Replace an organization's SSO policy

curl --request PUT \
  --url https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "enforce_sso": true,
  "mfa_policy": "admins",
  "accepted_acr_values": [
    "phrh"
  ],
  "break_glass_user_id": "8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e"
}
'

import requests

url = "https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy"

payload = {
    "enforce_sso": True,
    "mfa_policy": "admins",
    "accepted_acr_values": ["phrh"],
    "break_glass_user_id": "8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    enforce_sso: true,
    mfa_policy: 'admins',
    accepted_acr_values: ['phrh'],
    break_glass_user_id: '8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e'
  })
};

fetch('https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'enforce_sso' => true,
    'mfa_policy' => 'admins',
    'accepted_acr_values' => [
        'phrh'
    ],
    'break_glass_user_id' => '8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy"

	payload := strings.NewReader("{\n  \"enforce_sso\": true,\n  \"mfa_policy\": \"admins\",\n  \"accepted_acr_values\": [\n    \"phrh\"\n  ],\n  \"break_glass_user_id\": \"8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e\"\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"enforce_sso\": true,\n  \"mfa_policy\": \"admins\",\n  \"accepted_acr_values\": [\n    \"phrh\"\n  ],\n  \"break_glass_user_id\": \"8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"enforce_sso\": true,\n  \"mfa_policy\": \"admins\",\n  \"accepted_acr_values\": [\n    \"phrh\"\n  ],\n  \"break_glass_user_id\": \"8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e\"\n}"

response = http.request(request)
puts response.read_body

{
  "enforce_sso": true,
  "mfa_policy": "none",
  "accepted_acr_values": [
    "phrh"
  ],
  "break_glass_user_id": "8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e",
  "connection_status": "active",
  "revoked_sessions": 4
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

Organizations

Replace an organization's SSO policy

Replaces the whole policy. Turning enforce_sso on needs the connection active (409) and deletes, in the same transaction, the sessions of the organization’s managed accounts that its IdP did not create (browser and CLI sessions from Google, GitHub or a TOTP sign-in), except the break-glass administrator’s; the answer counts them in revoked_sessions. The break-glass administrator must be an Organization Admin of the organization with Qumo TOTP on (422). Needs the organization’s plan to include SSO (402) and the organization not to be suspended (403), except for a policy that enforces nothing (enforce_sso false and mfa_policy none). Audited as organization.sso_policy_update; turning enforcement off also as organization.sso_enforcement_disable and designating a break-glass administrator as organization.sso_break_glass_designate, both high severity.

PUT

organizations

{id}

sso

policy

Replace an organization's SSO policy

curl --request PUT \
  --url https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "enforce_sso": true,
  "mfa_policy": "admins",
  "accepted_acr_values": [
    "phrh"
  ],
  "break_glass_user_id": "8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e"
}
'

import requests

url = "https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy"

payload = {
    "enforce_sso": True,
    "mfa_policy": "admins",
    "accepted_acr_values": ["phrh"],
    "break_glass_user_id": "8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    enforce_sso: true,
    mfa_policy: 'admins',
    accepted_acr_values: ['phrh'],
    break_glass_user_id: '8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e'
  })
};

fetch('https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'enforce_sso' => true,
    'mfa_policy' => 'admins',
    'accepted_acr_values' => [
        'phrh'
    ],
    'break_glass_user_id' => '8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy"

	payload := strings.NewReader("{\n  \"enforce_sso\": true,\n  \"mfa_policy\": \"admins\",\n  \"accepted_acr_values\": [\n    \"phrh\"\n  ],\n  \"break_glass_user_id\": \"8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e\"\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"enforce_sso\": true,\n  \"mfa_policy\": \"admins\",\n  \"accepted_acr_values\": [\n    \"phrh\"\n  ],\n  \"break_glass_user_id\": \"8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.qumo-deploy.com/v1/organizations/{id}/sso/policy")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"enforce_sso\": true,\n  \"mfa_policy\": \"admins\",\n  \"accepted_acr_values\": [\n    \"phrh\"\n  ],\n  \"break_glass_user_id\": \"8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e\"\n}"

response = http.request(request)
puts response.read_body

{
  "enforce_sso": true,
  "mfa_policy": "none",
  "accepted_acr_values": [
    "phrh"
  ],
  "break_glass_user_id": "8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e",
  "connection_status": "active",
  "revoked_sessions": 4
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

{
  "error": "organization_id is required"
}

Authorizations

Authorization

string

header

required

A personal access token (POST /v1/auth/tokens) or a machine identity token (POST /v1/projects/{project_id}/identities/{identity_id}/tokens), both prefixed qumo_pat_. A token's scopes cap what it can do; see Scopes and permissions. A personal token names no organization: on a route whose path names no project or organization, pass ?organization_id=.

Path Parameters

string<uuid>

required

The organization's id.

Body

application/json

The whole policy, replacing the stored one.

enforce_sso

boolean

required

Whether to enforce SSO. Turning it on needs the connection active (409).

Example:

true

mfa_policy

enum<string>

required

Who must prove MFA at the IdP. An empty string is none.

Available options:

none,

admins,

all

Example:

"admins"

accepted_acr_values

string[]

required

The acr values that prove MFA, at most 10 of 1 to 256 printable characters.

Maximum array length: 10

Required string length: 1 - 256

Example:

["phrh"]

break_glass_user_id

string<uuid> | null

required

The break-glass administrator: an Organization Admin of this organization with Qumo TOTP on (422 otherwise). Null for none.

Example:

"8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e"

Response

The policy was saved.

An organization's single sign-on policy. It is kept on the OIDC connection and applies only while the connection is active.

enforce_sso

boolean

required

Whether the organization's managed accounts must sign in through its IdP. Their Google and GitHub sign-ins are refused, except the break-glass administrator's.

Example:

true

mfa_policy

enum<string>

required

Who must prove a second factor at the IdP to sign in through the connection: nobody, Organization Admins, or everyone. Proof is an amr value naming a second factor (mfa, mca, otp, hwk, swk, sc, fpt, face, iris, retina, vbm) or an acr in accepted_acr_values; missing claims prove nothing.

Available options:

none,

admins,

all

accepted_acr_values

string[]

required

The acr values that prove MFA at this IdP.

Example:

["phrh"]

break_glass_user_id

string<uuid> | null

required

The Organization Admin exempt from enforced SSO, who signs in with Google or GitHub and Qumo TOTP; null for none.

Example:

"8b1d4c2e-5f6a-4b7c-9d8e-0f1a2b3c4d5e"

connection_status

enum<string>

required

The connection's status. The policy applies only while it is active.

Available options:

draft,

active,

disabled

Example:

"active"

revoked_sessions

integer<int64>

required

How many sessions turning enforcement on deleted: the managed accounts' browser and CLI sessions their IdP did not create, except the break-glass administrator's. 0 when enforcement was already on or stays off.

Required range: x >= 0

Example:

4