Skip to main content
GET
Get an organization's SSO policy

Authorizations

Authorization
string
header
required

A personal access token (POST /v1/auth/tokens) or a machine identity token (POST /v1/projects/{project_id}/identities/{identity_id}/tokens), both prefixed qumo_pat_. A token's scopes cap what it can do; see Scopes and permissions. A personal token names no organization: on a route whose path names no project or organization, pass ?organization_id=.

Path Parameters

id
string<uuid>
required

The organization's id.

Response

The organization's policy.

An organization's single sign-on policy. It is kept on the OIDC connection and applies only while the connection is active.

enforce_sso
boolean
required

Whether the organization's managed accounts must sign in through its IdP. Their Google and GitHub sign-ins are refused, except the break-glass administrator's.

Example:

true

mfa_policy
enum<string>
required

Who must prove a second factor at the IdP to sign in through the connection: nobody, Organization Admins, or everyone. Proof is an amr value naming a second factor (mfa, mca, otp, hwk, swk, sc, fpt, face, iris, retina, vbm) or an acr in accepted_acr_values; missing claims prove nothing.

Available options:
none,
admins,
all
accepted_acr_values
string[]
required

The acr values that prove MFA at this IdP.

Example:
break_glass_user_id
string<uuid> | null
required

The Organization Admin exempt from enforced SSO, who signs in with Google or GitHub and Qumo TOTP; null for none.

Example:

"8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e"

connection_status
enum<string>
required

The connection's status. The policy applies only while it is active.

Available options:
draft,
active,
disabled
Example:

"active"