SSO Configuration

Create the SSO Configuration

Creates the SSO Configuration for the company.

Authentication

This endpoint accepts any one of the following token types:

Company-scoped access token (OAuth2AuthorizationCode) — obtained by a company manager through the Authorization Code flow or the Refresh Token flow. See Authentication for partners.
Company-scoped access token (assertion) (OAuth2CompanyManagerAssertion) — obtained through the urn:ietf:params:oauth:grant-type:jwt-bearer grant for a company manager. See OAuth Assertion.
Customer API token (CustomerAPIToken) — generated by the customer on their Integration Settings page, with the scopes they choose there. See Authorization for customers.

Scopes

Any one of the scopes in a token type's row is enough. all:write works too.

Token type	Category	Read only Scope	Write only Scope (read access implicit)
Company-scoped access token	Manage company resources (company_admin)	-	Manage SSO (sso_configuration:write)
Company-scoped access token (assertion)	Manage company resources (company_admin)	-	Manage SSO (sso_configuration:write)
Customer API token	Manage company resources (company_admin)	-	Manage SSO (sso_configuration:write)

post/v1/sso-configuration

Request

Base URL
https://gateway.remote.com
URL
https://gateway.remote.com/v1/sso-configuration
Auth
- OAuth 2
  Authorization code: /auth/oauth2/authorize
  Token URL: /auth/oauth2/token scopes: https://gateway.remote.com/company.manage
- or OAuth 2
  Authorization code: /auth/oauth2/authorize
  Token URL: /auth/oauth2/token scopes: sso_configuration:write
- or OAuth 2
  Authorization code: /auth/oauth2/authorize
  Token URL: /auth/oauth2/token scopes: all:write
- or OAuth 2
  Client credentials
  Token URL: /auth/oauth2/token scopes: sso_configuration:write
- or OAuth 2
  Client credentials
  Token URL: /auth/oauth2/token scopes: all:write
- or HTTP bearer

Request body

certificatestring binary required

The SAML signing certificate from your identity provider, base64-encoded.

domainstring required

The email domain(s) to route through SSO (e.g., "example.com").

identity_provider_urlstring required

The URL of the SAML identity provider login endpoint.

Example request

{
  "certificate": "c29tZSBjZXJ0aWZpY2F0ZSBleGFtcGxl...",
  "domain": "example.com",
  "identity_provider_url": "example.provider.com"
}

Response

Created

Example response

{
  "data": {
    "audience_uri": "urn:auth:remote-sso:89c4fbb2-some-id-8e4b-280f8795bbd8",
    "certificate": "c29tZSBjZXJ0aWZpY2F0ZSBleGFtcGxl...",
    "domain": "example.com",
    "identity_provider_url": "example.provider.com",
    "sso_url": "https://remote-sso.com/login/callback?connection=89c4fbb2-some-id-8e4b-280f8795bbd8"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.