v1/auth/saml/authorizeAuthorization
Descope Project ID Project ID as bearer token.
In: header
Query Parameters
SSO setup-suite test mode: authenticate against the IdP without persisting a user and skip the JIT-disabled and SSO-application association checks; the exchange returns the IdP response and no session. Internal console/management option - rejected for other callers, should not be documented in open api file or exposed in SDKs.
skip 19, was used and removed
The following are purely on project level, and meant for generiting link
int32int32SHOWS the Cross-App Access (XAA / ID-JAG) part of the suite. Positive on purpose, unlike every other field here: XAA is off unless a project opts in, and a proto3 bool cannot tell an explicit false from an absent field, so "disabled by default" is not expressible with a *Disabled field.
When true, the AuthnRequest Descope sends to this IdP is left unsigned. Some IdPs (NetIQ Access Manager for one) reject a signed request when their trusted-provider entry holds no signing certificate for us, so signing has to be opt-out per SSO configuration. Default false keeps requests signed, which is the behavior every existing configuration has today. This is deliberately a separate field from the legacy signRequest (8): that one is never read by the request-building path and is written as true unconditionally, so repurposing it would change behavior for every configuration that never set it.
Verify identity only: a login through this SSO configuration must not create, update or sign in a user. Lives on the settings row rather than the tenant's SSO wrapper so it reaches the default configuration, which owns no wrapper entry, and so a sub-tenant inherits it with the rest of the parent's configuration.
Authenticate against the IdP without creating, updating, or signing in a Descope user. The exchange returns the IdP attributes/claims but no session JWTs. Internal flow-action option — should not be documented in open api file or exposed in SDKs.
Draft SSO domains for test flows: the setup suite verifies domains before they are persisted on the tenant, so the email-domain-mismatch check would otherwise run against an empty persisted list and always fail. Allowed only when test is true.
Request Body
application/json
falseCustom claims to include in the JWT as key-value pairs. Keys must be strings; values can be strings, numbers, or booleans.
{
"claim-name": "claim-value"
}falserelevant only for enchanted links in the point in time - other methods will ignore this field
bytesCreating SAML redirect URI
curl -X POST "https://api.descope.com/v1/auth/saml/authorize" \ -H "Content-Type: application/json" \ -d '{}'{ "url": "string", "errorId": "string"}export interface Response {url?: stringerrorId?: string}