sso
Open an operation to see its authentication, its parameters and the fields of its request and response.
22 operations
GET/v1/auth/sso/complete
Opens the session of a validated SAML sign-in, in the browser that started it.
/v1/auth/sso/completeAuthentication: None
Parameters
| Name | Type | Description |
|---|---|---|
tokenquery | string |
Response 200
No fields.
GET/v1/auth/sso/connections/{id}
The organization and name of a connection, for the app tile confirmation page.
/v1/auth/sso/connections/{id}Authentication: None
Parameters
| Name | Type | Description |
|---|---|---|
idpathrequired | string |
Response 200
| Name | Type | Description |
|---|---|---|
idrequired | string | |
protocolrequired | enum | Values oidc | saml |
namerequired | string | |
organizationrequired | string |
POST/v1/auth/sso/connections/{id}/start
Starts the sign-in of one connection, once confirmed on the app’s own page.
/v1/auth/sso/connections/{id}/startAuthentication: None
Parameters
| Name | Type | Description |
|---|---|---|
idpathrequired | string |
Request body
| Name | Type | Description |
|---|---|---|
redirect_to | string |
Response 200
| Name | Type | Description |
|---|---|---|
redirect_urlrequired | string (uri) |
GET/v1/auth/sso/login
Identity provider app tile: redirects to the confirmation page, where the sign-in starts with a same-origin request.
/v1/auth/sso/loginAuthentication: None
Parameters
| Name | Type | Description |
|---|---|---|
connectionqueryrequired | string | |
redirect_toquery | string |
Response 200
No fields.
GET/v1/auth/sso/oidc/callback
OIDC callback: exchanges the code, signs in, then redirects to the dashboard.
/v1/auth/sso/oidc/callbackAuthentication: None
Response 200
No fields.
POST/v1/auth/sso/recovery
Break-glass sign-in of an owner while single sign-on is required (password and a single-use recovery code).
/v1/auth/sso/recoveryAuthentication: None
Request body
| Name | Type | Description |
|---|---|---|
emailrequired | string | |
passwordrequired | string | |
coderequired | string |
Response 200
| Name | Type | Description |
|---|---|---|
userrequired | object | |
user.idrequired | string | |
user.org_idrequired | string | |
user.emailrequired | string (email) | |
user.namerequired | string | |
user.rolerequired | enum | Values owner | admin | reviewer | client_viewer |
user.workspace_idsrequired | array of string | |
user.email_verified_atrequired | string (date-time) | |
user.github_loginrequired | string | |
user.localerequired | enum | Values en | it |
user.last_login_atrequired | string (date-time) | |
user.disabled_atrequired | string (date-time) | |
user.created_atrequired | string (date-time) | |
user.updated_atrequired | string (date-time) | |
organizationrequired | object | |
organization.idrequired | string | |
organization.namerequired | string | |
organization.slugrequired | string | |
organization.typerequired | enum | Values direct | agency |
organization.planrequired | enum | Values none | open_source | indie | startup | growth | managed | agency | enterprise |
organization.subscription_statusrequired | enum | Values none | trialing | active | past_due | canceled | incomplete | lifetime |
organization.trial_ends_atrequired | string (date-time) | |
organization.current_period_endrequired | string (date-time) | |
organization.plan_activated_atrequired | string (date-time) | |
organization.billing_emailrequired | string (email) | |
organization.spend_cap_usdrequired | number | |
organization.show_engine_brandrequired | boolean | |
organization.patterns_opt_inrequired | boolean | |
organization.badge_removal_addonrequired | boolean | |
organization.overage_enabledrequired | boolean | |
organization.retention_daysrequired | integer | |
organization.signup_sourcerequired | enum | Values direct | badge | referral | vexp | open_source | partner |
organization.referral_coderequired | string | |
organization.localerequired | enum | Values en | it |
organization.sso_enforcedrequired | boolean | |
organization.approval_min_approversrequired | integer | |
organization.approval_rolesrequired | array of enum | |
organization.stripe_connect_account_idrequired | string | |
organization.connect_charges_enabledrequired | boolean | |
organization.demo_used_atrequired | string (date-time) | |
