Get SAML IdP
One of the endpoint's SAML identity providers (IdPs): its certificates and their end dates, the last metadata read, who can join through it, its group rules, how many users sign in with it, its last failed sign-in, and what to enter in the IdP, its start link included. Answers never carry ngris's request-signing key or the metadata as received. Reading needs no plan.
Path parameters
uuid string (uuid) Req
The endpoint's
uuid from /endpoints.idp_uuid string (uuid) Req
The IdP's
uuid from List SAML IdPs.An integer id in the path is refused with 400 integer_id_unsupported (see public IDs). Use the uuid.
Response (200 OK)
uuid, name, enabled string (uuid), string, boolean
The IdP, its button name (Continue with <name>) and whether it's on.
entity_id, sso_url string
From the IdP's metadata: its entity ID (it never changes once saved) and the address ngris sends sign-in requests to.
certificates array<object>
The IdP's signing certificates:
sha256 (the fingerprint), subject, not_before, not_after.certs_not_after datetime?
When the last of them ends. After it, sign-ins through the IdP are refused until ngris has a new certificate.
certs_expire_soon boolean
true from 30 days before certs_not_after.certs_changed_at datetime?
When a metadata read last brought other certificates.
want_requests_signed boolean
The IdP's metadata asks for signed sign-in requests: ngris signs them, with the certificate in
sp.request_signing_certificate.metadata_source, metadata_url string
url (read again every day; metadata_url is the address) or pasted (it doesn't update itself).metadata_read_at, metadata_error, metadata_error_at datetime?, string?, datetime?
The last metadata read, and the last failed one with what went wrong. A failed read keeps the last values working.
join_mode string
email_domains array<string>
The email domains the IdP may send, which also connect a user already here at their first sign-in; empty: any, and nobody is connected by email.
email_attribute, name_attribute, groups_attribute string
The attributes ngris reads the email, name and groups from.
group_roles array<object>
own_second_step boolean
The IdP asks its own second step, so its sign-ins skip the endpoint's.
linked_users integer
How many users sign in with it.
last_sign_in_at datetime?
Its last sign-in.
last_error, last_error_at string?, datetime?
Its last failed sign-in, as a reason code such as
not_signed or audience, never what the answer said.sp object
What to enter in the IdP:
entity_id, acs_url, metadata_url (ngris's metadata for this IdP), start_url (the start link for its portal tile), name_id_format and, when the IdP wants signed requests, request_signing_certificate (PEM).created_at, updated_at datetime
When it was added and last changed.
Errors
401 Unauthorized
Missing auth.
403 Forbidden
Caller lacks the
endpoints:read permission in the active account.404 Not Found
Endpoint doesn't exist or doesn't belong to the calling account, or the IdP isn't this endpoint's (
SAML IdP not found).Request
curl "https://api.ngris.com/v1/endpoints/019bb1e4-e785-77d2-9966-c3cff31d0a0e/saml/idps/019c6a2e-4b10-7c3d-9e21-5a7f0b8c1d23" \
-H "X-API-KEY: <your_api_key>"
CLI
ngris api saml-idps get 019bb1e4-e785-77d2-9966-c3cff31d0a0e 019c6a2e-4b10-7c3d-9e21-5a7f0b8c1d23
Response
{
"uuid": "019c6a2e-4b10-7c3d-9e21-5a7f0b8c1d23",
"name": "Acme SSO",
"enabled": true,
"entity_id": "https://idp.example.com/saml",
"sso_url": "https://idp.example.com/saml/sso",
"certificates": [{
"sha256": "3F:9A:…:C2",
"subject": "CN=idp.example.com",
"not_before": "2026-01-10T00:00:00Z",
"not_after": "2031-01-10T00:00:00Z"
}],
"certs_not_after": "2031-01-10T00:00:00Z",
"certs_expire_soon": false,
"certs_changed_at": null,
"want_requests_signed": false,
"metadata_source": "url",
"metadata_url": "https://idp.example.com/metadata",
"metadata_read_at": "2026-11-14T06:00:00Z",
"metadata_error_at": null,
"join_mode": "anyone",
"email_domains": ["acme.com"],
"email_attribute": "email",
"name_attribute": "name",
"groups_attribute": "groups",
"group_roles": [{"group": "shop-admins", "role_uuid": "019b4b9d-d300-736b-8601-153b3d9f70aa", "role_name": "admin"}],
"own_second_step": false,
"linked_users": 12,
"last_sign_in_at": "2026-11-14T09:12:40Z",
"last_error_at": null,
"sp": {
"entity_id": "https://app.example.com/_tunnel_auth/saml",
"acs_url": "https://app.example.com/_tunnel_auth/saml/acs",
"metadata_url": "https://app.example.com/_tunnel_auth/saml/metadata?idp=019c6a2e-4b10-7c3d-9e21-5a7f0b8c1d23",
"start_url": "https://app.example.com/_tunnel_auth/saml/start?idp=019c6a2e-4b10-7c3d-9e21-5a7f0b8c1d23",
"name_id_format": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
},
"created_at": "2026-11-12T10:00:00Z",
"updated_at": "2026-11-14T06:00:00Z"
}
Was this helpful?