---
title: "Get the organization's SSO configuration"
method: GET
path: "/organizations/{organizationID}/sso"
tags: ["Organizations"]
---

# Get the organization's SSO configuration

`GET /organizations/{organizationID}/sso`

## Request

- Base URL: `https://api.xata.tech`
- URL: `https://api.xata.tech/organizations/{organizationID}/sso`
- Auth: OAuth 2
  - Implicit: `https://auth.xata.io/realms/xata/protocol/openid-connect/auth`
  - Scopes: `org:read`

Lists the organization's identity providers and the email domains claimed for them. An organization signs in
through one provider per verified domain, so both are collections. Client secrets are write-only and are never
returned. An organization that has not set anything up yet responds 200 with empty lists.

## Response `200`

SSO configuration for the organization

- OrganizationSSO: An organization's single sign-on setup, as one identity provider per verified email domain.
  - `providers` OrganizationSSOProvider[], required: Identity providers registered for this organization, at most one per verified domain.
    - `alias` string, required: Stable identifier for this provider, used in its own endpoints.
    - `type` 'google' | 'microsoft' | 'oidc', required: Which identity provider this is. `google` pins the login to a Google Workspace domain and `microsoft` to a single Entra tenant, taken from the issuer; `oidc` is the fallback for anything else that speaks OpenID Connect.
    - `display_name` string, required: Name members see for this provider when signing in.
    - `domain` string, required: The verified email domain this provider serves. Empty while the domain is not verified.
    - `enforced` boolean, required: Whether members on this domain are sent to this provider automatically, leaving no other way in. Registering a provider does not set this; it is enabled separately.
    - `issuer` string, uri: OIDC issuer URL, without the /.well-known suffix.
    - `client_id` string, required: OAuth client ID the organization registered with the provider.
  - `domains` OrganizationSSODomain[], required: Email domains claimed for this organization, verified and pending.
    - `domain` string, required: The claimed email domain
    - `provider_alias` string, required: The alias an identity provider on this domain will be given. Derived from the organization and the domain, so it is known before the provider exists, which is what lets a client show the redirect URI to register with the provider up front.
    - `verified` boolean, required: Whether control of the domain has been proven through DNS
    - `verification` OrganizationSSODomainVerification: The DNS TXT record that proves an organization controls a domain
      - `record_name` string, required: Name to create the record at
      - `record_type` string, required: DNS record type
      - `record_value` string, required: Value the record must hold
    - `missing_since` string, date-time, nullable: When the daily recheck first found the record missing from a verified domain.
    - `revokes_at` string, date-time, nullable: When the domain stops being verified if the record is still missing.

## Other responses

- `401`: Error returned when authentication or authorization fails
- `403`: Single sign-on is not enabled for the organization, or the caller is not an Admin
- `5XX`: Unexpected Error

## Changes

- **2026-09-29** `5d5197f76970`: 2 info
  - added the optional property `domains/items/missing_since` to the response with the `200` status
  - added the optional property `domains/items/revokes_at` to the response with the `200` status
- **2026-09-24** `a9044087aadf`: 1 info
  - removed the non-success response with the status `404`
- **2026-09-11** `dea04a8fcb58`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/xata/apis/xata-api/changes/organizations/:organizationID/sso/get.md)

---

[API](https://skmtc.dev/xata/apis/xata-api.md) - [All operations](https://skmtc.dev/xata/apis/xata-api/llms.txt) - [OpenAPI document](https://skmtc.dev/xata/apis/xata-api/revisions/3145f2078d68?raw)