Workspace: sso

Whether this workspace requires single sign-on, its connections and its domains

GET /v1/workspace/sso · operation getSso

Requires the batondeck:workspace:read permission (action sso:read).

Responses

Status	Meaning
200	Whether this workspace requires single sign-on, its connections and its domains
401	No portal session, and no live API key.
403	The policy refused, or the request was cross-site.
404	No such resource, or none this session may see.

200 response schema

{
  "type": "object",
  "properties": {
    "entitled": {
      "type": "boolean"
    },
    "required": {
      "type": "boolean"
    },
    "provider_configured": {
      "type": "boolean"
    },
    "connections": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string"
          },
          "type": {
            "type": "string"
          },
          "state": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "type",
          "state"
        ],
        "additionalProperties": false
      }
    },
    "domains": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "domain": {
            "type": "string"
          },
          "state": {
            "type": "string"
          }
        },
        "required": [
          "domain",
          "state"
        ],
        "additionalProperties": false
      }
    },
    "signed_in_with_sso": {
      "type": "boolean"
    }
  },
  "required": [
    "entitled",
    "required",
    "provider_configured",
    "connections",
    "domains",
    "signed_in_with_sso"
  ],
  "additionalProperties": false
}

curl -X GET 'https://api.batondeck.com/v1/workspace/sso' \
  -H "Authorization: Bearer $BATONDECK_API_KEY"

Require single sign-on for this workspace, or stop requiring it

PATCH /v1/workspace/sso · operation setSsoRequired

Requires the batondeck:workspace:admin permission (action sso:manage).

Requires a step-up: MFA enrolled and re-authenticated within 15 minutes. Not reachable with an API key — a key has no session and so can never step up.

Refused while the workspace is suspended or on deletion hold.

Request body (application/json)

Field	Type	Required	Notes
required	boolean	yes

Request schema

{
  "type": "object",
  "properties": {
    "required": {
      "type": "boolean"
    }
  },
  "required": [
    "required"
  ],
  "additionalProperties": false
}

Responses

Status	Meaning
200	Require single sign-on for this workspace, or stop requiring it
400	The arguments did not validate.
401	No portal session, and no live API key.
403	The policy refused, or the request was cross-site.
404	No such resource, or none this session may see.

200 response schema

{
  "type": "object",
  "properties": {
    "entitled": {
      "type": "boolean"
    },
    "required": {
      "type": "boolean"
    },
    "provider_configured": {
      "type": "boolean"
    },
    "connections": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string"
          },
          "type": {
            "type": "string"
          },
          "state": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "type",
          "state"
        ],
        "additionalProperties": false
      }
    },
    "domains": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "domain": {
            "type": "string"
          },
          "state": {
            "type": "string"
          }
        },
        "required": [
          "domain",
          "state"
        ],
        "additionalProperties": false
      }
    },
    "signed_in_with_sso": {
      "type": "boolean"
    }
  },
  "required": [
    "entitled",
    "required",
    "provider_configured",
    "connections",
    "domains",
    "signed_in_with_sso"
  ],
  "additionalProperties": false
}

curl -X PATCH 'https://api.batondeck.com/v1/workspace/sso' \
  -H "Authorization: Bearer $BATONDECK_API_KEY" \
  -H 'content-type: application/json' \
  -d @body.json

A short-lived link into the identity provider’s Admin Portal, to set up a connection or verify a domain

POST /v1/workspace/sso/portal-link · operation createSsoPortalLink

Requires the batondeck:workspace:admin permission (action sso:manage).

Requires a step-up: MFA enrolled and re-authenticated within 15 minutes. Not reachable with an API key — a key has no session and so can never step up.

Refused while the workspace is suspended or on deletion hold.

Request body (application/json)

Field	Type	Required	Notes
intent	“sso” \	“domain_verification”	yes

Request schema

{
  "type": "object",
  "properties": {
    "intent": {
      "type": "string",
      "enum": [
        "sso",
        "domain_verification"
      ]
    }
  },
  "required": [
    "intent"
  ],
  "additionalProperties": false
}

Responses

Status	Meaning
200	A short-lived link into the identity provider’s Admin Portal, to set up a connection or verify a domain
400	The arguments did not validate.
401	No portal session, and no live API key.
403	The policy refused, or the request was cross-site.
404	No such resource, or none this session may see.

200 response schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string"
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false
}

curl -X POST 'https://api.batondeck.com/v1/workspace/sso/portal-link' \
  -H "Authorization: Bearer $BATONDECK_API_KEY" \
  -H 'content-type: application/json' \
  -d @body.json