SSO Server REST API endpoints and usage
/auth/authorize/config/:configId/:appId
Initiate OAuth/OIDC authentication for a specific application.
configId (path): Client configuration IDappId (path): Application IDencoded (query, optional): Encoded parameters for custom integrationResponse: Redirect to IdP authorization URL
/auth/authorize/ui/:configId
Initiate OAuth/OIDC authentication for UI mode.
configId (path): Client configuration IDResponse: Redirect to IdP authorization URL
/auth/callback
OAuth/OIDC callback endpoint.
code (query): Authorization code from IdPstate (query): State parameter for CSRF protectionResponse: Redirect to external application with authentication token
/auth/callback/ui
UI mode callback endpoint.
code (query): Authorization code from IdPstate (query): State parameter with configurationResponse: Render UI authentication popup
/auth/saml/:providerId/:appId
Initiate SAML authentication.
providerId (path): SAML provider IDappId (path): Application ID (use 'ui' for UI mode)encoded (query, optional): Encoded parametersResponse: Redirect to SAML IdP or POST form for SAML request
/auth/saml/callback
SAML assertion consumer service (ACS).
SAMLResponse (required): Base64-encoded SAML responseRelayState (required): State/relay state from IdPResponse: Redirect to success handler or error
/auth/saml/success
SAML authentication success handler.
appId (query): Application IDproviderId (query): SAML provider IDResponse: Process user details and redirect to application
/auth/saml/metadata/:providerId
SAML SP metadata endpoint for IdP configuration.
providerId (path): SAML provider IDResponse: XML SP metadata document
/auth/direct-skip
Direct skip-auth entry point for SSO-linked apps.
clientId (query, required): Client configuration IDapplicationId (query, required): Application IDencoded (query, optional): Encoded parametersResponse: Redirect to skip-auth flow or initiate authentication
/auth/ui/app-skip/:configId/:appId
Skip-auth flow for UI-mode applications.
configId (path): Client configuration IDappId (path): Application IDencoded (query, optional): Encoded parametersResponse: Redirect to application with SSO token
/auth/verify-sso-token
Verify SSO token for skip-auth flow.
{
"token": "sso-jwt-token"
}Response:
{
"valid": true,
"email": "user@example.com",
"name": "User Name",
"sub": "user-subject",
"provider": "google",
"configId": "config-id",
"appId": "app-id",
"iat": 1234567890,
"exp": 1234567900,
"idpToken": "raw-idp-token"
}/auth/verify-sso-token
Verify SSO token via GET request.
token (query): SSO JWT tokenResponse: Same as POST endpoint
/auth/link-account
Link user account to external application.
{
"payload": {
"email": "user@example.com",
"password": "app-password"
},
"loginAttemptNumber": 1,
"appId": "app-id",
"providerId": "provider-id",
"configId": "config-id",
"encoded": "encoded-params"
}Response:
{
"redirectUrl": "https://app.example.com/callback",
"redirectMethod": "GET",
"redirectBody": null,
"token": "external-app-token"
}/auth/ui/app/:configId/:appId
UI mode application authentication page.
configId (path): Client configuration IDappId (path): Application IDencoded (query, optional): Encoded parametersResponse: Render popup-login page
{
"error": "Missing required parameters",
"details": "clientId and applicationId are required"
}{
"valid": false,
"error": "Invalid token"
}{
"error": "Unprocessable Entity",
"details": {
"message": "Invalid credentials"
}
}{
"error": "Internal Server Error",
"message": "Error message"
}