organization.created_atrequired | string (date-time) | |
organization.updated_atrequired | string (date-time) | |
workspacesrequired | array of object | |
workspaces[].idrequired | string | |
workspaces[].namerequired | string | |
workspaces[].slugrequired | string | |
workspaces[].client_namerequired | string | |
workspaces[].execution_moderequired | enum | Values managed | runner | mcp |
workspaces[].autonomyrequired | enum | Values copilot | approve | autopilot |
workspaces[].archived_atrequired | string (date-time) | |
sessionrequired | object | |
session.expires_atrequired | string (date-time) | |
session.ssorequired | boolean | |
staffrequired | boolean | |
planrequired | object | |
plan.idrequired | enum | Values none | open_source | indie | startup | growth | managed | agency | enterprise |
plan.namerequired | string | |
plan.featuresrequired | array of enum | |
plan.autonomyrequired | array of enum | |
plan.execution_modesrequired | array of enum | |
plan.limitsrequired | object | |
plan.limits.tickets_per_monthrequired | integer | |
plan.limits.repositories_per_workspacerequired | integer | |
plan.limits.public_repos_onlyrequired | boolean | |
plan.limits.workspaces_includedrequired | integer | |
plan.limits.extra_workspace_price_usdrequired | number | |
plan.limits.included_fixes_per_monthrequired | integer | |
plan.limits.overage_fix_price_usdrequired | number |
POST/v1/auth/sso/saml/{id}/acs
SAML assertion consumer service (HTTP-POST binding): validates the response, then 303 to the completion step.
/v1/auth/sso/saml/{id}/acsAuthentication: None
Parameters
| Name | Type | Description |
|---|---|---|
idpathrequired | string |
Response 200
No fields.
GET/v1/auth/sso/saml/{id}/metadata
SAML service provider metadata of a connection (entity id, ACS URL).
/v1/auth/sso/saml/{id}/metadataAuthentication: None
Parameters
| Name | Type | Description |
|---|---|---|
idpathrequired | string |
Response 200
No fields.
POST/v1/auth/sso/start
Returns the identity provider URL for the email domain (404 when it has no SSO).
/v1/auth/sso/startAuthentication: None
Request body
| Name | Type | Description |
|---|---|---|
emailrequired | string | |
redirect_to | string |
Response 200
| Name | Type | Description |
|---|---|---|
redirect_urlrequired | string (uri) |
GET/v1/security
Single sign-on and approval governance of the organization (owners and admins).
/v1/securityAuthentication: Dashboard session
Response 200
| Name | Type | Description |
|---|---|---|
ssorequired | object | |
sso.availablerequired | boolean | |
sso.enforcedrequired | boolean | |
sso.connectionsrequired | array of object | |
sso.connections[].idrequired | string | |
sso.connections[].org_idrequired | string | |
sso.connections[].protocolrequired | enum | Values oidc | saml |
sso.connections[].issuerrequired | string | |
sso.connections[].client_idrequired | string | |
sso.connections[].has_client_secretrequired | boolean | |
sso.connections[].idp_sso_urlrequired | string (uri) | |
sso.connections[].idp_certrequired | string | |
sso.connections[].has_idp_metadatarequired | boolean | |
sso.connections[].domainsrequired | array of string | |
sso.connections[].enforcedrequired | boolean | |
sso.connections[].default_rolerequired | enum | Values owner | admin | reviewer | client_viewer |
sso.connections[].created_atrequired | string (date-time) | |
sso.connections[].updated_atrequired | string (date-time) | |
sso.connections[].namerequired | string | |
sso.connections[].jit_enabledrequired | boolean | |
sso.connections[].last_login_atrequired | string (date-time) | |
sso.connections[].service_providerrequired | object | |
sso.connections[].service_provider.redirect_urirequired | string (uri) | |
sso.connections[].service_provider.entity_idrequired | string | |
sso.connections[].service_provider.acs_urlrequired | string (uri) | |
sso.connections[].service_provider.metadata_urlrequired | string (uri) | |
sso.connections[].service_provider.login_urlrequired | string (uri) | |
sso.connections[].certificate_expires_atrequired | string (date-time) | |
sso.connections[].linked_accountsrequired | integer | |
sso.domainsrequired | array of object | |
sso.domains[].domainrequired | string | |
sso.domains[].statusrequired | enum | Values pending | verified |
sso.domains[].verified_atrequired | string (date-time) | |
