> ## Documentation Index > Fetch the complete documentation index at: https://docs.niadra.com/llms.txt > Use this file to discover all available pages before exploring further. # Read the tenant SSO > The OIDC or SAML connection and what to paste into the identity provider. ## OpenAPI ````yaml openapi/en/control.json GET /v1/sso openapi: 3.1.0 info: title: Niadra control API version: '1' description: >- Tenants, projects, sources, keys, people, configuration and usage. It never receives customer content. servers: - url: https://control.api.niadra.com security: [] paths: /v1/sso: get: summary: Read the tenant SSO description: >- The tenant's single sign-on and what to paste into the identity provider. Needs the admin role. **Authentication.** Person token issued by the control plane (`Authorization: Bearer `), with the role the operation needs. operationId: get_sso_v1_sso_get responses: '200': content: application/json: schema: $ref: '#/components/schemas/SsoOut' example: connection: connection_id: 0192f8e5-93a4-75b6-8fc7-3c4d5e6f7a89 protocol: oidc domains: - acme.example enabled: true enforced: false default_role: null role_mappings: - group: niadra-admins role: admin - group: cx-quality role: review groups_attribute: groups require_second_factor: false oidc: issuer: https://login.acme.example client_id: niadra-console scopes: - openid - email - profile - groups client_secret_set: true saml: null created_at: '2026-09-24T10:00:00Z' updated_at: '2026-09-24T10:00:00Z' updated_by: 0192f0a0-4e5f-7061-9c72-8d9e0f1a2b34 service_provider: oidc_redirect_uri: https://control.api.niadra.com/v1/auth/sso/oidc/callback saml_entity_id: urn:niadra:sso:0192f0a0-1b2c-7d3e-8f40-5a6b7c8d9e01 saml_acs_url: >- https://control.api.niadra.com/v1/auth/sso/saml/0192f0a0-1b2c-7d3e-8f40-5a6b7c8d9e01/acs saml_metadata_url: >- https://control.api.niadra.com/v1/auth/sso/saml/0192f0a0-1b2c-7d3e-8f40-5a6b7c8d9e01/metadata description: >- The connection, or null, and what to paste into the identity provider. security: - personToken: [] components: schemas: SsoOut: additionalProperties: false properties: connection: anyOf: - $ref: '#/components/schemas/SsoConnectionOut' - type: 'null' description: Null while the tenant has no connection. service_provider: $ref: '#/components/schemas/ServiceProviderOut' required: - connection - service_provider title: SsoOut type: object SsoConnectionOut: additionalProperties: false properties: connection_id: format: uuid title: Connection Id type: string created_at: format: date-time title: Created At type: string default_role: anyOf: - $ref: '#/components/schemas/Role' - type: 'null' domains: items: type: string title: Domains type: array enabled: title: Enabled type: boolean enforced: title: Enforced type: boolean groups_attribute: title: Groups Attribute type: string oidc: anyOf: - $ref: '#/components/schemas/OidcOut' - type: 'null' protocol: $ref: '#/components/schemas/SsoProtocol' require_second_factor: title: Require Second Factor type: boolean role_mappings: items: $ref: '#/components/schemas/RoleMappingModel' title: Role Mappings type: array saml: anyOf: - $ref: '#/components/schemas/SamlOut' - type: 'null' updated_at: format: date-time title: Updated At type: string updated_by: format: uuid title: Updated By type: string required: - connection_id - protocol - domains - enabled - enforced - default_role - role_mappings - groups_attribute - require_second_factor - oidc - saml - created_at - updated_at - updated_by title: SsoConnectionOut type: object ServiceProviderOut: additionalProperties: false description: What to paste into the identity provider. properties: oidc_redirect_uri: description: 'OIDC: the redirect (callback) URI of the application.' title: Oidc Redirect Uri type: string saml_acs_url: description: 'SAML: the assertion consumer service, HTTP-POST binding.' title: Saml Acs Url type: string saml_entity_id: description: 'SAML: the service provider''s entity id (audience).' title: Saml Entity Id type: string saml_metadata_url: description: 'SAML: the service provider''s metadata, once the connection exists.' title: Saml Metadata Url type: string required: - oidc_redirect_uri - saml_entity_id - saml_acs_url - saml_metadata_url title: ServiceProviderOut type: object Role: description: Console roles, combinable. enum: - admin - security - integration - review - analysis - vendor title: Role type: string OidcOut: additionalProperties: false properties: client_id: title: Client Id type: string client_secret_set: description: 'Always true: the secret itself is never returned.' title: Client Secret Set type: boolean issuer: title: Issuer type: string scopes: items: type: string title: Scopes type: array required: - issuer - client_id - scopes - client_secret_set title: OidcOut type: object SsoProtocol: enum: - oidc - saml title: SsoProtocol type: string RoleMappingModel: additionalProperties: false properties: group: description: >- A value of the groups claim (OIDC) or attribute (SAML): a group name, or an id such as the object id Microsoft Entra ID sends. Compared without case. maxLength: 256 minLength: 1 title: Group type: string role: $ref: '#/components/schemas/Role' description: >- Given on the whole tenant. The vendor role is never given by a group. required: - group - role title: RoleMappingModel type: object SamlOut: additionalProperties: false properties: certificate: $ref: '#/components/schemas/CertificateOut' idp_entity_id: title: Idp Entity Id type: string idp_sso_url: title: Idp Sso Url type: string required: - idp_entity_id - idp_sso_url - certificate title: SamlOut type: object CertificateOut: additionalProperties: false properties: not_after: format: date-time title: Not After type: string pem: description: >- The certificate as stored: public, so the Console shows it for the next save. title: Pem type: string sha256_fingerprint: title: Sha256 Fingerprint type: string subject: title: Subject type: string required: - subject - not_after - sha256_fingerprint - pem title: CertificateOut type: object securitySchemes: personToken: type: http scheme: bearer bearerFormat: JWT ````