A company’s single sign-on settings

GET

/v1/companies/{id}/sso

curl --request GET \
  --url https://beta-api.plune.ai/v1/companies/example/sso \
  --cookie plune_session=<plune_session>

• beta
• production
• local

The owner reads every setting, the certificates and the DNS record each domain waits for; a manager reads that it is on, whether it is required and which domains stand - no value (#1449, ADR 0054 §3). sp is what to enter at the identity provider. Never a private key. The session only. A company without the saml option is refused by name, the read too.

Authorizations

• cookieAuth

Parameters

Path Parameters

id

required

string

Responses

200

The settings

Media type application/json

The owner reads everything below; a manager reads configured, enabled, enforced and, per domain, domain and verified - no value.

object

configured

required

boolean

sp

What to enter at the identity provider.

object

entityId

string

acsUrl

string

metadataUrl

string

startUrl

The bookmark for the provider’s application tile; null until a domain is verified.

string

nullable

idp

object

entityId

string

ssoUrl

string

certificates

Array<object>

object

pem

string

fingerprint256

string

subject

string

validFrom

string format: date-time

validTo

string format: date-time

enabled

required

boolean

enforced

required

boolean

defaultRole

string

Allowed values: member reader

jit

boolean

emailAttribute

string

nullable

nameAttribute

string

nullable

signRequests

boolean

spCertificate

The company’s public certificate for signed requests; there is no private key to read.

string

nullable

ownerSignedIn

The owner has signed in through this provider: what «required» waits for.

boolean

signingAvailable

boolean

tokensRevoked

Only in the answer to a save that sent revokeTokens: how many tokens it revoked (0 when the requirement is not on after it).

integer

domains

required

Array<object>

object

domain

required

string

verified

required

boolean

verifiedAt

required

string format: date-time

nullable

record

required

The DNS TXT record that proves the domain: put value in a TXT record at name, then ask for the verification.

object

type

required

string

Allowed values: TXT

name

required

string

value

required

string

Example

{
  "defaultRole": "member",
  "domains": [
    {
      "domain": "acme.example",
      "record": {
        "type": "TXT",
        "name": "_plune-sso.acme.example",
        "value": "plune-sso-verification=Zt3b…"
      }
    }
  ]
}

401

No / invalid session

403

The company does not have the saml option (code: tier_option_required, option: saml): a Team plan with the option, or Enterprise. Also: the caller is not the owner (or, for the read, a manager)

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

404

No such company, or the caller is not in it

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}