Current SSO/IdP configuration

GET

/v1/console/sso

curl --request GET \
  --url https://example.com/v1/console/sso \
  --header 'Authorization: Bearer <token>'

• this engine

Returns the managed SSO or IdP configuration of the addressed scope. Sealed secrets are never returned.

Authorizations

• bearerAuth
• browserSession

Responses

200

OK

Media type application/json

object

alias

string

assurance_mapping

Exact upstream MFA values. Omitted/null amr accepts mfa or a signed combination of knowledge (pwd/pin) and possession (otp/hwk/swk); a single method never counts by default. Explicit amr lists replace these defaults with operator-owned exact matches. Omitted/null saml_contexts defaults to https://refeds.org/profile/mfa. ACR has no implicit values. Empty lists trust none. An empty object restores defaults; omission preserves the stored mapping.

object

acr

Array<string> | null

amr

Array<string> | null

saml_contexts

Array<string> | null

claimed_domains

Array<string>

configured

required

boolean

display_name

string

<= 80 characters

enforced_by

string

groups_mapped_by

string

network_allowlist

Array<string>

oidc_client_id

string

oidc_client_secret_hint

string

oidc_groups_claim

string

oidc_issuer

string format: uri

protocol

string

Allowed values: oidc saml

provider_available

required

boolean

redirect_uri

string format: uri

require_sso

boolean

routed_by

string

saml_acs_url

string format: uri

saml_email_attr

string

saml_entity_id

string

saml_groups_attr

string

saml_idp_sso_url

string format: uri

saml_metadata_url

string format: uri

saml_sp_cert_pem

string

saml_sp_key_hint

string

saml_sp_sign_cert_pem

string

saml_sp_sign_key_hint

string

scim_authoritative

boolean

status

string

target_tenant

string

updated_at

string format: date-time

Example

{
  "protocol": "oidc"
}

400

Bad request

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

401

Unauthenticated

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

403

Forbidden

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

404

Not found

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

409

Conflict / setup required

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

429

Rate limited

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}