Single sign-on endpoints

24 endpoints at https://api.vaif.studio, generated from the API's OpenAPI document. The REST API page covers authentication, and All endpoints lists every group.

POST /sso/org/{orgId}/configure

Parameter	In	Type	Required
orgId	path	string	Yes

Request body (application/json)

{
  provider: "oidc";
  displayName?: string;
  issuer: string;
  clientId: string;
  clientSecret: string;
  domain: string;
  defaultRole?: "admin" | "member" | "viewer";
  jitProvisioning?: boolean;
} | {
  provider: "saml";
  displayName?: string;
  domain: string;
  idpEntityId?: string;
  ssoUrl?: string;
  metadataUrl?: string;
  emailAttribute?: string;
  subjectAttribute?: string;
  nameAttribute?: string;
  groupsAttribute?: string;
  allowIdpInitiated?: boolean;
  defaultRole?: "admin" | "member" | "viewer";
  jitProvisioning?: boolean;
}

Response 200 (application/json)

{
  ok: boolean;
  connection: {
    id: any;
    provider: any;
    issuer: any;
    clientId: any;
    domain: any;
    domainVerified: any;
    domainVerifiedAt: any;
    defaultRole: any;
    jitProvisioning: any;
    enabled: any;
    clientSecretSet: boolean;
    requireSso: boolean;
    requireSsoEnabledAt: any;
    saml: null | {
      idpEntityId: any;
      ssoUrl: any;
      metadataUrl: any;
      emailAttribute: any;
      subjectAttribute: any;
      nameAttribute: any;
      groupsAttribute: any;
      allowIdpInitiated: boolean;
      serviceProvider: {
        entityId: string;
        acsUrl: string;
        metadataUrl: string;
      };
    };
    lastSuccessfulSignInAt: null | string;
    createdAt: any;
    updatedAt: any;
    verification: null | {
      type: "dns-txt";
      host: any;
      record: string;
    };
  };
  redirectUri: string;
  verification: {
    type: string;
    host: string;
    record: string;
    message: string;
  };
}

PATCH /sso/org/{orgId}/connections/{connectionId}

Parameter	In	Type	Required
orgId	path	string	Yes
connectionId	path	string	Yes

Request body (application/json)

{
  idpEntityId?: string;
  ssoUrl?: null | string;
  metadataUrl?: null | string;
  emailAttribute?: null | string;
  subjectAttribute?: null | string;
  nameAttribute?: null | string;
  groupsAttribute?: null | string;
  allowIdpInitiated?: boolean;
  defaultRole?: "admin" | "member" | "viewer";
  jitProvisioning?: boolean;
}

Response 200 (application/json)

{
  ok: boolean;
  connection: {
    id: any;
    provider: any;
    issuer: any;
    clientId: any;
    domain: any;
    domainVerified: any;
    domainVerifiedAt: any;
    defaultRole: any;
    jitProvisioning: any;
    enabled: any;
    clientSecretSet: boolean;
    requireSso: boolean;
    requireSsoEnabledAt: any;
    saml: null | {
      idpEntityId: any;
      ssoUrl: any;
      metadataUrl: any;
      emailAttribute: any;
      subjectAttribute: any;
      nameAttribute: any;
      groupsAttribute: any;
      allowIdpInitiated: boolean;
      serviceProvider: {
        entityId: string;
        acsUrl: string;
        metadataUrl: string;
      };
    };
    lastSuccessfulSignInAt: null | string;
    createdAt: any;
    updatedAt: any;
    verification: null | {
      type: "dns-txt";
      host: any;
      record: string;
    };
  };
  changed: string[];
}

DELETE /sso/org/{orgId}/connections/{connectionId}

Parameter	In	Type	Required
orgId	path	string	Yes
connectionId	path	string	Yes

Response 200 (application/json)

{
  ok: boolean;
}

POST /sso/org/{orgId}/connections/{connectionId}/verify-domain

Parameter	In	Type	Required
orgId	path	string	Yes
connectionId	path	string	Yes

Response 200 (application/json)

