# Enterprise SSO API Reference

These APIs can be called from your backend using your PropelAuth API Key. Click [here](https://docs.propelauth.com/overview/authentication/saml) for more information about Enterprise SSO.

---

## [Allow Org To Setup SAML](https://docs.propelauth.com/reference/api/enterprise-sso#allow-org-to-setup-saml)

Allows an organization to setup SAML SSO. Users in the organization will then be able to go through the SAML setup flow.

### Required Permissions

Update Organization SSO Settings

### Properties

- Name `orgId` *Type string*  Description: The organization ID

### Request

```javascript
auth.allowOrgToSetupSamlConnection(
    "1189c444-8a2d-4c41-8b4b-ae43ce79a492"
)
```

### Successful Response

```

```

---

## [Disallow Org To Setup SAML](https://docs.propelauth.com/reference/api/enterprise-sso#disallow-org-to-setup-saml)

Disallows an organization to setup SAML SSO. If the organization already has SAML setup, they will no longer be able to use it.

### Required Permissions

Update Organization SSO Settings

### Properties

- Name `orgId` *Type string*  Description: The organization ID

### Request

```javascript
auth.disallowOrgToSetupSamlConnection(
    "1189c444-8a2d-4c41-8b4b-ae43ce79a492"
)
```

### Successful Response

```

```

---

## [Create SAML Connection Link](https://docs.propelauth.com/reference/api/enterprise-sso#create-saml-connection-link)

Creates a link that allows a user to setup SAML for an organization without logging in or creating an account. Visit our SAML/Enterprise SSO docs for more information.

### Required Permissions

Manage SSO Setup Links

### Properties

- Name `orgId` *Type string*  Description: The organization ID  
- Name `expiresInSeconds` *Type number*  Description: The amount of seconds before the link expires

### Request

```javascript
auth.createOrgSamlConnectionLink(
    "1189c444-8a2d-4c41-8b4b-ae43ce79a492", // orgId
    86400, // expired in seconds
)
```

### Successful Response

```json
{
    url: "https://example.com"
}
```

---

## [Fetch SAML SP Metadata](https://docs.propelauth.com/reference/api/enterprise-sso#fetch-saml-sp-metadata)

Fetches SAML Service Provider Metadata. This is the information your organizations will input into their IdP when configuring SAML.

### Required Permissions

Read SSO Connections

### Properties

- Name `orgId` *Type string*  Description: The ID of the organization

### Request

```javascript
auth.fetchSamlSpMetadata("1189c444-8a2d-4c41-8b4b-ae43ce79a492")
```

### Successful Response

```json
{
    entityId: "https://auth.your.domain/saml/ORGS-URL-SLUG/metadata",
    acsUrl: "https://auth.your.domain/saml/ORGS-URL-SLUG/acs",
    logoutUrl: "https://auth.your.domain/saml/ORGS-URL-SLUG/logout"
}
```

---

## [Set SAML IdP Metadata](https://docs.propelauth.com/reference/api/enterprise-sso#set-saml-id-p-metadata)

Sets the SAML metadata from an organization's IdP. Must be completed before using the SAML Go Live endpoint.

### Required Permissions

Setup SSO Connections

### Properties

- Name `idpEntityId` *Type string*  Description: The Entity ID from the organization's IdP
- Name `idpSsoUrl` *Type string*  Description: The Single Sign-On URL from the organization's IdP
- Name `idpCertificate` *Type string*  Description: The Base-64 encoded X.509 certificate from the organization's IdP
- Name `provider` *Type string*  Description: The name of the SAML provider. Must equal 'Google', 'Rippling', 'OneLogin', 'JumpCloud', 'Okta', 'Azure', 'Duo', or 'Generic'

### Request

```javascript
auth.setSamlIdpMetadata(orgId, {
    idpEntityId: "https://sts.windows.net/SOME-UUID/",
    idpSsoUrl: "https://login.microsoftonline.com/SOME-UUID/saml2",
    idpCertificate: "-----BEGIN CERTIFICATE-----MyCertificateHere-----END CERTIFICATE-----",
    provider: "Azure"
});
```

### Successful Response

```

```

---

## [Enable SAML Connection](https://docs.propelauth.com/reference/api/enterprise-sso#enable-saml-connection)

Sets an organization's SAML status to Live after using the Set SAML IdP Metadata endpoint.

### Required Permissions

Setup SSO Connections

### Properties

- Name `orgId` *Type string*  Description: The organization ID

### Request

```javascript
auth.samlGoLive(
    "1189c444-8a2d-4c41-8b4b-ae43ce79a492"
)
```

### Successful Response

```

```

---

## [Delete SAML Connection](https://docs.propelauth.com/reference/api/enterprise-sso#delete-saml-connection)

Deletes an organization's SAML connection. The organization will still be able to enable SAML.

### Required Permissions

Delete SSO Connections

### Properties

- Name `orgId` *Type string*  Description: The organization ID

### Request

```javascript
auth.deleteSamlConnection("1189c444-8a2d-4c41-8b4b-ae43ce79a492")
```

### Successful Response

```

```

---

## [Fetch Org SCIM Groups](https://docs.propelauth.com/reference/api/enterprise-sso#fetch-org-scim-groups)

Fetches SCIM groups for an organization that has SCIM enabled and is syncing groups from an external identity provider.

### Required Permissions

Read SCIM Groups

### Properties

- Name `orgId` *Type string*  Description: The ID of the organization
- Name `userId` *Type string*  Description: Filter by a user ID to get groups that a specific user belongs to.
- Name `pageSize` *Type number*  Description: The number of results to return per page.
- Name `pageNumber` *Type number*  Description: The page number to return.

### Request

```javascript
auth.fetchOrgScimGroups({
    orgId: "1189c444-8a2d-4c41-8b4b-ae43ce79a492",
    userId: "31c41c16-c281-44ae-9602-8a047e3bf33d",
    pageSize: 10,
    pageNumber: 0,
})
```

### Successful Response

```json
{
  "total_groups": 2,
  "page_size": 10,
  "page_number": 0,
  "groups": [
    {
      "group_id": "021103f2-24c1-4867-bb51-d7a37777ea1d",
      "display_name": "Engineering",
      "external_id_from_idp": "abc123"
    },
    {
      "group_id": "4b14cf03-4f63-4840-9867-fb28c862b0d3",
      "display_name": "Sales",
      "external_id_from_idp": "abc1234"
    }
  ]
}
```

---

## [Fetch SCIM Group](https://docs.propelauth.com/reference/api/enterprise-sso#fetch-scim-group)

Fetches a SCIM group for an organization and returns the group's membership.

### Required Permissions

Read SCIM Groups

### Properties

- Name `orgId` *Type string*  Description: The ID of the organization
- Name `groupId` *Type string*  Description: The ID of the group to fetch.
- Name `membersPageSize` *Type number*  Description: The number of members to fetch per page.
- Name `membersPageNumber` *Type number*  Description: The page number of members to fetch.

### Request

```javascript
auth.fetchOrgScimGroup({
    orgId: "1189c444-8a2d-4c41-8b4b-ae43ce79a492",
    groupId: "31c41c16-c281-44ae-9602-8a047e3bf33d",
    membersPageSize: 10,
    membersPageNumber: 0,
})
```

### Successful Response

```json
{
  "group_id": "068ce3f1-0b7e-4b91-8559-f64a558d9f9f",
  "external_id_from_idp": "abc123",
  "display_name": "Engineering",
  "members": [
    {
      "user_id": "18bec57e-b6c0-4007-ba32-d65da45321ce"
    }
  ]
}
```