Discover OIDC Endpoints
Given a custom OIDC provider's issuer URL, fetch its .well-known/openid-configuration and return the endpoint URLs you need to create an oidc SSO config. This is a pure read — it does not create or modify any config — and is what the dashboard's Discover button calls so an admin can paste one issuer URL and have auth_url, token_url, userinfo_url, issuer, and jwks_url filled in automatically.
Works with any OIDC-compliant IdP that publishes a discovery document — Okta, Microsoft Entra ID, Auth0, and others. google / github configs don't need this (their endpoints are platform-controlled).
Plan-gated: requires the account's sso entitlement (discovery is part of SSO setup). Permission-gated: requires the settings:read account permission.
Request body
https://acme.okta.com/oauth2/default). The standard /.well-known/openid-configuration suffix is appended if you don't include it. Must be https and resolve to a public host.Response (200 OK)
The provider's parsed discovery document. Map the fields onto the SSO config as noted:
issuer. The canonical issuer identifier the provider asserts in the id_token iss claim.auth_url.token_url.userinfo_url.jwks_url. The signing-key endpoint used to verify the id_token at login.openid profile email.Errors
issuer_url, or discovery failed — e.g. the URL isn't https, the host is unreachable or private, or the document isn't valid OIDC discovery JSON. The message explains what went wrong.settings:read, or the account plan doesn't include the sso entitlement.