List SSO Configurations
List the SSO configurations on the caller's active account. Account SSO provides single sign-on into the platform's dashboard for account members — distinct from endpoint OAuth providers, which gate access to your endpoints' upstream services.
Requires the settings:read account permission. Returns a bare JSON array of every SSO config on the active account.
Response (200 OK)
A bare JSON array of SSO config objects (no wrapper). Each:
id int64
Numeric ID.
account_id int64
ID of the account this config belongs to.
email_domain string
Email domain this SSO config handles. Login flow: a user types
alice@acme.com, the platform looks up the SSO config for acme.com, and redirects to that IdP.provider_type string
google | github | oidc | saml.client_id, auth_url, token_url, userinfo_url string
OAuth/OIDC settings.
auth_url, token_url, and userinfo_url are only set for custom OIDC/SAML providers.scopes string
OAuth scopes (space-separated). Default per provider.
status string
enforced boolean
When
true, account members whose email matches email_domain are forced through this provider and password login is rejected. Enforcement requires the account plan to carry the sso entitlement.domain_verified boolean
Whether the account has proven ownership of
email_domain via DNS-TXT. google/github are auto-verified (identity is asserted by the provider); oidc/saml must pass domain verification before the config applies at login.domain_verify_record_name string
Name of the DNS TXT record to publish (
_ngris-sso-verify.<email_domain>). Present only while a config is unverified and awaiting proof; omitted once verified.domain_verify_record_value string
Value of the DNS TXT record to publish (
ngris-sso-verify=<token>). Present only while unverified; omitted once verified.last_error_message string
Detail from the most recent failed test (see test). Empty when healthy.
last_tested_at datetime | null
When the config was last tested.
null if never tested.created_at, updated_at datetime
RFC 3339 UTC.
Errors
401 Unauthorized
Missing auth.
403 Forbidden
No active account, or the caller lacks the
settings:read account permission.Request
curl "https://api.ngris.com/v1/sso/config" \
-H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
for s in client.sso.list():
print(f"{s['email_domain']:<20} {s['provider_type']:<10} {s['status']}")
Response — 200 OK
[
{
"id": 1,
"account_id": 5,
"email_domain": "acme.com",
"provider_type": "oidc",
"client_id": "0oa1234abc",
"auth_url": "https://acme.okta.com/oauth2/default/v1/authorize",
"token_url": "https://acme.okta.com/oauth2/default/v1/token",
"userinfo_url": "https://acme.okta.com/oauth2/default/v1/userinfo",
"scopes": "openid profile email",
"status": "active",
"enforced": true,
"domain_verified": false,
"domain_verify_record_name": "_ngris-sso-verify.acme.com",
"domain_verify_record_value": "ngris-sso-verify=8f2c1e9a4b7d6f0e",
"last_error_message": "",
"last_tested_at": "2026-01-15T12:00:00Z",
"created_at": "2026-01-15T00:00:00Z",
"updated_at": "2026-01-15T00:00:00Z"
}
]