---
title: "Test SSO metadata URL validity"
method: POST
path: "/orgs/{org_id}/sso/test"
tags: ["Organizations"]
---

# Test SSO metadata URL validity

`POST /orgs/{org_id}/sso/test`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/orgs/{org_id}/sso/test`
- Auth: HTTP bearer

Fetches `metadata_url` (or the saved one) and checks it is SAML IdP metadata. A URL that fails the outbound URL rules by its text alone returns 400. The fetch runs under the same outbound URL rules, re-resolved and re-checked on every redirect hop (at most 3), with a timeout and a response-size cap. Any failure (blocked destination, DNS failure, refused connection, timeout) is reported with one generic message, so the result never reveals internal hosts or ports. An unreachable URL returns 200 with `valid: false`.

## Path parameters

- `org_id` string, required

## Request body

- object
  - `metadata_url` string, uri

## Response `200`

SSO test result

- object
  - `valid` boolean
  - `error` string, nullable
  - `metadata_url` string

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Forbidden
- `404`: Resource not found
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.
- `503`: An upstream dependency is currently unavailable. The request was not processed; retry after the cooldown window.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)