# Apply a preset attribute mapping profile

`POST /v1/connections/{connection_id}/attribute-mappings:apply-profile` · permission `connections:write`

Replaces the fixed-target rules (email, names, groups…) of an enterprise connection with the rules of a preset profile: `entra`, `okta`, `google`, `ping`, `jumpcloud` or `keycloak` for SAML, `generic` for OIDC. Stored `user_metadata.<key>` rules are kept. The SAML subject attribute is not changed: the subject is configured separately, and changing it would orphan linked identities. `If-Match` is required as for [replacing the list](put.md). Applying a profile that is already applied writes nothing. The write is audited as `connection.attribute_mappings_replaced` with the profile name.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `connection_id` | path | yes | Enterprise connection ID (`conn_…`). |
| `If-Match` | header | yes | The `ETag` from the last read. Missing: `428`; stale: `412`. |
| `profile` | string | yes | `entra`, `okta`, `google`, `ping`, `jumpcloud`, `keycloak` (SAML) or `generic` (OIDC). |

## Response

`200 OK` with the stored list (see [Get the attribute mappings](get.md)) and the new `ETag`.

## Errors

| HTTP | code | When |
|---|---|---|
| 404 | `not_found` | The connection does not exist in this environment or is not an enterprise connection. |
| 409 | `conflict` | The connection's protocol has no attribute mappings (LDAP). |
| 412 | `precondition_failed` | `If-Match` does not match the current version, or the list changed concurrently. |
| 422 | `validation_failed` | `profile` is missing, unknown or not a preset of the connection's protocol (`/profile`), or a kept `user_metadata` rule reads a profile attribute with another NameFormat (`/profile`, `conflicts_with_stored_mappings`). |
| 428 | `precondition_required` | The `If-Match` header is missing. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl -X POST "https://api.eu.keenauth.com/v1/connections/conn_01j9xp6q0r1s5t7v9w1x3y5z7b/attribute-mappings:apply-profile" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -H 'If-Match: "6f1c…"' \
  -d '{"profile":"entra"}'
```

```bash
keenauth connections attribute-mappings apply-profile conn_01j9xp6q0r1s5t7v9w1x3y5z7b --profile entra --if-match '"6f1c…"'
```