SSO & SCIM API

9 operations. Paths are relative to the API host (http://localhost:5080 in local development). Every operation accepts an OIDC bearer token (Authorization: Bearer …) or a workspace API key (X-Api-Key: keel_live_…); errors are RFC 9457 Problem Details with a code (error codes). Permissions: matrix.

Method	Path	Summary
GET	/api/v1/tenant/scim	SCIM provisioning: the endpoint URL, token metadata (never the token), last sync, and provisioned groups with their roles (Owners).
PUT	/api/v1/tenant/scim/attribute-mappings	Replace which SCIM user attributes become member attributes for row filters (SCIM values win over manual ones; audited).
PUT	/api/v1/tenant/scim/groups/{groupId}/role	Map a provisioned group to a workspace role (null unmaps it); members' access follows at once.
POST	/api/v1/tenant/scim/token	Generate the SCIM bearer token, shown once. The previous token keeps working for 24 hours.
GET	/api/v1/tenant/sso	The tenant's single sign-on: IdP (OIDC or SAML, never the secret), broker URLs, verified domains, enforcement and the last test (Owners).
POST	/api/v1/tenant/sso:test	Record a test sign-in: the token from a sign-in through the tenant's IdP proves the round trip and the claims received.
PUT	/api/v1/tenant/sso/enforcement	Require SSO for verified domains (needs a successful test, a verified domain and a break-glass Owner), or stop requiring it.
PUT	/api/v1/tenant/sso/oidc	Set up the tenant's OpenID Connect IdP: the broker imports its discovery document. The client secret is write-only.
PUT	/api/v1/tenant/sso/saml	Set up the tenant's SAML 2.0 IdP from its metadata URL (imported by the broker).

GetScimSettings

GET /api/v1/tenant/scim

SCIM provisioning: the endpoint URL, token metadata (never the token), last sync, and provisioned groups with their roles (Owners).

Status	Description	Body
200	OK	ScimSettingsResponse

Response 200: ScimSettingsResponse

Field	Type	Notes
attributeMappings	ScimAttributeMappingDto[]
enabled	boolean
endpointUrl	string
groups	ScimGroupMappingDto[]
lastSyncAt	date-time?
previousTokenValidUntil	date-time?
tokenCreatedAt	date-time?
tokenPrefix	string?
users	int32

SetScimAttributeMappings

PUT /api/v1/tenant/scim/attribute-mappings

Replace which SCIM user attributes become member attributes for row filters (SCIM values win over manual ones; audited).

Request body (application/json): SetScimAttributeMappingsRequest

Field	Type	Notes
mappings	ScimAttributeMappingDto[]	The whole mapping (replaced): SCIM attribute → Keel member attribute, at most 20.

Status	Description	Body
204	No Content	—

MapScimGroupRole

PUT /api/v1/tenant/scim/groups/{groupId}/role

Map a provisioned group to a workspace role (null unmaps it); members' access follows at once.

Parameter	In	Type	Required	Notes
groupId	path	uuid	yes

Request body (application/json): MapScimGroupRoleRequest

Field	Type	Notes
role	WorkspaceRole?	Viewer, Analyst, Modeler, Steward or Admin; null unmaps the group. Never Owner.

Status	Description	Body
204	No Content	—

GenerateScimToken

POST /api/v1/tenant/scim/token

Generate the SCIM bearer token, shown once. The previous token keeps working for 24 hours.

Status	Description	Body
200	OK	ScimTokenResponse

Response 200: ScimTokenResponse

Field	Type	Notes
prefix	string
previousTokenValidUntil	date-time?
token	string

GetSsoSettings

GET /api/v1/tenant/sso

The tenant's single sign-on: IdP (OIDC or SAML, never the secret), broker URLs, verified domains, enforcement and the last test (Owners).

Status	Description	Body
200	OK	SsoSettingsResponse

Response 200: SsoSettingsResponse

Field	Type	Notes
breakGlassUserId	uuid?
broker	IdpBrokerEndpoints?
brokerAvailable	boolean
clientId	string?
configured	boolean
domains	SsoDomainDto[]
enforced	boolean
idpAlias	string
issuer	string?
lastTest	SsoTestDto?
metadataUrl	string?
owners	SsoOwnerDto[]
protocol	string?
secretSetAt	date-time?

TestSsoSignIn

POST /api/v1/tenant/sso:test

Record a test sign-in: the token from a sign-in through the tenant's IdP proves the round trip and the claims received.

Request body (application/json): TestSsoSignInRequest

Field	Type	Notes
accessToken	string	The access token the test sign-in popup received (validated, never stored).

Status	Description	Body
200	OK	SsoTestResultResponse

Response 200: SsoTestResultResponse

Field	Type	Notes
email	string?
emailReceived	boolean
failure	string?
groupsReceived	boolean
succeeded	boolean

SetSsoEnforcement

PUT /api/v1/tenant/sso/enforcement

Require SSO for verified domains (needs a successful test, a verified domain and a break-glass Owner), or stop requiring it.

Request body (application/json): SetSsoEnforcementRequest

Field	Type	Notes
breakGlassUserId	uuid?
enforce	boolean

Status	Description	Body
204	No Content	—

ConfigureOidcSso

PUT /api/v1/tenant/sso/oidc

Set up the tenant's OpenID Connect IdP: the broker imports its discovery document. The client secret is write-only.

Request body (application/json): ConfigureOidcSsoRequest

Field	Type	Notes
clientId	string
clientSecret	string?	Leave empty to keep the current secret. Stored in the secret store and the broker; never returned.
issuer	string

Status	Description	Body
204	No Content	—

ConfigureSamlSso

PUT /api/v1/tenant/sso/saml

Set up the tenant's SAML 2.0 IdP from its metadata URL (imported by the broker).

Request body (application/json): ConfigureSamlSsoRequest

Field	Type	Notes
metadataUrl	string

Status	Description	Body
204	No Content	—