{
  ok: boolean;
  connection: {
    id: any;
    provider: any;
    issuer: any;
    clientId: any;
    domain: any;
    domainVerified: any;
    domainVerifiedAt: any;
    defaultRole: any;
    jitProvisioning: any;
    enabled: any;
    clientSecretSet: boolean;
    requireSso: boolean;
    requireSsoEnabledAt: any;
    saml: null | {
      idpEntityId: any;
      ssoUrl: any;
      metadataUrl: any;
      emailAttribute: any;
      subjectAttribute: any;
      nameAttribute: any;
      groupsAttribute: any;
      allowIdpInitiated: boolean;
      serviceProvider: {
        entityId: string;
        acsUrl: string;
        metadataUrl: string;
      };
    };
    lastSuccessfulSignInAt: null | string;
    createdAt: any;
    updatedAt: any;
    verification: null | {
      type: "dns-txt";
      host: any;
      record: string;
    };
  };
}

POST /sso/org/{orgId}/connections/{connectionId}/enable

Parameter	In	Type	Required
orgId	path	string	Yes
connectionId	path	string	Yes

Response 200 (application/json)

{
  ok: boolean;
  connection: {
    id: any;
    provider: any;
    issuer: any;
    clientId: any;
    domain: any;
    domainVerified: any;
    domainVerifiedAt: any;
    defaultRole: any;
    jitProvisioning: any;
    enabled: any;
    clientSecretSet: boolean;
    requireSso: boolean;
    requireSsoEnabledAt: any;
    saml: null | {
      idpEntityId: any;
      ssoUrl: any;
      metadataUrl: any;
      emailAttribute: any;
      subjectAttribute: any;
      nameAttribute: any;
      groupsAttribute: any;
      allowIdpInitiated: boolean;
      serviceProvider: {
        entityId: string;
        acsUrl: string;
        metadataUrl: string;
      };
    };
    lastSuccessfulSignInAt: null | string;
    createdAt: any;
    updatedAt: any;
    verification: null | {
      type: "dns-txt";
      host: any;
      record: string;
    };
  };
}

POST /sso/org/{orgId}/connections/{connectionId}/disable

Parameter	In	Type	Required
orgId	path	string	Yes
connectionId	path	string	Yes

Response 200 (application/json)

{
  ok: boolean;
  connection: {
    id: any;
    provider: any;
    issuer: any;
    clientId: any;
    domain: any;
    domainVerified: any;
    domainVerifiedAt: any;
    defaultRole: any;
    jitProvisioning: any;
    enabled: any;
    clientSecretSet: boolean;
    requireSso: boolean;
    requireSsoEnabledAt: any;
    saml: null | {
      idpEntityId: any;
      ssoUrl: any;
      metadataUrl: any;
      emailAttribute: any;
      subjectAttribute: any;
      nameAttribute: any;
      groupsAttribute: any;
      allowIdpInitiated: boolean;
      serviceProvider: {
        entityId: string;
        acsUrl: string;
        metadataUrl: string;
      };
    };
    lastSuccessfulSignInAt: null | string;
    createdAt: any;
    updatedAt: any;
    verification: null | {
      type: "dns-txt";
      host: any;
      record: string;
    };
  };
}

POST /sso/org/{orgId}/connections/{connectionId}/test

Parameter	In	Type	Required
orgId	path	string	Yes
connectionId	path	string	Yes

Response 200 (application/json)

{
  ok: boolean;
  issuer: string;
  authorizationEndpoint: string;
  tokenEndpoint: string;
  signingKeys: number;
  redirectUri: string;
  note: string;
}

GET /sso/org/{orgId}

Parameter	In	Type	Required
orgId	path	string	Yes

Response 200 (application/json)

