---
title: "Check if email domain has SSO enabled"
method: GET
path: "/auth/sso/check-domain"
tags: ["Auth"]
---

# Check if email domain has SSO enabled

`GET /auth/sso/check-domain`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/auth/sso/check-domain`
- Auth: none required

Routes the login screen: answers whether the email's domain uses single sign-on and whether password sign-in is disabled for it. Unauthenticated. **Rate limit:** 10 requests per minute per client IP, counted on this endpoint's own bucket — separate from, and in addition to, the shared `/v1/auth/*` per-IP bucket. Every call counts, including ones rejected with 400. Over the limit the endpoint answers 429 with `Retry-After` (seconds until the 60-second window resets) before any lookup is made.

## Query parameters

- `email` string, email, required

## Response `200`

SSO domain check result

- object: Minimal, login-routing-only result: the two booleans the login screen needs. Intentionally omits internal identifiers (org_id, org_slug, SSO provider id) and the org / identity-provider display names, so this unauthenticated endpoint cannot be used to map an email domain to a named tenant or its IdP. Throttled per IP (10/min) independently of the shared auth bucket.
  - `sso_enabled` boolean
  - `enforced` boolean: Whether password login is disabled for this domain.

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `404`: Resource not found
- `429`: Rate-limit exceeded: either this endpoint's own per-IP budget (10 requests/minute) or the shared `/v1/auth/*` per-IP bucket. Back off for `Retry-After` seconds.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)