sso.domains[].last_checked_atrequired | string (date-time) | |
sso.domains[].last_errorrequired | enum | Values txt_missing | txt_mismatch | dns_error | domain_taken |
sso.domains[].txtrequired | object | |
sso.domains[].txt.namerequired | string | |
sso.domains[].txt.valuerequired | string | |
sso.domains[].connection_idsrequired | array of string | |
sso.domains[].created_atrequired | string (date-time) | |
sso.enforcementrequired | object | |
sso.enforcement.can_enablerequired | boolean | |
sso.enforcement.blockersrequired | array of object | |
sso.enforcement.blockers[].coderequired | enum | Values plan | no_connection | members_outside_domains | not_signed_in_with_sso | no_owner_with_password |
sso.enforcement.blockers[].members | array of object | |
sso.enforcement.blockers[].total | integer | |
sso.recovery_codesrequired | object | |
sso.recovery_codes.remainingrequired | integer | |
sso.recovery_codes.generated_atrequired | string (date-time) | |
sso.session_ssorequired | boolean | |
governancerequired | object | |
governance.availablerequired | boolean | |
governance.min_approversrequired | integer | |
governance.rolesrequired | array of enum | |
governance.defaultsrequired | object | |
governance.defaults.min_approversrequired | integer | |
governance.defaults.rolesrequired | array of enum | |
governance.eligible_approversrequired | integer | |
governance.workspaces_below_minimumrequired | array of object | |
governance.workspaces_below_minimum[].idrequired | string | |
governance.workspaces_below_minimum[].namerequired | string | |
governance.workspaces_below_minimum[].eligiblerequired | integer | |
governance.max_min_approversrequired | integer |
PUT/v1/security/governance
Sets how many approvers a fix or release needs, and which roles approve (owners).
/v1/security/governanceAuthentication: Dashboard session
Request body
| Name | Type | Description |
|---|---|---|
min_approversrequired | integer | |
rolesrequired | array of enum |
Response 200
| Name | Type | Description |
|---|---|---|
availablerequired | boolean | |
min_approversrequired | integer | |
rolesrequired | array of enum | |
defaultsrequired | object | |
defaults.min_approversrequired | integer | |
defaults.rolesrequired | array of enum | |
eligible_approversrequired | integer | |
workspaces_below_minimumrequired | array of object | |
workspaces_below_minimum[].idrequired | string | |
workspaces_below_minimum[].namerequired | string | |
workspaces_below_minimum[].eligiblerequired | integer | |
max_min_approversrequired | integer |
POST/v1/security/sso/connections
Adds an OIDC or SAML connection (owners; plans with single sign-on).
/v1/security/sso/connectionsAuthentication: Dashboard session
Request body
| Name | Type | Description |
|---|---|---|
protocolrequired | "oidc" | |
namerequired | string | |
domains | array of string | |
default_role | enum | Values admin | reviewer |
jit_enabled | boolean | |
issuerrequired | string (uri) | |
client_idrequired | string | |
client_secretrequired | string |
Response 201
| Name | Type | Description |
|---|---|---|
idrequired | string | |
org_idrequired | string | |
protocolrequired | enum | Values oidc | saml |
issuerrequired | string | |
client_idrequired | string | |
has_client_secretrequired | boolean | |
idp_sso_urlrequired | string (uri) | |
idp_certrequired | string | |
has_idp_metadatarequired | boolean | |
domainsrequired | array of string | |
enforcedrequired | boolean | |
default_rolerequired | enum | Values owner | admin | reviewer | client_viewer |
created_atrequired | string (date-time) | |
updated_atrequired | string (date-time) | |
namerequired | string | |
jit_enabledrequired | boolean | |
last_login_atrequired | string (date-time) | |
service_providerrequired | object | |
service_provider.redirect_urirequired | string (uri) | |
service_provider.entity_idrequired | string | |
service_provider.acs_urlrequired | string (uri) | |
service_provider.metadata_urlrequired | string (uri) | |
service_provider.login_urlrequired | string (uri) | |
certificate_expires_atrequired | string (date-time) | |
linked_accountsrequired | integer |
PATCH/v1/security/sso/connections/{id}
Changes a connection; a new client secret replaces the stored one (provider settings and domains: owners).
