methods

PUT 
/api/v1/organizations/current/auth-methods

Restrict sign-in methods for the org.

An empty list clears the restriction (platform defaults). To require SSO, set ["sso"]. Not flag-gated — narrowing the platform's own methods is a standard org control; SSO itself only functions once the SSO config is enabled (which IS gated).

Admin/owner only — but enforcing SSO (a non-empty list that excludes all local methods, blocking password/GitHub/Google login) is owner-only per (owner-only capabilities). Admins may relax the restriction or pick a set that still permits a local method.

Request

Responses

200

Successful Response

400

Bad request — malformed input or failed validation.

401

Missing, expired, or invalid credentials.

403

Authenticated but not authorized for this resource. Note: cross-organization reads return 404, not 403.

404

Resource not found, or hidden for tenant-enumeration safety (the caller lacks permission to know whether the resource exists).

409

Conflict — the current resource state does not allow this operation (e.g. assessment already started, email already in use).

422

Semantic validation failure — request shape was valid but contents were not.

429

Too many requests — rate limited. Retry after the window resets.

500

Internal server error — unexpected failure.