Test SSO/IdP connectivity

POST

/v1/console/sso/test

curl --request POST \
  --url https://example.com/v1/console/sso/test \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "assurance_mapping": { "acr": [ "example" ], "amr": [ "example" ], "saml_contexts": [ "example" ] }, "claimed_domains": [ "example" ], "display_name": "example", "enabled": true, "network_allowlist": [ "example" ], "oidc_client_id": "example", "oidc_client_secret": "example", "oidc_groups_claim": "example", "oidc_issuer": "https://example.com", "protocol": "oidc", "require_sso": true, "saml_acs_url": "https://example.com", "saml_email_attr": "example", "saml_entity_id": "example", "saml_groups_attr": "example", "saml_idp_sso_url": "https://example.com", "saml_metadata_url": "https://example.com", "saml_sp_cert_pem": "example", "saml_sp_key_pem": "example", "saml_sp_sign_cert_pem": "example", "saml_sp_sign_key_pem": "example", "scim_authoritative": true }'

• this engine

Validates a candidate SSO configuration by running discovery or fetching metadata, without persisting it. It answers 501 when the provider builder is not configured.

Authorizations

• bearerAuth
• browserSession

Request Body ^required

Media type application/json

object

assurance_mapping

Exact upstream MFA values. Omitted/null amr accepts mfa or a signed combination of knowledge (pwd/pin) and possession (otp/hwk/swk); a single method never counts by default. Explicit amr lists replace these defaults with operator-owned exact matches. Omitted/null saml_contexts defaults to https://refeds.org/profile/mfa. ACR has no implicit values. Empty lists trust none. An empty object restores defaults; omission preserves the stored mapping.

object

acr

Array<string> | null

amr

Array<string> | null

saml_contexts

Array<string> | null

claimed_domains

Array<string>

display_name

string

<= 80 characters

enabled

boolean

network_allowlist

Array<string>

oidc_client_id

string

oidc_client_secret

string format: password

oidc_groups_claim

string

oidc_issuer

string format: uri

protocol

required

string

Allowed values: oidc saml

require_sso

boolean

saml_acs_url

string format: uri

saml_email_attr

string

saml_entity_id

string

saml_groups_attr

string

saml_idp_sso_url

string format: uri

saml_metadata_url

string format: uri

saml_sp_cert_pem

string

saml_sp_key_pem

string format: password

saml_sp_sign_cert_pem

string

saml_sp_sign_key_pem

string format: password

scim_authoritative

boolean

Responses

200

OK

Media type application/json

object

message

string

success

boolean

Example ^generated

{
  "message": "example",
  "success": true
}

400

Bad request

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

401

Unauthenticated

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

403

Forbidden

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

404

Not found

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

409

Conflict / setup required

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}

429

Rate limited

Media type application/json

object

error

required

object

code

required

string

message

required

string

module

With code module_not_enabled: the namespace of the module this node does not run.

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "module": "example"
  }
}