---
title: "Get"
method: GET
path: "/api/v1/settings/sso"
tags: ["SSO"]
---

# Get

`GET /api/v1/settings/sso`

Get returns the tenant's SSO provider settings.

## Response `200`

SSOSettingsServiceGetResponse returns the tenant's SSO provider settings.

- C1ApiSsoV1SSOSettingsServiceGetResponse — SSOSettingsServiceGetResponse returns the tenant's SSO provider settings.
  - `settings` C1ApiSsoV1SSOSettings — SSOSettings is the per-tenant configuration for ConductorOne acting as an SSO provider.
    - `createdAt` string, date-time, nullable
    - `defaultAssertionLifetime` string, duration, nullable
    - `defaultIdTokenSignedResponseAlg` 'OIDC_SIGNING_ALGORITHM_UNSPECIFIED' | 'OIDC_SIGNING_ALGORITHM_EDDSA' | 'OIDC_SIGNING_ALGORITHM_ES256' | 'OIDC_SIGNING_ALGORITHM_RS256' — The id_token signing algorithm applied to OIDC applications that do not choose one. When unset, the server uses EdDSA.
    - `defaultSubjectType` 'SSO_SUBJECT_TYPE_UNSPECIFIED' | 'SSO_SUBJECT_TYPE_PAIRWISE' | 'SSO_SUBJECT_TYPE_PUBLIC' | 'SSO_SUBJECT_TYPE_COMPATIBILITY' — The subject type materialized onto new SSO applications that do not choose one. Changing this default does not change existing applications. When unset, the server uses pairwise subjects.
    - `enabled` boolean — Master switch for the SSO provider. ConductorOne also gates the feature behind an operator-controlled rollout flag; this is the tenant administrator's intent. Individual SSO applications can still be disabled one at a time.
    - `updatedAt` string, date-time, nullable

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)