{  "tenant": {    "id": "string",    "name": "string",    "selfProvisioningDomains": [      "string"    ],    "customAttributes": {      "attribute-key": "attribute-value"    },    "authType": "string",    "domains": [      "string"    ],    "createdTime": 0,    "disabled": true,    "enforceSSO": true,    "enforceSSOExclusions": [      "string"    ],    "federatedAppIds": [      "string"    ],    "parent": "string",    "successors": [      "string"    ],    "defaultRoles": [      "string"    ],    "roleInheritance": "string",    "additionalSSOConfigs": [      {        "ssoId": "string",        "name": "string",        "authType": "string"      }    ]  },  "saml": {    "idpEntityId": "string",    "idpSSOUrl": "string",    "idpCertificate": "string",    "idpMetadataUrl": "string",    "spEntityId": "string",    "spACSUrl": "string",    "spCertificate": "string",    "attributeMapping": {      "name": "string",      "email": "string",      "username": "string",      "group": "string",      "givenName": "string",      "middleName": "string",      "familyName": "string",      "picture": "string",      "customAttributes": {        "property1": "string",        "property2": "string"      },      "verifiedEmail": "string",      "verifiedPhone": "string"    },    "groupsMapping": [      {        "role": {          "id": "string",          "name": "string"        },        "groups": [          "string"        ]      }    ],    "redirectUrl": "string",    "spSignCertificate": "string",    "subjectNameIdFormat": "string",    "defaultSSORoles": [      "string"    ],    "fgaMappings": {      "property1": {        "relations": [          {            "resource": "string",            "relationDefinition": "string",            "namespace": "string"          }        ]      },      "property2": {        "relations": [          {            "resource": "string",            "relationDefinition": "string",            "namespace": "string"          }        ]      }    },    "providerID": "string",    "scimProviderID": "string",    "configFGATenantIDResourcePrefix": "string",    "configFGATenantIDResourceSuffix": "string",    "idpAdditionalCertificates": [      "string"    ],    "groupsPriority": [      "string"    ],    "lastSuccessTestTime": 0,    "disableSignRequest": true  },  "oidc": {    "name": "string",    "clientId": "string",    "clientSecret": "string",    "redirectUrl": "string",    "authUrl": "string",    "tokenUrl": "string",    "userDataUrl": "string",    "scope": [      "string"    ],    "JWKsUrl": "string",    "userAttrMapping": {      "loginId": "string",      "username": "string",      "name": "string",      "email": "string",      "verifiedEmail": "string",      "verifiedPhone": "string",      "picture": "string",      "givenName": "string",      "middleName": "string",      "familyName": "string",      "customAttributes": {        "property1": "string",        "property2": "string"      },      "group": "string"    },    "manageProviderTokens": true,    "callbackDomain": "string",    "prompt": [      "string"    ],    "grantType": "string",    "issuer": "string",    "groupsMapping": [      {        "role": {          "id": "string",          "name": "string"        },        "groups": [          "string"        ]      }    ],    "defaultSSORoles": [      "string"    ],    "fgaMappings": {      "property1": {        "relations": [          {            "resource": "string",            "relationDefinition": "string",            "namespace": "string"          }        ]      },      "property2": {        "relations": [          {            "resource": "string",            "relationDefinition": "string",            "namespace": "string"          }        ]      }    },    "roleMappings": [      {        "groups": [          "string"        ],        "roleName": "string"      }    ],    "providerID": "string",    "scimProviderID": "string",    "groupsPriority": [      "string"    ],    "lastSuccessTestTime": 0,    "authenticationOnly": true,    "replaceDefaultSSORoles": true  },  "ssoId": "string",  "name": "string",  "authenticationOnly": true}

