# Single Sign-On Overview Frontegg’s Single Sign-On (SSO) enables users to sign in using their existing credentials, removing the need to create new usernames and passwords specifically for your application. Our SSO solution supports two popular protocols: SAML and OpenID Connect (OIDC). These protocols facilitate user authentication across multiple applications and can be configured via Frontegg’s Management Portal or the Self-Service menu within your application. This section lists all relevant API endpoints, organized into Management and Self-Service categories: **Management Endpoints**: Require environment-level authorization and provide comprehensive control over SSO (SAML and OIDC) resources.
**Self-Service Endpoints**: Accessible with a user token (JWT), allowing users with appropriate permissions to create, update, and delete SSO connections on their accounts. Version: 1.0 ## Servers EU Region ``` https://api.frontegg.com/team ``` US Region ``` https://api.us.frontegg.com/team ``` CA Region ``` https://api.ca.frontegg.com/team ``` AU Region ``` https://api.au.frontegg.com/team ``` Frontegg sub-domain for use with user tokens ``` https://{domain}.frontegg.com/team ``` Variables: - `domain` Default: "app-xxx" ## Security ### bearer Type: http Scheme: bearer Bearer Format: JWT ## Download OpenAPI description [Single Sign-On Overview](https://developers.frontegg.com/_bundle/ciam/api/sso.yaml) ## SSO settings ### Get service provider metadata - [GET /resources/sso/v1/saml/configurations/sp-metadata](https://developers.frontegg.com/ciam/api/sso/sso-settings/samlcontrollerv1_getspmetadata.md): Retrieve the service provider metadata for a specific account (tenant). ### Exclude email from SSO - [POST /resources/sso/v1/configurations/excluded-emails](https://developers.frontegg.com/ciam/api/sso/sso-settings/excludeemailsfromssov1_excludessoemail.md): Exclude an email address from SSO enforcement. Provide the email address to exclude in the request body. ### Get SSO excluded emails - [GET /resources/sso/v1/configurations/excluded-emails](https://developers.frontegg.com/ciam/api/sso/sso-settings/excludeemailsfromssov1_getssoexcludedemails.md): Retrieve the list of email addresses excluded from SSO enforcement. ### Delete SSO excluded email - [DELETE /resources/sso/v1/configurations/excluded-emails/{email}](https://developers.frontegg.com/ciam/api/sso/sso-settings/excludeemailsfromssov1_deletessoexcludedemail.md): Remove an email address from the list of SSO-excluded emails. ### Vendor only - Force SSO domain validation - [PUT /resources/sso/v1/configurations/domains/{domain}/force-validate](https://developers.frontegg.com/ciam/api/sso/sso-settings/vendoronlyssoconfigurationcontrollerv1_forcessodomainvalidation.md): Force domain validation for SSO configuration in the environment. ### Get SSO per account (tenant) configuration - [GET /resources/sso/v1/configurations/multiple-sso-per-domain](https://developers.frontegg.com/ciam/api/sso/sso-settings/ssopertenantcontrollerv1_getssopertenantconfig.md): Retrieve the SSO configuration for a specific account (tenant). ### Create or update SSO per account (tenant) configuration - [PUT /resources/sso/v1/configurations/multiple-sso-per-domain](https://developers.frontegg.com/ciam/api/sso/sso-settings/ssopertenantcontrollerv1_createorupdatessopertenantconfig.md): Create or update the SSO configuration for a specific account (tenant). ### Configure OIDC - [POST /resources/sso/v1/oidc/configurations](https://developers.frontegg.com/ciam/api/sso/sso-settings/oidccontrollerv1_configureoidc.md): Configure or update an OpenID Connect (OIDC) identity provider for the environment. ## SAML configurations ### Get vendor's SAML config - [GET /resources/sso/v1/saml/configurations/vendor-config](https://developers.frontegg.com/ciam/api/sso/saml-configurations/samlcontrollerv1_getvendorsamlconfig.md): Retrieve the environment’s SAML configuration. Returns the current SAML identity provider settings configured for the environment. ### Get service provider certificate - [GET /resources/sso/v1/saml/configurations/sp-certificate](https://developers.frontegg.com/ciam/api/sso/saml-configurations/samlcontrollerv1_getspcertificate.md): Retrieve the service provider (SP) certificate used for SAML authentication. ## OIDC configurations ### Get OIDC configuration - [GET /resources/sso/v1/oidc/configurations](https://developers.frontegg.com/ciam/api/sso/oidc-configurations/oidccontrollerv1_getoidcconifguration.md): Retrieve the OpenID Connect (OIDC) configuration for the environment. ## SSO configurations ### Create SSO configuration - [POST /resources/sso/v1/configurations](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssoconfigurationcontrollerv1_createssoconfiguration.md): Create a new Single Sign-On (SSO) configuration for the specified account (tenant). ### Get SSO configurations - [GET /resources/sso/v1/configurations](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssoconfigurationcontrollerv1_getssoconfigurations.md): Retrieve Single Sign-On (SSO) configurations for the specified account (tenant). ### Delete SSO configuration - [DELETE /resources/sso/v1/configurations/{configurationId}](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssoconfigurationcontrollerv1_deletessoconfiguration.md): Delete Single Sign-On (SSO) configurations for the specified account (tenant). ### Update SSO configuration - [PATCH /resources/sso/v1/configurations/{configurationId}](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssoconfigurationcontrollerv1_updatessoconfiguration.md): Update SSO configuration ### Create SSO configuration using metadata - [POST /resources/sso/v1/configurations/metadata](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssoconfigurationcontrollerv1_createssoconfigurationbymetadata.md): Create a Single Sign-On (SSO) configuration using identity provider metadata for the specified account (tenant). ### Update SSO configuration using metadata - [PUT /resources/sso/v1/configurations/{configurationId}/metadata](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssoconfigurationcontrollerv1_updatessoconfigurationbymetadata.md): Update a Single Sign-On (SSO) configuration using identity provider metadata for the specified account (tenant). ### Create SSO domain - [POST /resources/sso/v1/configurations/{configurationId}/domains](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssodomaincontrollerv1_createssodomain.md): Add a domain to a Single Sign-On (SSO) configuration for the specified account (tenant). ### Delete SSO domain - [DELETE /resources/sso/v1/configurations/{configurationId}/domains/{domainId}](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssodomaincontrollerv1_deletessodomain.md): Remove a domain from a Single Sign-On (SSO) configuration for the specified account (tenant). ### Validate SSO domain by email - [PUT /resources/sso/v1/configurations/{configurationId}/domains/{domainId}/validate/email](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssodomaincontrollerv1_validatessodomainbyemail.md): Validate a domain in a Single Sign-On (SSO) configuration using the user's email domain. ### Validate SSO domain - [PUT /resources/sso/v2/configurations/{configurationId}/domains/{domainId}/validate](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssodomaincontrollerv2_validatessodomain.md): Validate a domain in a Single Sign-On (SSO) configuration for the specified account (tenant). ### Set SSO default roles - [PUT /resources/sso/v1/configurations/{configurationId}/roles](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssorolescontrollerv1_setssodefaultroles.md): Set default roles assigned to users authenticated through Single Sign-On (SSO) for the specified account (tenant). ### Get SSO default roles - [GET /resources/sso/v1/configurations/{configurationId}/roles](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssorolescontrollerv1_getssodefaultroles.md): Retrieve default roles assigned to users authenticated through Single Sign-On (SSO) for the specified account (tenant). ### Create an SSO group - [POST /resources/sso/v1/configurations/{configurationId}/groups](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssogroupscontrollerv1_createssogroup.md): Create a new SSO group for user management and access control within the specified SSO configuration for the account (tenant). ### Get SSO group - [GET /resources/sso/v1/configurations/{configurationId}/groups](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssogroupscontrollerv1_getssogroup.md): Retrieve an SSO group from the specified SSO configuration for the account (tenant). ### Update SSO group - [PATCH /resources/sso/v1/configurations/{configurationId}/groups/{groupId}](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssogroupscontrollerv1_updatessogroup.md): Update an existing SSO group within the specified SSO configuration for the account (tenant). ### Delete SSO group - [DELETE /resources/sso/v1/configurations/{configurationId}/groups/{groupId}](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssogroupscontrollerv1_deletessogroup.md): Delete an existing SSO group from the specified SSO configuration for the account (tenant). ### Create or update SSO domains configuration - [PUT /resources/sso/v1/configurations/domains](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssodomainsconfigurationcontrollerv1_createorupdatessodomainsconfiguration.md): Create or update the SSO domains configuration for the account (tenant). ### Get SSO domains configuration - [GET /resources/sso/v1/configurations/domains](https://developers.frontegg.com/ciam/api/sso/sso-configurations/ssodomainsconfigurationcontrollerv1_getssodomainsconfiguration.md): Retrieve the SSO domains configuration for the account (tenant).