The team's single sign-on, as a member sees it

GET

/teams/{teamId}/sso

Any member (team:read). The client secret is never returned;
hasSecret says one is set. With each claimed domain's state and the
DNS record that proves it (domainClaims), the callback URL the
provider has to be told, and the address a sign-in starts at.

Capability: team:read (area team).

Request

Path Params

Responses

🟢200

application/json

The provider, or sso: null

Bodyapplication/json

🟠401KlockUnauthorized

🟠403Forbidden

🟠404NotFound

Response Example

200 - Example 1

{
    "sso": {
        "id": 0,
        "teamId": 0,
        "provider": "oidc",
        "issuer": "http://example.com",
        "clientId": "string",
        "hasSecret": true,
        "endpoints": {
            "authorization": "http://example.com",
            "token": "http://example.com",
            "userinfo": "http://example.com",
            "fetchedAt": "2019-08-24T14:15:22.123Z"
        },
        "domains": [
            "string"
        ],
        "defaultRole": "string",
        "enabled": true,
        "enforced": true,
        "createdAt": "2019-08-24T14:15:22.123Z",
        "updatedAt": "2019-08-24T14:15:22.123Z",
        "domainClaims": [
            {
                "domain": "example.com",
                "state": "pending",
                "challenge": {
                    "type": "TXT",
                    "name": "_prorm-challenge.example.com",
                    "value": "prorm-domain-verification=4f1c…"
                },
                "verifiedAt": "2019-08-24T14:15:22.123Z",
                "lastCheckedAt": "2019-08-24T14:15:22.123Z",
                "lastError": "string"
            }
        ]
    },
    "callbackUrl": "http://example.com",
    "startUrl": "http://example.com"
}

Modified at 2026-10-05 04:04:32

Which team an address signs in to

Set the team's OpenID Connect provider up, or change it