auth

Discover SSO configuration for an email address.

Changed on

This endpoint allows the frontend to determine which IdP to use for login based on the user's email domain. If the email domain matches an organization with SSO configured, the response includes the organization details and IdP info.

SSO is only available when the email domain has been verified via DNS TXT record. The response includes domain verification status to help users understand why SSO may not be available.

get/auth/discover

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /auth/discover
  • Auth: HTTP bearer

Query parameters

emailstring required

Email address to discover SSO configuration for

Response

SSO discovery result for the email domain

domain_verification_status'pending' | 'verified' | 'failed'

Domain verification status.

domain_verifiedboolean required

Whether the email domain has been verified via DNS TXT record. SSO is only available for verified domains.

enforcement_mode'optional' | 'required' | 'test' required

SSO enforcement mode.

has_ssoboolean required

Whether the organization has SSO configured and the domain is verified. SSO is only available when both conditions are met.

idp_namestring nullable

Display name for the identity provider (derived from issuer URL or IdP entity ID)

org_idstring uuid required

Organization ID

org_namestring required

Organization display name

org_slugstring required

Organization slug (URL-friendly identifier)

provider_type'oidc' | 'saml' required

SSO provider type.

sso_requiredboolean required

Whether SSO is required for this organization (enforcement_mode = "required"). Only true if has_sso is also true.

verified_atstring date-time nullable

When the domain was successfully verified (if applicable).

Changes