Single sign-on

Create or replace the SSO connection (Enterprise plan). Signed-in workspace admins only; API keys get 403. Enabling it checks the provider's discovery document first.

put/api/v1/sso

Request

  • Base URL: https://qrlia.dev.castlesoft.eu
  • URL: https://qrlia.dev.castlesoft.eu/api/v1/sso
  • Auth: API key in cookie qrc_session

Request body

issuerstring uri required

OpenID Connect issuer URL, e.g. https://accounts.google.com, https://login.microsoftonline.com/<tenant-id>/v2.0 or https://<org>.okta.com. Must serve /.well-known/openid-configuration.

clientIdstring required
clientSecretstring

Write-only. Required when creating the connection; omit to keep the stored secret.

allowedDomainsstring[] required

Email domains the identity provider may sign in, e.g. ["example.com"].

enabledboolean

Show the SSO button and accept SSO sign-ins.

enforcedboolean

Turn off password sign-in for everyone except workspace admins (who keep it as a fallback).

autoProvisionboolean

Create an account on first SSO sign-in for allowed-domain users who don't have one yet.

defaultRole'advanced' | 'limited'

Role given to accounts created on first SSO sign-in. Owner is never granted automatically.

trustUnverifiedEmailboolean

Accept sign-ins whose email the provider doesn't mark verified. Needed for Microsoft Entra ID, which never sends email_verified; only turn on for a provider whose directory you control.

buttonLabelstring nullable

Login button text, e.g. "Sign in with Okta". Defaults to "Sign in with SSO".

Response

Saved

Changes

No recorded changes to this operation across all 1 revision of this API.