---
title: "Get the SSO policy for an Identity Provider."
method: GET
path: "/identity-providers/{identityProviderId}/policies/sso"
tags: ["Identity Providers"]
---

# Get the SSO policy for an Identity Provider.

`GET /identity-providers/{identityProviderId}/policies/sso`

## Request

- Base URL: `https://api.acquia.com/v3`
- URL: `https://api.acquia.com/v3/identity-providers/{identityProviderId}/policies/sso`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/acquia/apis/acquia-cloud-platform-api/docs/identity-providers/:identityProviderId/policies/sso/get.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `identityProviderId` string, required

## Response `200`

OK

- object: SSO policy that enforces an Identity Provider for specific domains.
  - `status` 'enabled' | 'disabled', required: The status of the SSO policy. When enabled, the policy enforces SSO for the specified domains. Defaults to disabled on creation.
  - `_embedded` object, required: Embedded resources (optional)
    - `domains` object[], required: The SSO domains enforced by this policy, each with a self link back to the authoritative SsoDomain resource.
      - `domain_id` string, required: Unique identifier for the domain.
      - `domain` string, required: The domain name (e.g., "acme.com").
      - `subscription_id` string, required: Unique identifier for the subscription that the domain belongs to.
      - `health` object, required: The overall verification health of the domain. Uses the same code semantics as the platform email domain-verification system: `200` verified, `202` verification pending or in progress, `404` DNS record not found or could not be validated.
        - `code` '200' | '202' | '404', required: Machine-readable verification status code. `200` — verified. `202` — verification pending or in progress; retry after propagation. `404` — DNS TXT record not found or does not match expected value.
        - `summary` string, required: Short human-readable label for the verification state (e.g., "Verified", "Verification pending", "Missing DNS record").
        - `details` string, required: Actionable explanation of the current state. For `404`, describes what was checked and what the customer should do next.
      - `verification_record` object, required: DNS TXT record the customer must publish to verify domain ownership.
        - `type` 'TXT', required: DNS record type.
        - `host` string, required: DNS record host name.
        - `value` string, required: Expected DNS record value.
        - `health` object, required: Verification health specific to this DNS record. Anchors the failure reason to the exact record the customer needs to fix, matching the per-record health pattern used in platform email domain verification.
          - `code` '200' | '202' | '404', required: `200` — record found and value matches. `202` — check in progress. `404` — record not found or value does not match.
          - `summary` string, required: Short human-readable label for this record's verification state.
          - `details` string, required: Actionable explanation; for `404`, states what was checked and what to fix.
      - `verified_at` string, date-time: Timestamp when the domain was successfully verified. Present only when `health.code` is `200`.
      - `_links` object, required: HAL links for the resource
        - `self` FederatedAuthenticationAPIHalLink, required: HAL link object
          - `href` union, required: The target URI of the link (can be a URI or URI template)
            - string, uri
            - string, uri-template
          - `templated` boolean: Whether the link is a URI template
          - `type` string: Hint about the media type expected when dereferencing the target resource
          - `deprecation` string: A URL to a resource that provides deprecation information
          - `name` string: A secondary key for selecting links
          - `profile` string: A URI that hints about the profile of the target resource
          - `title` string: A human-readable identifier for the link
          - `hreflang` string: The language of the target resource
      - `_embedded` object: Embedded resources (optional)
  - `_links` object, required: HAL links for the resource
    - `self` FederatedAuthenticationAPIHalLink, required: HAL link object
      - `href` union, required: The target URI of the link (can be a URI or URI template)
        - string, uri
        - string, uri-template
      - `templated` boolean: Whether the link is a URI template
      - `type` string: Hint about the media type expected when dereferencing the target resource
      - `deprecation` string: A URL to a resource that provides deprecation information
      - `name` string: A secondary key for selecting links
      - `profile` string: A URI that hints about the profile of the target resource
      - `title` string: A human-readable identifier for the link
      - `hreflang` string: The language of the target resource

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `500`: Internal Server Error

---

[API](https://skmtc.dev/acquia/apis/acquia-cloud-platform-api.md) - [All operations](https://skmtc.dev/acquia/apis/acquia-cloud-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/acquia/apis/acquia-cloud-platform-api/revisions/508f8f94456d?raw)