Skip to content
GitmoapAPIBeta
Identity & platformsso
GET/auth/sso/resolve

Route an email address to its organization's single sign-on.

resolve_sso
  • Public
    This operation declares no security requirement: it takes no token.

Anyone may call it, without signing in. Given an email address or a domain, it answers sso: true with an authorization URL that takes the person straight to their organization's identity provider when an organization has verified the domain and its connection is active, and sso: false otherwise, for the ordinary sign-in page. redirect_uri and state are carried into the URL.

Parameters

Query
  • emailstringoptionalCaller's email (domain is extracted)
  • domainstringoptionalExplicit domain hint
  • redirect_uristringClient callback URL
  • statestringoptionalOpaque CSRF state

Responses

200application/json
  • ssoboolean
  • authorize_urlstring or nulloptional
  • protocolSsoProtocolsamloidcor nulloptionalThe IdP protocol an org's connection speaks.
200 exampleSynthesized example
{
"sso": false,
"authorize_url": "https://gitmoap.example/acme/9b7a4fca",
"protocol": "saml"
}
400application/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-159c",
"message": "Label every synthesized example"
}
}
501SSO login routing is not configured on this deploymentapplication/json
Error codes
  • NOT_IMPLEMENTEDThis deployment has not configured the feature the operation needs; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
501 exampleSynthesized example
{
"error": {
"code": "code-3da7",
"message": "Stream pipeline status into the run header"
}
}

CLI

gitmoap sso resolve-sso

  • --domainstringoptionalExplicit domain hint
  • --emailstringoptionalCaller's email (domain is extracted)
  • --redirect-uristringClient callback URL
  • --statestringoptionalOpaque CSRF state

Used in these guides