> ## Documentation Index > Fetch the complete documentation index at: https://docs.qumo-deploy.com/llms.txt > Use this file to discover all available pages before exploring further. # Get an organization's OIDC connection > Returns the organization's OIDC connection to its identity provider, with the redirect URI to register at the IdP. The client secret is never returned, only whether one is set and its last four characters. 404 when the organization has no connection. ## OpenAPI ````yaml /api-reference/openapi.yaml get /v1/organizations/{id}/sso/oidc openapi: 3.1.0 info: title: Qumo Deploy REST API description: > The Qumo Deploy control plane: organizations, projects, signing keys, machine identities, access control, audit and billing. Relay credentials are not issued here: your app signs them with its own [signing keys](/guides/signing-keys). Every operation here is generated against the routes the server registers and checked in CI, so an operation in this reference exists and a route missing from it is deliberately internal (relay mesh, webhooks, probes, operator-only and browser sign-in routes). Errors are JSON objects with one `error` field. What each status code means is in [Error codes](/guides/error-codes); the token scope each permission needs is in [Scopes and permissions](/guides/scopes-permissions). version: 1.0.0 servers: - url: https://api.qumo-deploy.com description: Public API (Bearer tokens only; cookies are ignored) security: [] tags: - name: Account description: The signed-in user's own sessions, tokens, security settings and data. - name: Device flow description: OAuth 2.0 device authorization, used by `qumod login`. - name: Organizations description: Organizations, their members and usage. - name: Projects description: Projects inside an organization. - name: Signing keys description: Keys your app signs relay credentials with. - name: Relays description: Where clients of a broadcast path connect. - name: Identities description: Machine identities, their tokens and IP allowlists. - name: Access control description: Roles, IAM bindings and invitations. - name: Audit description: The audit log and its webhook. - name: Notifications description: Notification policies. - name: Billing description: Plans, usage cost, budgets, invoices and payment methods. - name: Pricing description: Public price list. paths: /v1/organizations/{id}/sso/oidc: parameters: - name: id in: path required: true description: The organization's id. schema: type: string format: uuid example: 3f8c2a1e-7b4d-4e9a-9c61-2d5e8f0a1b7c get: tags: - Organizations summary: Get an organization's OIDC connection description: | Returns the organization's OIDC connection to its identity provider, with the redirect URI to register at the IdP. The client secret is never returned, only whether one is set and its last four characters. 404 when the organization has no connection. operationId: getOrganizationOIDCConnection responses: '200': description: The organization's connection. content: application/json: schema: $ref: '#/components/schemas/OIDCConnection' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' security: - token: [] - cliSession: [] - sessionCookie: [] components: schemas: OIDCConnection: type: object required: - id - organization_id - protocol - issuer - client_id - client_secret - scopes - claims - status - redirect_uri - created_at - updated_at - last_tested_at - last_test_succeeded_at properties: id: type: string format: uuid example: 8b1d3f5a-2c4e-4f6a-8b0d-1e3f5a7c9b2d organization_id: type: string format: uuid example: 3f8c2a1e-7b4d-4e9a-9c61-2d5e8f0a1b7c protocol: type: string enum: - oidc issuer: type: string format: uri example: https://acme.okta.com client_id: type: string example: 0oa8f2k3l9XyZ1abc357 client_secret: $ref: '#/components/schemas/OIDCConnectionSecret' scopes: type: array items: type: string example: - openid - email - profile claims: $ref: '#/components/schemas/OIDCClaimMapping' status: type: string enum: - draft - active - disabled description: | `draft` until activated: a draft connection can be tested but is not used to sign in. `active` once a test login of the current configuration passed and it was activated. `disabled` when turned off. redirect_uri: type: string format: uri description: The redirect URI to register at the IdP. example: https://console.qumo-deploy.com/oauth/sso/callback created_at: type: string format: date-time updated_at: type: string format: date-time last_tested_at: type: string format: date-time nullable: true description: >- When the current configuration last finished a test login; cleared when the configuration changes. last_test_succeeded_at: type: string format: date-time nullable: true description: When the current configuration last passed a test login. last_test_result: type: string enum: - passed - exchange_failed - invalid_token - email_missing - email_unverified - discovery_failed - configuration_changed - idp_denied description: The last test login's result; absent before the first. OIDCConnectionSecret: type: object description: What the API says about the client secret; never the secret itself. required: - set - last4 properties: set: type: boolean last4: type: string example: x9Qk OIDCClaimMapping: type: object description: The ID token claims read for each attribute, by name. required: - email - email_verified - name - groups properties: email: type: string default: email example: email email_verified: type: string default: email_verified description: >- A boolean claim. Microsoft Entra ID does not send `email_verified`; map it to `xms_edov`. example: email_verified name: type: string default: name example: name groups: type: string default: groups example: groups Error: type: object required: - error properties: error: type: string description: A human-readable message. example: organization_id is required responses: BadRequest: description: >- Malformed request or failed validation. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing or invalid credentials. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: >- Authenticated but not allowed (permission, token scope, IP allowlist or CSRF). See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: >- Not found, or not visible to the caller. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: token: type: http scheme: bearer bearerFormat: qumo_pat_ description: > A personal access token (`POST /v1/auth/tokens`) or a machine identity token (`POST /v1/projects/{project_id}/identities/{identity_id}/tokens`), both prefixed `qumo_pat_`. A token's scopes cap what it can do; see [Scopes and permissions](/guides/scopes-permissions). A personal token names no organization: on a route whose path names no project or organization, pass `?organization_id=`. cliSession: type: http scheme: bearer description: | The session token `qumod login` obtains through the device flow (`POST /v1/auth/device/token`). It acts as the signed-in user, like a console session, and needs no CSRF token. sessionCookie: type: apiKey in: cookie name: __Host-qumo_session description: | The console's browser session. Accepted only on the console origin (`https://console.qumo-deploy.com`), never on `api.qumo-deploy.com`. A request that changes state must also send `X-CSRF-Token`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.