Preview an identity provider's configuration

POST

/api/v1/team/sso/discover

curl --request POST \
  --url https://api.deploybase.eu/api/v1/api/v1/team/sso/discover \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "issuer": "example" }'

Fetches and validates an issuer’s OpenID discovery document and reports what it found: the canonical issuer, the detected provider flavour, the endpoints, the profile mapping we would default to, and any warnings. Writes nothing and creates nothing, so it is safe to call repeatedly while an admin corrects an address. This is the first step of setting a connection up: it lets the admin confirm we reached the right provider before they produce a client id and secret. Team admin or owner.

Authorizations

• BearerAuth

Request Body

The issuer address to preview

Media type application/json

object

issuer

string

Example ^generated

{
  "issuer": "example"
}

Responses

200

OK

Media type application/json

object

data

meta

object

request_id

string

timestamp

string

trace_id

string

data

object

authorization_endpoint

The endpoints we found. Shown back to the admin as evidence that we reached the right provider, which is the whole point of a preview step: a reachable issuer at the wrong address is the failure a list of endpoints catches and a green tick does not. UserinfoEndpoint is empty for a provider that has none.

string

issuer

Issuer is the canonical issuer the document reports, which is the value that should be submitted to Create — not necessarily the one the admin typed.

string

jwks_uri

string

provider

Provider is the detected flavour: generic_oidc, keycloak or authentik. It picks the setup copy and prefills the connection name.

string

recommended_is_id_token_mapping

RecommendedIsIDTokenMapping is what Create would choose if the admin expressed no preference, so the form can show the resolved value rather than an empty control.

boolean

redirect_uri

RedirectURI is the callback to register in the IdP, repeated here so the preview step can show it without a second call.

string

suggested_issuer

SuggestedIssuer is set only when the typed address and the document disagree in a way we can fix for them, which in practice is a trailing slash. Empty otherwise.

string

suggested_name

SuggestedName is a sensible prefill for the connection name, from the flavour. The admin owns the final value — it becomes the label on their sign-in button.

string

token_endpoint

string

userinfo_endpoint

string

warnings

Warnings are the same advisories Create would return, in the same three-field shape, seen before anything is created rather than after.

Array<object>

object

code

string

docs_url

string

message

string

Example ^generated

{
  "data": {
    "authorization_endpoint": "example",
    "issuer": "example",
    "jwks_uri": "example",
    "provider": "example",
    "recommended_is_id_token_mapping": true,
    "redirect_uri": "example",
    "suggested_issuer": "example",
    "suggested_name": "example",
    "token_endpoint": "example",
    "userinfo_endpoint": "example",
    "warnings": [
      {
        "code": "example",
        "docs_url": "example",
        "message": "example"
      }
    ]
  },
  "meta": {
    "request_id": "example",
    "timestamp": "example",
    "trace_id": "example"
  }
}

400

Bad Request

Media type application/json

object

code

string

details

error

string

meta

object

request_id

string

timestamp

string

trace_id

string

Example ^generated

{
  "code": "example",
  "details": "example",
  "error": "example",
  "meta": {
    "request_id": "example",
    "timestamp": "example",
    "trace_id": "example"
  }
}

401

Unauthorized

Media type application/json

object

code

string

details

error

string

meta

object

request_id

string

timestamp

string

trace_id

string

Example ^generated

{
  "code": "example",
  "details": "example",
  "error": "example",
  "meta": {
    "request_id": "example",
    "timestamp": "example",
    "trace_id": "example"
  }
}

403

Forbidden

Media type application/json

object

code

string

details

error

string

meta

object

request_id

string

timestamp

string

trace_id

string

Example ^generated

{
  "code": "example",
  "details": "example",
  "error": "example",
  "meta": {
    "request_id": "example",
    "timestamp": "example",
    "trace_id": "example"
  }
}

422

INVALID_INPUT, SSO_ISSUER_INVALID, SSO_ISSUER_UNREACHABLE, SSO_ISSUER_MISMATCH or SSO_DISCOVERY_INCOMPLETE

Media type application/json

object

code

string

details

error

string

meta

object

request_id

string

timestamp

string

trace_id

string

Example ^generated

{
  "code": "example",
  "details": "example",
  "error": "example",
  "meta": {
    "request_id": "example",
    "timestamp": "example",
    "trace_id": "example"
  }
}