---
title: "Get the workspace's OpenID Connect SSO connection (workspace admins). The client secret is never returned."
method: GET
path: "/api/v1/sso"
tags: ["Single sign-on"]
---

# Get the workspace's OpenID Connect SSO connection (workspace admins). The client secret is never returned.

`GET /api/v1/sso`

## Request

- Base URL: `https://qrlia.dev.castlesoft.eu`
- URL: `https://qrlia.dev.castlesoft.eu/api/v1/sso`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `qrc_session`

## Response `200`

Connection, or null when none is set up

- object
  - `connection` object, nullable, required
    - `issuer` string, required
    - `clientId` string, required
    - `clientSecretSet` true, required
    - `allowedDomains` string[], required
    - `enabled` boolean, required
    - `enforced` boolean, required
    - `autoProvision` boolean, required
    - `defaultRole` 'advanced' | 'limited', required: Role given to accounts created on first SSO sign-in. Owner is never granted automatically.
    - `trustUnverifiedEmail` boolean, required
    - `buttonLabel` string, nullable, required
    - `redirectUris` string[], required: Register every one of these as an allowed redirect / callback URL at the identity provider.
    - `lastLoginAt` string, date-time, nullable, required
    - `updatedAt` string, date-time, required

## Other responses

- `400`: Validation failed
- `401`: Authentication required
- `403`: Forbidden
- `404`: Not found
- `409`: Conflict
- `500`: Internal

---

[API](https://skmtc.dev/qrlia/apis/qrlia-api.md) · [All operations](https://skmtc.dev/qrlia/apis/qrlia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/qrlia/apis/qrlia-api/revisions/01c5dd6002ab?raw)