{
  connections: {
    id: any;
    provider: any;
    issuer: any;
    clientId: any;
    domain: any;
    domainVerified: any;
    domainVerifiedAt: any;
    defaultRole: any;
    jitProvisioning: any;
    enabled: any;
    clientSecretSet: boolean;
    requireSso: boolean;
    requireSsoEnabledAt: any;
    saml: null | {
      idpEntityId: any;
      ssoUrl: any;
      metadataUrl: any;
      emailAttribute: any;
      subjectAttribute: any;
      nameAttribute: any;
      groupsAttribute: any;
      allowIdpInitiated: boolean;
      serviceProvider: {
        entityId: any;
        acsUrl: any;
        metadataUrl: any;
      };
    };
    lastSuccessfulSignInAt: null | string;
    createdAt: any;
    updatedAt: any;
    verification: null | {
      type: "dns-txt";
      host: any;
      record: string;
    };
  }[];
  redirectUri: string;
  entitled: boolean;
  certificateNotices: {
    connectionId: string;
    domain: null | string;
    certificateId: string;
    sha256Fingerprint: string;
    status: string;
    notAfter: string (date-time);
    daysLeft: number;
    expired: boolean;
  }[];
}

GET /sso/org/{orgId}/connections/{connectionId}/break-glass

Parameter	In	Type	Required
orgId	path	string	Yes
connectionId	path	string	Yes

Response 200 (application/json)

{
  owners: {
    userId: string;
    email: string;
    name: null | string;
    hasPassword: boolean;
    hasMfa: boolean;
    breakGlass: boolean;
    insideDomain: boolean;
  }[];
  max: number;
  outsideDomainBreakGlass: boolean;
}

PUT /sso/org/{orgId}/connections/{connectionId}/break-glass

Parameter	In	Type	Required
orgId	path	string	Yes
connectionId	path	string	Yes

Request body (application/json)

{
  userIds: string[];
}

Response 200 (application/json)

{
  owners: {
    userId: string;
    email: string;
    name: null | string;
    hasPassword: boolean;
    hasMfa: boolean;
    breakGlass: boolean;
    insideDomain: boolean;
  }[];
  max: number;
  outsideDomainBreakGlass: boolean;
  ok: boolean;
}

GET /sso/org/{orgId}/connections/{connectionId}/require

Parameter	In	Type	Required
orgId	path	string	Yes
connectionId	path	string	Yes

Response 200 (application/json)

{
  requireSso: boolean;
  requireSsoEnabledAt: null | string (date-time);
  signOut: null;
  refusal: null;
} | {
  requireSso: boolean;
  requireSsoEnabledAt: null;
  signOut: {
    sessions: number;
    people: number;
  };
  refusal: null | {
    error: string;
    message: string;
    userId?: string;
  };
}

PUT /sso/org/{orgId}/connections/{connectionId}/require

Parameter	In	Type	Required
orgId	path	string	Yes
connectionId	path	string	Yes

Request body (application/json)

{
  enabled: boolean;
  confirmSessions?: number;
  outsideMembers?: boolean;
  outsideMembersListHash?: string;
}

Response 200 (application/json)

