{  "tenant": {    "id": "string",    "name": "string",    "selfProvisioningDomains": [      "string"    ],    "customAttributes": {      "attribute-key": "attribute-value"    },    "authType": "string",    "domains": [      "string"    ],    "createdTime": 0,    "disabled": true,    "enforceSSO": true,    "enforceSSOExclusions": [      "string"    ],    "federatedAppIds": [      "string"    ],    "parent": "string",    "successors": [      "string"    ],    "defaultRoles": [      "string"    ],    "roleInheritance": "string",    "additionalSSOConfigs": [      {        "ssoId": "string",        "name": "string",        "authType": "string"      }    ],    "approvedDomains": [      "string"    ],    "enforceSSOExclusionPermissions": [      "string"    ]  },  "saml": {    "idpEntityId": "string",    "idpSSOUrl": "string",    "idpCertificate": "string",    "idpMetadataUrl": "string",    "spEntityId": "string",    "spACSUrl": "string",    "spCertificate": "string",    "attributeMapping": {      "name": "string",      "email": "string",      "username": "string",      "group": "string",      "givenName": "string",      "middleName": "string",      "familyName": "string",      "picture": "string",      "customAttributes": {        "property1": "string",        "property2": "string"      },      "verifiedEmail": "string",      "verifiedPhone": "string"    },    "groupsMapping": [      {        "role": {          "id": "string",          "name": "string"        },        "groups": [          "string"        ]      }    ],    "redirectUrl": "string",    "spSignCertificate": "string",    "subjectNameIdFormat": "string",    "defaultSSORoles": [      "string"    ],    "fgaMappings": {      "property1": {        "relations": [          {            "resource": "string",            "relationDefinition": "string",            "namespace": "string"          }        ]      },      "property2": {        "relations": [          {            "resource": "string",            "relationDefinition": "string",            "namespace": "string"          }        ]      }    },    "providerID": "string",    "scimProviderID": "string",    "configFGATenantIDResourcePrefix": "string",    "configFGATenantIDResourceSuffix": "string",    "idpAdditionalCertificates": [      "string"    ],    "groupsPriority": [      "string"    ],    "lastSuccessTestTime": 0,    "disableSignRequest": true  },  "oidc": {    "name": "string",    "clientId": "string",    "clientSecret": "string",    "redirectUrl": "string",    "authUrl": "string",    "tokenUrl": "string",    "userDataUrl": "string",    "scope": [      "string"    ],    "JWKsUrl": "string",    "userAttrMapping": {      "loginId": "string",      "username": "string",      "name": "string",      "email": "string",      "verifiedEmail": "string",      "verifiedPhone": "string",      "picture": "string",      "givenName": "string",      "middleName": "string",      "familyName": "string",      "customAttributes": {        "property1": "string",        "property2": "string"      },      "group": "string"    },    "manageProviderTokens": true,    "callbackDomain": "string",    "prompt": [      "string"    ],    "grantType": "string",    "issuer": "string",    "groupsMapping": [      {        "role": {          "id": "string",          "name": "string"        },        "groups": [          "string"        ]      }    ],    "defaultSSORoles": [      "string"    ],    "fgaMappings": {      "property1": {        "relations": [          {            "resource": "string",            "relationDefinition": "string",            "namespace": "string"          }        ]      },      "property2": {        "relations": [          {            "resource": "string",            "relationDefinition": "string",            "namespace": "string"          }        ]      }    },    "roleMappings": [      {        "groups": [          "string"        ],        "roleName": "string"      }    ],    "providerID": "string",    "scimProviderID": "string",    "groupsPriority": [      "string"    ],    "lastSuccessTestTime": 0,    "authenticationOnly": true,    "replaceDefaultSSORoles": true,    "usePkce": true,    "jitDisabled": true  },  "ssoId": "string",  "name": "string",  "authenticationOnly": true,  "jitDisabled": true}

export interface Response {tenant?: {id?: stringname?: stringselfProvisioningDomains?: string[]/** * Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays. */customAttributes?: {[k: string]: string}authType?: stringdomains?: string[]createdTime?: numberdisabled?: booleanenforceSSO?: booleanenforceSSOExclusions?: string[]federatedAppIds?: string[]parent?: stringsuccessors?: string[]defaultRoles?: string[]roleInheritance?: stringadditionalSSOConfigs?: AdditionalSSOConfiguration[]/** * The tenant's vanity hostname (e.g. surveys.example.com), unique across the project's tenants. Requests that reach the project through its trusted proxy on this hostname are bound to this tenant. One item for now */approvedDomains?: string[]/** * Permission names or IDs whose holders in the tenant