---
title: "SAML sign-on endpoint. No service provider is registered on the hosted Gate, so it answers 400 unknown_sp. Once one is, it requires an Obelisk session (any sign-in method; the assertion states PasswordProtectedTransport, not how the person signed in) and auto-POSTs an RSA-SHA256-signed assertion to the SP's ACS."
method: GET
path: "/saml/idp/sso"
tags: ["federation"]
---

# SAML sign-on endpoint. No service provider is registered on the hosted Gate, so it answers 400 unknown_sp. Once one is, it requires an Obelisk session (any sign-in method; the assertion states PasswordProtectedTransport, not how the person signed in) and auto-POSTs an RSA-SHA256-signed assertion to the SP's ACS.

`GET /saml/idp/sso`

## Request

- Base URL: `https://obeliskgate.com`
- URL: `https://obeliskgate.com/saml/idp/sso`
- Auth: none declared

## Query parameters

- `SAMLRequest` string

## Response `200`

Success.

## Other responses

- `default`: Error — { ok:false, reason:<code>, message?:<human> } on failures; HTTP status mirrors it.

---

[API](https://skmtc.dev/obeliskgate/apis/obelisk-api.md) · [All operations](https://skmtc.dev/obeliskgate/apis/obelisk-api/llms.txt) · [OpenAPI document](https://skmtc.dev/obeliskgate/apis/obelisk-api/revisions/b99b2069699b?raw)