/v1/security/sso/connections/{id}Authentication: Dashboard session
Parameters
| Name | Type | Description |
|---|---|---|
idpathrequired | string |
Request body
| Name | Type | Description |
|---|---|---|
name | string | |
domains | array of string | |
default_role | enum | Values admin | reviewer |
jit_enabled | boolean | |
issuer | string (uri) | |
client_id | string | |
client_secret | string | |
metadata_xml | string | |
entity_id | string | |
sso_url | string (uri) | |
certificate | string |
Response 200
The same fields as POST /v1/security/sso/connections.
DELETE/v1/security/sso/connections/{id}
Removes a connection and its client secret (owners).
/v1/security/sso/connections/{id}Authentication: Dashboard session
Parameters
| Name | Type | Description |
|---|---|---|
idpathrequired | string |
Response 200
| Name | Type | Description |
|---|---|---|
okrequired | true |
POST/v1/security/sso/connections/{id}/test
Checks the identity provider settings (OIDC discovery, SAML certificate).
/v1/security/sso/connections/{id}/testAuthentication: Dashboard session
Parameters
| Name | Type | Description |
|---|---|---|
idpathrequired | string |
Response 200
| Name | Type | Description |
|---|---|---|
okrequired | boolean | |
protocolrequired | enum | Values oidc | saml |
detailsrequired | object | |
errorrequired | enum | Values discovery_failed | issuer_mismatch | insecure_issuer | blocked_address | certificate_invalid | certificate_expired |
POST/v1/security/sso/connections/{id}/unlink
Unlinks a member from their identity at the provider (owners); the next sign-in links again.
/v1/security/sso/connections/{id}/unlinkAuthentication: Dashboard session
Parameters
| Name | Type | Description |
|---|---|---|
idpathrequired | string |
Request body
| Name | Type | Description |
|---|---|---|
emailrequired | string |
Response 200
The same fields as POST /v1/security/sso/connections.
POST/v1/security/sso/domains
Claims an email domain and returns the TXT record that proves it (owners).
/v1/security/sso/domainsAuthentication: Dashboard session
Request body
| Name | Type | Description |
|---|---|---|
domainrequired | string |
Response 201
| Name | Type | Description |
|---|---|---|
domainrequired | string | |
statusrequired | enum | Values pending | verified |
verified_atrequired | string (date-time) | |
last_checked_atrequired | string (date-time) | |
last_errorrequired | enum | Values txt_missing | txt_mismatch | dns_error | domain_taken |
txtrequired | object | |
txt.namerequired | string | |
txt.valuerequired | string | |
connection_idsrequired | array of string | |
created_atrequired | string (date-time) |
DELETE/v1/security/sso/domains/{domain}
Removes a domain from single sign-on (owners).
/v1/security/sso/domains/{domain}Authentication: Dashboard session
Parameters
| Name | Type | Description |
|---|---|---|
domainpathrequired | string |
Response 200
| Name | Type | Description |
|---|---|---|
okrequired | true |
POST/v1/security/sso/domains/{domain}/verify
Looks up the TXT record of a claimed domain (owners).
/v1/security/sso/domains/{domain}/verifyAuthentication: Dashboard session
Parameters
| Name | Type | Description |
|---|---|---|
domainpathrequired | string |
Response 200
The same fields as POST /v1/security/sso/domains.