may sign in without SSO while enforceSSO is on (break-glass accounts) */enforceSSOExclusionPermissions?: string[]}saml?: SamlSettingsResponseoidc?: {name?: stringclientId?: stringclientSecret?: stringredirectUrl?: stringauthUrl?: stringtokenUrl?: stringuserDataUrl?: stringscope?: string[]JWKsUrl?: string/** * Note that this is used both in SSO settings and in OAuth settings import/export, *  make sure not to change any fields which might break backwards compatibility with *  existing exported project data */userAttrMapping?: {loginId?: stringusername?: stringname?: stringemail?: stringverifiedEmail?: stringverifiedPhone?: stringpicture?: stringgivenName?: stringmiddleName?: stringfamilyName?: stringcustomAttributes?: {[k: string]: string}group?: string}manageProviderTokens?: booleancallbackDomain?: stringprompt?: string[]grantType?: stringissuer?: stringgroupsMapping?: {role?: RoleItemgroups?: string[]}[]defaultSSORoles?: string[]fgaMappings?: {[k: string]: {relations?: ReBACGroupsMappingRelation[]}}roleMappings?: {groups?: string[]roleName?: string}[]providerID?: stringscimProviderID?: stringgroupsPriority?: string[]/** * Epoch seconds of the last successful SSO test login on this configuration. *  Read-only: populated on load responses, ignored on configure requests. */lastSuccessTestTime?: number/** * Verify identity only: a login through this SSO configuration creates no user and issues no *  session. Optional, so a caller that does not send it keeps whatever is stored rather than *  clearing it. Setting it here applies to the whole configuration - its SAML, OIDC and Cross-App *  Access rows move together, since leaving one behind would leave a path that still provisions a *  user. *  Write-only, the mirror of lastSuccessTestTime above: read on configure requests, never set when *  this message is returned as the oidc field of a load response. Read the classification from *  LoadSSOSettingsResponse.authenticationOnly, which answers for the whole configuration. */authenticationOnly?: boolean/** * When true, defaultSSORoles replaces the stored default SSO roles even when it is empty, which is *  how a caller clears them. When false, an empty defaultSSORoles keeps what is stored: over proto3 an *  empty list cannot be told apart from an omitted one. *  Write-only: read on configure requests, never set on load responses. */replaceDefaultSSORoles?: boolean/** * Send a PKCE (S256) code challenge in the authorization request to the IdP, and the code verifier *  on the code exchange. Applies to the authorization_code grant type only. *  Optional, so a caller that does not send it keeps whatever is stored rather than clearing it. */usePkce?: boolean/** * JIT provisioning off: a login through this SSO configuration signs in only users who already *  exist, and refuses anyone else with E062014 instead of creating them. Optional, so a caller that *  does not send it keeps whatever is stored rather than clearing it. Applies to the configuration *  named by ssoId, or to the tenant's default configuration when ssoId is empty. *  Write-only: read on configure requests. Read the stored value from *  LoadSSOSettingsResponse.jitDisabled. */jitDisabled?: boolean}ssoId?: string/** * Display name of the SSO configuration, as given when it was created. Empty for the tenant's default SSO configuration, which has no display name. */name?: string/** * Verify identity only: logins through this SSO configuration do not create, update or sign in a user. */authenticationOnly?: boolean/** * JIT provisioning off: logins through this SSO configuration sign in only users who already exist. */jitDisabled?: boolean}export interface AdditionalSSOConfiguration {ssoId?: stringname?: stringauthType?: string}export interface SamlSettingsResponse {idpEntityId?: stringidpSSOUrl?: stringidpCertificate?: stringidpMetadataUrl?: stringspEntityId?: stringspACSUrl?: stringspCertificate?: stringattributeMapping?: {name?: stringemail?: stringusername?: stringgroup?: stringgivenName?: stringmiddleName?: stringfamilyName?: stringpicture?: stringcustomAttributes?: {[k: string]: string}verifiedEmail?: stringverifiedPhone?: string}groupsMapping?: {role?: RoleItemgroups?: string[]}[]redirectUrl?: stringspSignCertificate?: stringsubjectNameIdFormat?: stringdefaultSSORoles?: string[]fgaMappings?: {[k: string]: {relations?: ReBACGroupsMappingRelation[]}}providerID?: stringscimProviderID?: stringconfigFGATenantIDResourcePrefix?: stringconfigFGATenantIDResourceSuffix?: stringidpAdditionalCertificates?: string[]groupsPriority?: string[]/** * Epoch seconds of the last successful SSO test login on this configuration. */lastSuccessTestTime?: number/** * True when Descope sends the SAML AuthnRequest to this IdP unsigned. */disableSignRequest?: boolean}export interface RoleItem {id?: stringname?: string}export interface ReBACGroupsMappingRelation {/** * Resource identifier of the relation */resource?: string/** * The name of the relation definition */relationDefinition?: string/** * The namespace of the relation definition */namespace?: string}