---
title: "Discover"
method: GET
path: "/api/auth/workos/discover"
tags: ["auth", "workos"]
---

# Discover

`GET /api/auth/workos/discover`

Email-domain SSO routing.

Looks up whether the email's domain belongs to a WorkOS Organization
that's wired to one of our ``Organization`` rows. Returns the org
slug + the ``/start`` URL the caller should redirect to. Returns
``{org_slug: null, login_url: null}`` when no SSO is configured for
the domain — the caller falls back to global Google login.

When the caller supplies ``frontend_origin``, it must match
``ALLOWED_FRONTEND_ORIGINS`` and is round-tripped into ``login_url``
so hosted browser callers can redirect to ``/start`` without
rebuilding the query string themselves.

WorkOS is the source of truth for ``OrganizationDomain``; we keep no
local copy. One WorkOS API call per discover, which is acceptable
since users only click "Continue with SSO" at most once per login.

## Query parameters

- `email` string, required
- `frontend_origin` string, nullable

## Response `200`

Successful Response

- DiscoverResponse
  - `org_slug` string, nullable, required
  - `login_url` string, nullable, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/quadrillion/apis/quadrillion-cloud-api.md) · [All operations](https://skmtc.net/quadrillion/apis/quadrillion-cloud-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/quadrillion/quadrillion-cloud-api/revisions/ee473d0e84e0/schema)