XAxata
Organizations

Require members on this provider's domain to sign in through it

Changed on

Enabling sends every address on the provider's domain to it, leaving those members no other way in. Refused with a 409 until the domain is verified. Disabling needs nothing, so the way out is always open.

put/organizations/{organizationID}/sso/providers/{providerAlias}/enforcement

Request

  • Base URL
    https://api.xata.tech
  • Auth
    OAuth 2
    Implicit: https://auth.xata.io/realms/xata/protocol/openid-connect/auth
    Scopes: org:write

Request body

enforcedboolean required

Enable to send every address on the domain to this provider. Disable to let members sign in however they could before.

Response

Identity provider after the change

aliasstring required

Stable identifier for this provider, used in its own endpoints.

type'google' | 'microsoft' | 'oidc' required

Which identity provider this is. google pins the login to a Google Workspace domain and microsoft to a single Entra tenant, taken from the issuer; oidc is the fallback for anything else that speaks OpenID Connect.

display_namestring required

Name members see for this provider when signing in.

domainstring required

The verified email domain this provider serves. Empty while the domain is not verified.

enforcedboolean required

Whether members on this domain are sent to this provider automatically, leaving no other way in. Registering a provider does not set this; it is enabled separately.

issuerstring uri

OIDC issuer URL, without the /.well-known suffix.

client_idstring required

OAuth client ID the organization registered with the provider.

Changes