List SSO Configurations
List the SSO configurations on the caller's active account. Account SSO provides single sign-on into the platform's dashboard for account members — distinct from endpoint OAuth providers, which gate access to your endpoints' upstream services.
Requires the settings:read account permission. Returns a bare JSON array of every SSO config on the active account.
Response (200 OK)
A bare JSON array of SSO config objects (no wrapper); [] when the account has none. Each:
uuid string (uuid)
The config's public id. Use it in /sso/config/{uuid}.
account_uuid string (uuid)
The account this config belongs to.
email_domain string
Email domain this SSO config handles. Login flow: a user types
alice@acme.com, the platform looks up the SSO config for acme.com, and redirects to that IdP.provider_type string
google | github | oidc. A saml config saved before SAML was refused can still be listed; it never signs anyone in. Delete it and add the provider again with oidc.client_id, auth_url, token_url, userinfo_url string
OAuth/OIDC settings.
auth_url, token_url, and userinfo_url are only set for oidc configs.issuer, jwks_url string
Required for
oidc. issuer is matched against the id_token iss claim and jwks_url supplies its signature keys at login. Always empty for google/github.scopes string
OAuth scopes (space-separated). Default per provider.
status string
enforced boolean
When
true, account members whose email matches email_domain are forced through this provider and password login is rejected. Enforcement requires the account plan to carry the sso entitlement.domain_verified boolean
Whether the account has proven ownership of
email_domain via DNS-TXT. google/github are auto-verified (identity is asserted by the provider); oidc must pass domain verification before the config applies at login.domain_verify_record_name string
Name of the DNS TXT record to publish (
_ngris-sso-verify.<email_domain>). Present only while a config is unverified and awaiting proof; omitted once verified.domain_verify_record_value string
Value of the DNS TXT record to publish (
ngris-sso-verify=<token>). Present only while unverified; omitted once verified.last_error_message string
Detail from the most recent failed test (see test). Empty when healthy.
last_tested_at datetime | null
When the config was last tested.
null if never tested.created_at, updated_at datetime
RFC 3339 UTC.
Deprecated: until the sunset this response also carries the legacy integer id and *_id fields. Don't use them; read uuid and the *_uuid fields.
Errors
401 Unauthorized
Missing auth.
403 Forbidden
No active account, or the caller lacks the
settings:read account permission.Request
curl "https://api.ngris.com/v1/sso/config" \
-H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
for s in client.sso.list():
print(f"{s['email_domain']:<20} {s['provider_type']:<10} {s['status']}")
Response — 200 OK
[
{
"uuid": "019af662-7814-75fe-ac3c-b767d84325a9",
"account_uuid": "019a68b9-1a79-7820-a884-41f554aba6bd",
"email_domain": "acme.com",
"provider_type": "oidc",
"client_id": "0oa1234abc",
"auth_url": "https://acme.okta.com/oauth2/default/v1/authorize",
"token_url": "https://acme.okta.com/oauth2/default/v1/token",
"userinfo_url": "https://acme.okta.com/oauth2/default/v1/userinfo",
"issuer": "https://acme.okta.com/oauth2/default",
"jwks_url": "https://acme.okta.com/oauth2/default/v1/keys",
"scopes": "openid profile email",
"status": "active",
"enforced": true,
"domain_verified": false,
"domain_verify_record_name": "_ngris-sso-verify.acme.com",
"domain_verify_record_value": "ngris-sso-verify=8f2c1e9a4b7d6f0e",
"last_error_message": "",
"last_tested_at": "2026-01-15T12:00:00Z",
"created_at": "2026-01-15T00:00:00Z",
"updated_at": "2026-01-15T00:00:00Z"
}
]
Was this helpful?