{
  ok: boolean;
  requireSso: boolean;
  connection: {
    id: any;
    provider: any;
    issuer: any;
    clientId: any;
    domain: any;
    domainVerified: any;
    domainVerifiedAt: any;
    defaultRole: any;
    jitProvisioning: any;
    enabled: any;
    clientSecretSet: boolean;
    requireSso: boolean;
    requireSsoEnabledAt: any;
    saml: null | {
      idpEntityId: any;
      ssoUrl: any;
      metadataUrl: any;
      emailAttribute: any;
      subjectAttribute: any;
      nameAttribute: any;
      groupsAttribute: any;
      allowIdpInitiated: boolean;
      serviceProvider: {
        entityId: string;
        acsUrl: string;
        metadataUrl: string;
      };
    };
    lastSuccessfulSignInAt: null | string;
    createdAt: any;
    updatedAt: any;
    verification: null | {
      type: "dns-txt";
      host: any;
      record: string;
    };
  };
} | {
  ok: boolean;
  requireSso: boolean;
  connection: {
    id: any;
    provider: any;
    issuer: any;
    clientId: any;
    domain: any;
    domainVerified: any;
    domainVerifiedAt: any;
    defaultRole: any;
    jitProvisioning: any;
    enabled: any;
    clientSecretSet: boolean;
    requireSso: boolean;
    requireSsoEnabledAt: any;
    saml: null | {
      idpEntityId: any;
      ssoUrl: any;
      metadataUrl: any;
      emailAttribute: any;
      subjectAttribute: any;
      nameAttribute: any;
      groupsAttribute: any;
      allowIdpInitiated: boolean;
      serviceProvider: {
        entityId: string;
        acsUrl: string;
        metadataUrl: string;
      };
    };
    lastSuccessfulSignInAt: null | string;
    createdAt: any;
    updatedAt: any;
    verification: null | {
      type: "dns-txt";
      host: any;
      record: string;
    };
  };
  outsideMembers?: {
    policy: string;
    restored: number;
  };
} | {
  ok: boolean;
  requireSso: boolean;
  revokedSessions: number;
  people: number;
  connection: {
    id: any;
    provider: any;
    issuer: any;
    clientId: any;
    domain: any;
    domainVerified: any;
    domainVerifiedAt: any;
    defaultRole: any;
    jitProvisioning: any;
    enabled: any;
    clientSecretSet: boolean;
    requireSso: boolean;
    requireSsoEnabledAt: any;
    saml: null | {
      idpEntityId: any;
      ssoUrl: any;
      metadataUrl: any;
      emailAttribute: any;
      subjectAttribute: any;
      nameAttribute: any;
      groupsAttribute: any;
      allowIdpInitiated: boolean;
      serviceProvider: {
        entityId: string;
        acsUrl: string;
        metadataUrl: string;
      };
    };
    lastSuccessfulSignInAt: null | string;
    createdAt: any;
    updatedAt: any;
    verification: null | {
      type: "dns-txt";
      host: any;
      record: string;
    };
  };
} | {
  ok: boolean;
  requireSso: boolean;
  revokedSessions: number;
  people: number;
  connection: {
    id: any;
    provider: any;
    issuer: any;
    clientId: any;
    domain: any;
    domainVerified: any;
    domainVerifiedAt: any;
    defaultRole: any;
    jitProvisioning: any;
    enabled: any;
    clientSecretSet: boolean;
    requireSso: boolean;
    requireSsoEnabledAt: any;
    saml: null | {
      idpEntityId: any;
      ssoUrl: any;
      metadataUrl: any;
      emailAttribute: any;
      subjectAttribute: any;
      nameAttribute: any;
      groupsAttribute: any;
      allowIdpInitiated: boolean;
      serviceProvider: {
        entityId: string;
        acsUrl: string;
        metadataUrl: string;
      };
    };
    lastSuccessfulSignInAt: null | string;
    createdAt: any;
    updatedAt: any;
    verification: null | {
      type: "dns-txt";
      host: any;
      record: string;
    };
  };
  outsideMembers: null | {
    policy: "blocked_unless_allowed";
    blocked: number;
    kept: number;
    revokedInvitations: number;
  };
}

POST /sso/org/{orgId}/connections/{connectionId}/release-account

Parameter	In	Type	Required
orgId	path	string	Yes
connectionId	path	string	Yes

Request body (application/json)

{
  email: string;
}

Response 200 (application/json)

{
  ok: boolean;
  userId: string;
}

DELETE /sso/org/{orgId}/connections/{connectionId}/identities/{userId}

Parameter	In	Type	Required
orgId	path	string	Yes
connectionId	path	string	Yes
userId	path	string	Yes

Response 200 (application/json)

{
  ok: boolean;
}

GET /sso/org/{orgId}/security-contact

Parameter	In	Type	Required
orgId	path	string	Yes

Response 200 (application/json)

