Require single sign-on

PATCH

/api/v1/sso

curl --request PATCH \
  --url http://localhost:3000/api/v1/sso \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "required": true }'

With required, addresses at the verified domain sign in only through the provider: password sign-in answers SSO_REQUIRED and no reset email goes out. The organization’s admins keep their password, so a provider that breaks never locks the organization out. Requiring it signs out everyone else at the domain.

Scope: admin.

Authorizations

• bearer
• session
• None

Request Body^required

Media typeapplication/json

object

required

required

Hold everyone at the domain to the provider: no password sign-in or reset, but for the organization’s admins

boolean

Example^generated

{
  "required": true
}

Responses

200

Single sign-on

Media typeapplication/json

object

data

required

object

issuer

required

string

clientId

required

string

domain

required

string

verified

required

The domain is proved: its people sign in through the provider

boolean

required

required

Addresses at the domain sign in only through the provider, but for the organization’s admins

boolean

projectId

required

The project its people land in the first time, able to read; null for the organization’s oldest

string | null

record

required

What proves the domain: add this record at your DNS host

object

type

required

string

Allowed value: TXT

name

required

string

value

required

string

redirectUri

required

Register this with the provider as the app’s redirect URI

string format: uri

Example

{
  "data": {
    "record": {
      "type": "TXT"
    }
  }
}

default

An error

Media typeapplication/json

object

error

required

object

code

required

string

message

required

string

detail

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "detail": "example"
  }
}