---
title: "GET /accounts/self/ssoAuthSettings"
method: GET
path: "/accounts/self/ssoAuthSettings"
tags: ["SSO"]
---

# GET /accounts/self/ssoAuthSettings

`GET /accounts/self/ssoAuthSettings`

Returns Single Sign On Authentication Settings for the given account.

## Query parameters

- `include` string[]

## Response `200`

OK

- union
  - ApiDisabledSsoSettings — No Single Sign On enabled and ssoOidcIdpConfigUrls include requested.
    - `type` 'disabled', required
    - `ssoOidcIdpConfigUrls` object — Optional include that can be requested to be returned to get OpenId Connect specific url(s) to be used when configuring the IDP.
      - `redirectUri` string, url — URL to be used in a third party IDP as allowed redirect URI. This value is unique to the account and its configuration, so please request it every time it is shown to the user and do not try to generate it.
  - ApiGenericOidcSsoSettings — Generic OpenID Connect SSO config.
    - `type` 'oidc', required
    - `spInitiatedSsoLogin` boolean — If this field is set to true, it means that all the non admin users under this account will use this SSO settings to authenticate when performing Service provider initiated login. A Service provider initiated login means that an unauthenticated user tries to directly login to an application like the VMS webapp and the application redirects them to their configured Identity provider to authenticate themselves. This is the opposite of an Idp initiated login where the user directly logs in to their identity provider, which then shows them a catalog of applications they have access to.
    - `ssoOidcIdpConfigUrls` object — Optional include that can be requested to be returned to get OpenId Connect specific url(s) to be used when configuring the IDP.
      - `redirectUri` string, url — URL to be used in a third party IDP as allowed redirect URI. This value is unique to the account and its configuration, so please request it every time it is shown to the user and do not try to generate it.
    - `config` object, required
      - `credentials` ApiIDPCredentials, required
        - `clientId` string, required
        - `clientSecret` string, required
      - `endpoints` ApiIDPEndpoints, required
        - `authorization` string, url, required — Authorization URL of the IDP
        - `token` string, url, required — Token URL of the IDP
        - `userInfo` string, url, required — User info URL of the IDP
        - `jwks` string, url, required — JWKs URL of the IDP
      - `issuer` ApiIDPIssuer, required
        - `url` string, url, required — Issuer URL of the IDP
    - `scim` Scim
      - `autoUserProvisioningEnabled` boolean — If this option is enabled, it means that if the user does not exist in the VMS, the system will automatically provision them, eliminating the need for any manual intervention.
  - ApiGoogleOidcSsoSettings — Google OpenID Connect SSO config.
    - `type` 'google', required
    - `spInitiatedSsoLogin` boolean — If this field is set to true, it means that all the non admin users under this account will use this SSO settings to authenticate when performing Service provider initiated login. A Service provider initiated login means that an unauthenticated user tries to directly login to an application like the VMS webapp and the application redirects them to their configured Identity provider to authenticate themselves. This is the opposite of an Idp initiated login where the user directly logs in to their identity provider, which then shows them a catalog of applications they have access to.
    - `ssoOidcIdpConfigUrls` object — Optional include that can be requested to be returned to get OpenId Connect specific url(s) to be used when configuring the IDP.
      - `redirectUri` string, url — URL to be used in a third party IDP as allowed redirect URI. This value is unique to the account and its configuration, so please request it every time it is shown to the user and do not try to generate it.
  - ApiOktaOidcSsoSettings — Okta OpenID Connect SSO config.
    - `type` 'okta', required
    - `spInitiatedSsoLogin` boolean — If this field is set to true, it means that all the non admin users under this account will use this SSO settings to authenticate when performing Service provider initiated login. A Service provider initiated login means that an unauthenticated user tries to directly login to an application like the VMS webapp and the application redirects them to their configured Identity provider to authenticate themselves. This is the opposite of an Idp initiated login where the user directly logs in to their identity provider, which then shows them a catalog of applications they have access to.
    - `ssoOidcIdpConfigUrls` object — Optional include that can be requested to be returned to get OpenId Connect specific url(s) to be used when configuring the IDP.
      - `redirectUri` string, url — URL to be used in a third party IDP as allowed redirect URI. This value is unique to the account and its configuration, so please request it every time it is shown to the user and do not try to generate it.
    - `config` object, required
      - `credentials` ApiIDPCredentials, required
        - `clientId` string, required
