prompt?array<string>
string
unsavedSaml.enabled?boolean
unsavedSaml.redirectURL?string
unsavedSaml.idpURL?string
unsavedSaml.idpMetadataURL?string
unsavedSaml.idpCert?string
unsavedSaml.entityID?string
unsavedSaml.spCert?string
unsavedSaml.signRequest?boolean
unsavedSaml.samlMappings.name?string
unsavedSaml.samlMappings.email?string
unsavedSaml.samlMappings.username?string
unsavedSaml.samlMappings.phoneNumber?string
unsavedSaml.samlMappings.group?string
unsavedSaml.samlMappings.givenName?string
unsavedSaml.samlMappings.middleName?string
unsavedSaml.samlMappings.familyName?string
unsavedSaml.samlMappings.picture?string
unsavedSaml.samlMappings.verifiedEmail?string
unsavedSaml.samlMappings.verifiedPhone?string
unsavedSaml.useMetaInfoToggle?boolean
unsavedSaml.allowSamlAuthOnly?boolean
unsavedSaml.version?string
unsavedSaml.descopeEntityId?string
unsavedSaml.tenantID?string
unsavedSaml.acsUrl?string
unsavedSaml.mergeUsers?boolean
unsavedSaml.signRequestKey?string
skip 19, was used and removed
unsavedSaml.spEncryptionKey?string
unsavedSaml.signRequestCert?string
unsavedSaml.subjectNameIdFormat?string
unsavedSaml.additional?boolean
unsavedSaml.providerID?string
unsavedSaml.configProviderId?string
The following are purely on project level, and meant for generiting link
unsavedSaml.configTemplateId?string
unsavedSaml.configExpirationTime?integer
unsavedSaml.configExpirationTimeUnit?string
unsavedSaml.scimProviderID?string
unsavedSaml.lastSuccessTestTime?integer
unsavedSaml.mandatoryUserAttributes?array<string>
string
unsavedSaml.defaultSSORoles?array<string>
string
unsavedSaml.configFGAMappableFeatures.types?array<string>
string
unsavedSaml.configAssumedRoles?array<string>
string
unsavedSaml.configAssumedPermissions?array<string>
string
unsavedSaml.s4StyleId?string
unsavedSaml.s4Features.scimDisabled?boolean
unsavedSaml.s4Features.ssoDomainsDisabled?boolean
unsavedSaml.s4Features.groupMappingDisabled?boolean
unsavedSaml.s4Features.samlDisabled?boolean
unsavedSaml.s4Features.oidcDisabled?boolean
unsavedSaml.s4Features.jitGuideDisabled?boolean
unsavedSaml.s4Features.roleMappingDisabled?boolean
unsavedSaml.s4Features.fgaMappingDisabled?boolean
unsavedSaml.s4Features.ssoDisabled?boolean
unsavedSaml.s4Features.xaaEnabled?boolean
SHOWS the Cross-App Access (XAA / ID-JAG) part of the suite. Positive on purpose, unlike
every other field here: XAA is off unless a project opts in, and a proto3 bool cannot tell
an explicit false from an absent field, so "disabled by default" is not expressible with a
*Disabled field.
unsavedSaml.lockedTenantId?string
unsavedSaml.s4DisableUserMappingCreate?boolean
unsavedSaml.useTenantLevelS4Configs?boolean
unsavedSaml.forceDomainVerification?boolean
unsavedSaml.configFGATenantIDResourcePrefix?string
unsavedSaml.configFGATenantIDResourceSuffix?string
unsavedSaml.allowDuplicateSSODomainsInOtherTenants?boolean
unsavedSaml.idpCerts?array<string>
string
unsavedSaml.allowOverrideRoles?boolean
unsavedSaml.groupPriorityEnabled?boolean
unsavedSaml.blockIfEmailDomainMismatch?boolean
unsavedSaml.markEmailAsUnverified?boolean
unsavedSaml.s4ShowHelpContact?boolean
unsavedSaml.s4SupportEmail?string
unsavedSaml.allowMergeUsersWithMultipleTenants?boolean
unsavedOauth.enabled?boolean
unsavedOauth.redirectURL?string
unsavedOauth.version?string
unsavedOauth.ssoMergeUsers?boolean
unsavedOauth.additional?boolean
unsavedOauth.mandatoryUserAttributes?array<string>
string
unsavedOauth.lockedTenantId?string
unsavedOauth.allowOverrideRoles?boolean
unsavedOauth.groupPriorityEnabled?boolean
unsavedOauth.blockIfEmailDomainMismatch?boolean
unsavedOauth.markEmailAsUnverified?boolean
unsavedOauth.allowMergeUsersWithMultipleTenants?boolean
doNotCreateUser?boolean
Authenticate against the IdP without creating, updating, or signing in a Descope user.
The exchange returns the IdP attributes/claims but no session JWTs.
Internal flow-action option — should not be documented in open api file or exposed in SDKs.
unsavedSSODomains?array<string>
stringDraft SSO domains for test flows: the setup suite verifies domains before they are
persisted on the tenant, so the email-domain-mismatch check would otherwise run
against an empty persisted list and always fail. Allowed only when test is true.