---
title: "POST check-nitrate-sso"
method: POST
path: "check-nitrate-sso"
---

# POST check-nitrate-sso

`POST check-nitrate-sso`

## Request

- Base URL: `https://design.penpot.app/api/main/methods`
- URL: `https://design.penpot.app/api/main/methods/check-nitrate-sso`
- Auth: none declared

Check if a user needs to login into the organization SSO.
Accepts either team-id (to look up the organization via the team) or organization-id directly.
Returns {:authorized true :reason :sso-satisfied} when SSO is not active or the
session already holds a valid entry for the organization, and
{:authorized true :reason :no-team-access} when the gate was skipped because the
user cannot access the team; the reason lets the client tell a usable session
apart from a plain permission failure.
Returns {:authorized false :redirect-uri <url>} when SSO is active;
the client must redirect there. The OIDC provider itself handles
re-authentication transparently if the user already has an active SSO session.
A nil :redirect-uri means SSO is required but the provider is not usable.

## Request body

- object
  - `teamId` string, uuid: UUID formatted string
  - `organizationId` string, uuid: UUID formatted string
  - `url` string, uri, required: URI formatted string

## Changes

> 11 revisions in range; 1 not diffed.

- **2026-09-10** `d014f72adc3f`: 2 breaking, 2 warning
  - added `subschema #1: CheckNitrateSsoParams` to the request body `allOf` list
  - the request's body type changed from `object` to no type
  - removed the request property `teamId`
  - removed the request property `url`

[Operation history](https://skmtc.dev/penpot/apis/penpot-api/changes/check-nitrate-sso/post.md)

---

[API](https://skmtc.dev/penpot/apis/penpot-api.md) - [All operations](https://skmtc.dev/penpot/apis/penpot-api/llms.txt) - [OpenAPI document](https://skmtc.dev/penpot/apis/penpot-api/revisions/a195708d87bc?raw)