---
title: "Find the single sign-on provider for an email address"
method: POST
path: "/auth/sso/discover"
---

# Find the single sign-on provider for an email address

`POST /auth/sso/discover`

## Request

- Base URL: `https://api.caveman.so/api/v1`
- URL: `https://api.caveman.so/api/v1/auth/sso/discover`
- Auth: none required

POST /api/v1/auth/sso/discover on the Caveman Cloud control plane. Unauthenticated but rate-limited; it establishes or ends a session rather than reading tenant data. Not exposed to autonomous agents: Public sign-in discovery before authentication: it names the identity provider for an email address. Part of the authentication plane; agents authenticate through a scoped control-plane session and never touch it.

## Request body

- object
  - `email` string, email, required

## Response `200`

The enabled provider of the organization that verified the address's domain by DNS. Start SSO with it.

- object
  - `provider_id` string, uuid, required

## Other responses

- `404`: cave_sso_not_found: one answer for every address no enabled provider covers; cave_identity_required in legacy auth mode.
- `429`: Rate limited per IP
- `2XX`: Successful response. Exact status depends on synchronous or durable delivery outcome.
- `4XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `5XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.

---

[API](https://skmtc.dev/caveman/apis/caveman-cloud-api.md) - [All operations](https://skmtc.dev/caveman/apis/caveman-cloud-api/llms.txt) - [OpenAPI document](https://skmtc.dev/caveman/apis/caveman-cloud-api/revisions/508312d01cfc?raw)