        - `clientSecret` string, required
      - `issuer` ApiIDPIssuer, required
        - `url` string, url, required — Issuer URL of the IDP
    - `scim` Scim
      - `autoUserProvisioningEnabled` boolean — If this option is enabled, it means that if the user does not exist in the VMS, the system will automatically provision them, eliminating the need for any manual intervention.
  - ApiMicrosoftGlobalOidcSsoSettings — If the "Microsoft Global" OIDC SSO type is configured, users with personal Microsoft accounts and users under any active directory can use it to login to the system. Guest users of an active directory can't use this configuration to login. As it is impossible to authoritatively decide which account an unknown user belongs to, Auto User Provisioning is not possible.
    - `type` 'microsoftGlobal', required
    - `spInitiatedSsoLogin` boolean — If this field is set to true, it means that all the non admin users under this account will use this SSO settings to authenticate when performing Service provider initiated login. A Service provider initiated login means that an unauthenticated user tries to directly login to an application like the VMS webapp and the application redirects them to their configured Identity provider to authenticate themselves. This is the opposite of an Idp initiated login where the user directly logs in to their identity provider, which then shows them a catalog of applications they have access to.
    - `ssoOidcIdpConfigUrls` object — Optional include that can be requested to be returned to get OpenId Connect specific url(s) to be used when configuring the IDP.
      - `redirectUri` string, url — URL to be used in a third party IDP as allowed redirect URI. This value is unique to the account and its configuration, so please request it every time it is shown to the user and do not try to generate it.
  - ApiMicrosoftActiveDirectoryOidcSsoSettings — With the "Microsoft Active Directory" OIDC SSO type, a specific active directory is configured as identity provider for the account. The specific directory is identified by the required tenantId. Any user and guest under this specific active directory can use this configuration to login. "Microsoft Accounts", also known as "Personal accounts" can only be used to identify as a user if that account has been invited as a guest account in the Active Directory. Auto User Provisioning can be enabled for this configuration.
    - `type` 'microsoftActiveDirectory', required
    - `spInitiatedSsoLogin` boolean — If this field is set to true, it means that all the non admin users under this account will use this SSO settings to authenticate when performing Service provider initiated login. A Service provider initiated login means that an unauthenticated user tries to directly login to an application like the VMS webapp and the application redirects them to their configured Identity provider to authenticate themselves. This is the opposite of an Idp initiated login where the user directly logs in to their identity provider, which then shows them a catalog of applications they have access to.
    - `ssoOidcIdpConfigUrls` object — Optional include that can be requested to be returned to get OpenId Connect specific url(s) to be used when configuring the IDP.
      - `redirectUri` string, url — URL to be used in a third party IDP as allowed redirect URI. This value is unique to the account and its configuration, so please request it every time it is shown to the user and do not try to generate it.
    - `config` object, required
      - `credentials` ApiIDPCredentials, required
        - `clientId` string, required
        - `clientSecret` string, required
      - `tenantId` string, required — Tenant id of the IDP
    - `scim` Scim
      - `autoUserProvisioningEnabled` boolean — If this option is enabled, it means that if the user does not exist in the VMS, the system will automatically provision them, eliminating the need for any manual intervention.
  - ApiBrivoSsoSettings — Brivo Security Suite (BSS) SSO config. Only available for BSS clients. Only the "Brivo Management User" Service Account (BMU) can update this setting.
    - `type` 'bss', required
    - `environment` 'production' | 'qa' | 'development', required — Environment of the Brivo Security Suite.
    - `ssoOidcIdpConfigUrls` object — Optional include that can be requested to be returned to get OpenId Connect specific url(s) to be used when configuring the IDP.
      - `redirectUri` string, url — URL to be used in a third party IDP as allowed redirect URI. This value is unique to the account and its configuration, so please request it every time it is shown to the user and do not try to generate it.

## Other responses

- `400` — The supplied object is invalid. Error detail will contain the validation error.
- `401` — You are not authenticated. Please authenticate and try again.
- `404` — Referenced resource could not be found.
- `500` — Something went wrong in the server. Please try again.

---

[API](https://skmtc.net/eagleeyenetworks/apis/devices.md) · [All operations](https://skmtc.net/eagleeyenetworks/apis/devices/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/eagleeyenetworks/devices/revisions/df57313de545/schema)