---
title: "SAML 2.0 Assertion Consumer Service (ACS) endpoint."
method: POST
path: "/saml/acs"
tags: ["saml"]
---

# SAML 2.0 Assertion Consumer Service (ACS) endpoint.

`POST /saml/acs`

Implements the SAML 2.0 Assertion Consumer Service (ACS) endpoint supporting the POST and Artifact bindings.

## Query parameters

- `RelayState` union
  - string, uri — URL to take the user to after the ACS has been verified. Often sent by Identity Provider initiated login requests.
  - string, uuid — UUID of the SAML Relay State stored in the database, used to identify the Service Provider initiated login request.
- `SAMLArt` string
- `SAMLResponse` string

## Other responses

- `302` — HTTP See Other redirect response where `Location` is a specially formatted URL that includes an `access_token`, `refresh_token`, `expires_in` as URL query encoded values in the URL fragment (anything after `#`). These values are encoded in the fragment as this value is only visible to the browser handling the redirect and is not sent to the server.
- `400` — HTTP Bad Request response. Can occur if the passed in JSON cannot be unmarshalled properly or when CAPTCHA verification was not successful. In certain cases can also occur when features are disabled on the server (e.g. sign ups). It may also mean that the operation failed due to some constraint not being met (such a user already exists for example).
- `429` — HTTP Too Many Requests response, when a rate limiter has been breached.

## Changes

- **2025-02-07** `4d0f1a6c1ad9` — 1 info
  - added the optional property `error_code` to the response with the `400` status
- **2023-12-13** `77f9aeb9339a` — 1 info
  - added the optional property `weak_password` to the response with the `400` status
- **2023-02-01** `144a34ca6d74` — 2 warning
  - removed the optional property `error_code` from the response with the `400` status
  - removed the optional property `weak_password` from the response with the `400` status

[Change history](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/saml/acs/post.md)

---

[API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/revisions/2e2a74a7459f/schema)