{
  securityContact: null | {
    email: string;
    addedAt: string (date-time);
  };
}

PUT /sso/org/{orgId}/security-contact

Parameter	In	Type	Required
orgId	path	string	Yes

Request body (application/json)

{
  email: string;
}

Response 200 (application/json)

{
  ok: boolean;
  securityContact: null | {
    email: string;
    addedAt: string (date-time);
  };
}

DELETE /sso/org/{orgId}/security-contact

Parameter	In	Type	Required
orgId	path	string	Yes

Response 200 (application/json)

{
  ok: boolean;
  securityContact: null;
}

GET /sso/org/{orgId}/outside-members

Parameter	In	Type	Required
orgId	path	string	Yes

Response 200 (application/json)

{
  policy: "allowed" | "blocked_unless_allowed";
  domains: string[];
  members: {
    allowed: boolean;
    allowReason: null | string;
    allowId: null | string;
    userId: string;
    name: null | string;
    email: string;
    role: string;
    lastActive: null | string;
    projects: number;
    breakGlass: boolean;
  }[];
  invitations: {
    allowed: boolean;
    allowReason: null | string;
    allowId: null | string;
    inviteId: string;
    email: string;
    role: string;
  }[];
  listHash: string;
  counts: {
    block: number;
    keep: number;
    revokeInvitations: number;
  };
}

PUT /sso/org/{orgId}/outside-members/allow

Parameter	In	Type	Required
orgId	path	string	Yes

Request body (application/json)

{
  userIds?: string[];
  emails?: string[];
  reason?: string;
}

Response 200 (application/json)

{
  ok: boolean;
  allowed: number;
  review: {
    policy: "allowed" | "blocked_unless_allowed";
    domains: string[];
    members: {
      allowed: boolean;
      allowReason: null | string;
      allowId: null | string;
      userId: string;
      name: null | string;
      email: string;
      role: string;
      lastActive: null | string;
      projects: number;
      breakGlass: boolean;
    }[];
    invitations: {
      allowed: boolean;
      allowReason: null | string;
      allowId: null | string;
      inviteId: string;
      email: string;
      role: string;
    }[];
    listHash: string;
    counts: {
      block: number;
      keep: number;
      revokeInvitations: number;
    };
  };
}

DELETE /sso/org/{orgId}/outside-members/allow/{allowId}

Parameter	In	Type	Required
orgId	path	string	Yes
allowId	path	string	Yes

Response 200 (application/json)

{
  ok: boolean;
  blocked: boolean;
  revokedInvitations: number;
}

PUT /sso/org/{orgId}/outside-members/policy

Parameter	In	Type	Required
orgId	path	string	Yes

Request body (application/json)

{
  mode: "allowed" | "blocked_unless_allowed";
  reviewedListHash?: string;
}

Response 200 (application/json)

{
  ok: boolean;
  policy: "allowed";
  restored: number;
} | {
  ok: boolean;
  policy: "blocked_unless_allowed";
  blocked: number;
  kept: number;
  revokedInvitations: number;
}

GET /sso/org/{orgId}/outside-members/blocked

Parameter	In	Type	Required
orgId	path	string	Yes

Response 200 (application/json)

{
  domains: string[];
  blocked: {
    userId: any;
    email: any;
    name: any;
    role: any;
    projects: any;
    blockedAt: string;
    outsideDomain: boolean;
  }[];
}

GET /sso/me/paused-access

Response 200 (application/json)

{
  paused: {
    orgId: string;
    orgSlug: string;
    orgName: string;
    message: string;
  }[];
}

POST /sso/org/{orgId}/outside-members/blocked/{userId}/restore

Parameter	In	Type	Required
orgId	path	string	Yes
userId	path	string	Yes

Response 200 (application/json)

{
  ok: boolean;
  userId: string;
  role: string;
  grantsRestored: number;
  grantsSkipped: number;
}