SSO API: SAML and OIDC Sign-in Connections - OneCLI

SSO lets members sign in through your identity provider with SAML or OIDC. These endpoints manage your organization’s SSO connection and decide whether members must use it. Enforcing SSO needs an active connection and a verified domain. For user lifecycle sync, pair SSO with SCIM.

Endpoints

Endpoint	Method and path	What it does
List SSO connections	`GET /org/sso/connections`	List your organization’s SSO connections with their type and status, so you can check sign-in setup before you enforce SSO.
Create an SSO connection	`POST /org/sso/connections`	Create a SAML or OIDC SSO connection.
Update an SSO connection	`PATCH /org/sso/connections/{connectionId}`	Update an SSO connection to rename it, rotate credentials or metadata, or enable and disable it.
Delete an SSO connection	`DELETE /org/sso/connections/{connectionId}`	Delete your SSO connection.
Test an SSO connection	`POST /org/sso/connections/{connectionId}/test`	Test an SSO connection’s metadata or issuer for reachability and shape without changing anything.
Get SSO enforcement	`GET /org/sso/enforcement`	Check whether members must sign in through SSO, and whether the active connection and verified domain it depends on are in place.
Require or stop requiring SSO	`PATCH /org/sso/enforcement`	Require or stop requiring SSO for members.
Look up SSO for an email	`POST /auth/sso/lookup`	Look up SSO for an email address.

Next steps

API overview: base URLs, authentication, and pagination
Errors: status codes and the error format
Editions: which endpoints each edition serves