PUT/v1/security/sso/enforcement
Requires single sign-on for the organization, or stops requiring it (owners).
/v1/security/sso/enforcementAuthentication: Dashboard session
Request body
| Name | Type | Description |
|---|---|---|
enforcedrequired | boolean |
Response 200
| Name | Type | Description |
|---|---|---|
ssorequired | object | |
sso.availablerequired | boolean | |
sso.enforcedrequired | boolean | |
sso.connectionsrequired | array of object | |
sso.connections[].idrequired | string | |
sso.connections[].org_idrequired | string | |
sso.connections[].protocolrequired | enum | Values oidc | saml |
sso.connections[].issuerrequired | string | |
sso.connections[].client_idrequired | string | |
sso.connections[].has_client_secretrequired | boolean | |
sso.connections[].idp_sso_urlrequired | string (uri) | |
sso.connections[].idp_certrequired | string | |
sso.connections[].has_idp_metadatarequired | boolean | |
sso.connections[].domainsrequired | array of string | |
sso.connections[].enforcedrequired | boolean | |
sso.connections[].default_rolerequired | enum | Values owner | admin | reviewer | client_viewer |
sso.connections[].created_atrequired | string (date-time) | |
sso.connections[].updated_atrequired | string (date-time) | |
sso.connections[].namerequired | string | |
sso.connections[].jit_enabledrequired | boolean | |
sso.connections[].last_login_atrequired | string (date-time) | |
sso.connections[].service_providerrequired | object | |
sso.connections[].service_provider.redirect_urirequired | string (uri) | |
sso.connections[].service_provider.entity_idrequired | string | |
sso.connections[].service_provider.acs_urlrequired | string (uri) | |
sso.connections[].service_provider.metadata_urlrequired | string (uri) | |
sso.connections[].service_provider.login_urlrequired | string (uri) | |
sso.connections[].certificate_expires_atrequired | string (date-time) | |
sso.connections[].linked_accountsrequired | integer | |
sso.domainsrequired | array of object | |
sso.domains[].domainrequired | string | |
sso.domains[].statusrequired | enum | Values pending | verified |
sso.domains[].verified_atrequired | string (date-time) | |
sso.domains[].last_checked_atrequired | string (date-time) | |
sso.domains[].last_errorrequired | enum | Values txt_missing | txt_mismatch | dns_error | domain_taken |
sso.domains[].txtrequired | object | |
sso.domains[].txt.namerequired | string | |
sso.domains[].txt.valuerequired | string | |
sso.domains[].connection_idsrequired | array of string | |
sso.domains[].created_atrequired | string (date-time) | |
sso.enforcementrequired | object | |
sso.enforcement.can_enablerequired | boolean | |
sso.enforcement.blockersrequired | array of object | |
sso.enforcement.blockers[].coderequired | enum | Values plan | no_connection | members_outside_domains | not_signed_in_with_sso | no_owner_with_password |
sso.enforcement.blockers[].members | array of object | |
sso.enforcement.blockers[].total | integer | |
sso.recovery_codesrequired | object | |
sso.recovery_codes.remainingrequired | integer | |
sso.recovery_codes.generated_atrequired | string (date-time) | |
sso.session_ssorequired | boolean | |
recovery_codesrequired | object | |
recovery_codes.codesrequired | array of string | |
recovery_codes.generated_atrequired | string (date-time) |
POST/v1/security/sso/recovery-codes
Replaces the break-glass recovery codes (owners); the old ones stop working.
/v1/security/sso/recovery-codesAuthentication: Dashboard session
Response 200
| Name | Type | Description |
|---|---|---|
codesrequired | array of string | |
generated_atrequired | string (date-time) |
POST/v1/security/sso/released-addresses
Frees an address of a verified domain from an account of another organization, which is closed (owners).
/v1/security/sso/released-addressesAuthentication: Dashboard session
Request body
| Name | Type | Description |
|---|---|---|
emailrequired | string |
Response 200
| Name | Type | Description |
|---|---|---|
releasedrequired | true | |
was_verifiedrequired | boolean |