export interface Response {tenant?: {id?: stringname?: stringselfProvisioningDomains?: string[]/** * Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays. */customAttributes?: {[k: string]: string}authType?: stringdomains?: string[]createdTime?: numberdisabled?: booleanenforceSSO?: booleanenforceSSOExclusions?: string[]federatedAppIds?: string[]parent?: stringsuccessors?: string[]defaultRoles?: string[]roleInheritance?: stringadditionalSSOConfigs?: AdditionalSSOConfiguration[]}saml?: SamlSettingsResponseoidc?: {name?: stringclientId?: stringclientSecret?: stringredirectUrl?: stringauthUrl?: stringtokenUrl?: stringuserDataUrl?: stringscope?: string[]JWKsUrl?: string/** * Note that this is used both in SSO settings and in OAuth settings import/export, *  make sure not to change any fields which might break backwards compatibility with *  existing exported project data */userAttrMapping?: {loginId?: stringusername?: stringname?: stringemail?: stringverifiedEmail?: stringverifiedPhone?: stringpicture?: stringgivenName?: stringmiddleName?: stringfamilyName?: stringcustomAttributes?: {[k: string]: string}group?: string}manageProviderTokens?: booleancallbackDomain?: stringprompt?: string[]grantType?: stringissuer?: stringgroupsMapping?: {role?: RoleItemgroups?: string[]}[]defaultSSORoles?: string[]fgaMappings?: {[k: string]: {relations?: ReBACGroupsMappingRelation[]}}roleMappings?: {groups?: string[]roleName?: string}[]providerID?: stringscimProviderID?: stringgroupsPriority?: string[]/** * Epoch seconds of the last successful SSO test login on this configuration. *  Read-only: populated on load responses, ignored on configure requests. */lastSuccessTestTime?: number/** * Verify identity only: a login through this SSO configuration creates no user and issues no *  session. Optional, so a caller that does not send it keeps whatever is stored rather than *  clearing it. Setting it here applies to the whole configuration - its SAML, OIDC and Cross-App *  Access rows move together, since leaving one behind would leave a path that still provisions a *  user. *  Write-only, the mirror of lastSuccessTestTime above: read on configure requests, never set when *  this message is returned as the oidc field of a load response. Read the classification from *  LoadSSOSettingsResponse.authenticationOnly, which answers for the whole configuration. */authenticationOnly?: boolean/** * When true, defaultSSORoles replaces the stored default SSO roles even when it is empty, which is *  how a caller clears them. When false, an empty defaultSSORoles keeps what is stored: over proto3 an *  empty list cannot be told apart from an omitted one. *  Write-only: read on configure requests, never set on load responses. */replaceDefaultSSORoles?: boolean}ssoId?: string/** * Display name of the SSO configuration, as given when it was created. Empty for the tenant's default SSO configuration, which has no display name. */name?: string/** * Verify identity only: logins through this SSO configuration do not create, update or sign in a user. */authenticationOnly?: boolean}export interface AdditionalSSOConfiguration {ssoId?: stringname?: stringauthType?: string}export interface SamlSettingsResponse {idpEntityId?: stringidpSSOUrl?: stringidpCertificate?: stringidpMetadataUrl?: stringspEntityId?: stringspACSUrl?: stringspCertificate?: stringattributeMapping?: {name?: stringemail?: stringusername?: stringgroup?: stringgivenName?: stringmiddleName?: stringfamilyName?: stringpicture?: stringcustomAttributes?: {[k: string]: string}verifiedEmail?: stringverifiedPhone?: string}groupsMapping?: {role?: RoleItemgroups?: string[]}[]redirectUrl?: stringspSignCertificate?: stringsubjectNameIdFormat?: stringdefaultSSORoles?: string[]fgaMappings?: {[k: string]: {relations?: ReBACGroupsMappingRelation[]}}providerID?: stringscimProviderID?: stringconfigFGATenantIDResourcePrefix?: stringconfigFGATenantIDResourceSuffix?: stringidpAdditionalCertificates?: string[]groupsPriority?: string[]/** * Epoch seconds of the last successful SSO test login on this configuration. */lastSuccessTestTime?: number/** * True when Descope sends the SAML AuthnRequest to this IdP unsigned. */disableSignRequest?: boolean}export interface RoleItem {id?: stringname?: string}export interface ReBACGroupsMappingRelation {/** * Resource identifier of the relation */resource?: string/** * The name of the relation definition */relationDefinition?: string/** * The namespace of the relation definition */namespace?: string}