prompt?array<string>
string
test?boolean
SSO setup-suite test mode: authenticate against the IdP without persisting a user and skip the
JIT-disabled and SSO-application association checks; the exchange returns the IdP response and no session.
Internal console/management option - rejected for other callers, should not be documented in open api file or exposed in SDKs.
unsavedSaml.enabled?boolean
unsavedSaml.redirectURL?string
unsavedSaml.idpURL?string
unsavedSaml.idpMetadataURL?string
unsavedSaml.idpCert?string
unsavedSaml.entityID?string
unsavedSaml.spCert?string
unsavedSaml.signRequest?boolean
unsavedSaml.samlMappings.name?string
unsavedSaml.samlMappings.email?string
unsavedSaml.samlMappings.username?string
unsavedSaml.samlMappings.phoneNumber?string
unsavedSaml.samlMappings.group?string
unsavedSaml.samlMappings.givenName?string
unsavedSaml.samlMappings.middleName?string
unsavedSaml.samlMappings.familyName?string
unsavedSaml.samlMappings.picture?string
unsavedSaml.samlMappings.verifiedEmail?string
unsavedSaml.samlMappings.verifiedPhone?string
unsavedSaml.useMetaInfoToggle?boolean
unsavedSaml.allowSamlAuthOnly?boolean
unsavedSaml.version?string
unsavedSaml.descopeEntityId?string
unsavedSaml.tenantID?string
unsavedSaml.acsUrl?string
unsavedSaml.mergeUsers?boolean
unsavedSaml.signRequestKey?string
skip 19, was used and removed
unsavedSaml.spEncryptionKey?string
unsavedSaml.signRequestCert?string
unsavedSaml.subjectNameIdFormat?string
unsavedSaml.additional?boolean
unsavedSaml.providerID?string
unsavedSaml.configProviderId?string
The following are purely on project level, and meant for generiting link
unsavedSaml.configTemplateId?string
unsavedSaml.configExpirationTime?integer
unsavedSaml.configExpirationTimeUnit?string
unsavedSaml.scimProviderID?string
unsavedSaml.lastSuccessTestTime?integer
unsavedSaml.mandatoryUserAttributes?array<string>
string
unsavedSaml.defaultSSORoles?array<string>
string
unsavedSaml.configFGAMappableFeatures.types?array<string>
string
unsavedSaml.configAssumedRoles?array<string>
string
unsavedSaml.configAssumedPermissions?array<string>
string
unsavedSaml.s4StyleId?string
unsavedSaml.s4Features.scimDisabled?boolean
unsavedSaml.s4Features.ssoDomainsDisabled?boolean
unsavedSaml.s4Features.groupMappingDisabled?boolean
unsavedSaml.s4Features.samlDisabled?boolean
unsavedSaml.s4Features.oidcDisabled?boolean
unsavedSaml.s4Features.jitGuideDisabled?boolean
unsavedSaml.s4Features.roleMappingDisabled?boolean
unsavedSaml.s4Features.fgaMappingDisabled?boolean
unsavedSaml.s4Features.ssoDisabled?boolean
unsavedSaml.s4Features.xaaEnabled?boolean
SHOWS the Cross-App Access (XAA / ID-JAG) part of the suite. Positive on purpose, unlike
every other field here: XAA is off unless a project opts in, and a proto3 bool cannot tell
an explicit false from an absent field, so "disabled by default" is not expressible with a
*Disabled field.
unsavedSaml.lockedTenantId?string
unsavedSaml.s4DisableUserMappingCreate?boolean
unsavedSaml.useTenantLevelS4Configs?boolean
unsavedSaml.forceDomainVerification?boolean
unsavedSaml.configFGATenantIDResourcePrefix?string
unsavedSaml.configFGATenantIDResourceSuffix?string
unsavedSaml.allowDuplicateSSODomainsInOtherTenants?boolean
unsavedSaml.idpCerts?array<string>
string
unsavedSaml.allowOverrideRoles?boolean
unsavedSaml.groupPriorityEnabled?boolean
unsavedSaml.blockIfEmailDomainMismatch?boolean
unsavedSaml.markEmailAsUnverified?boolean
unsavedSaml.s4ShowHelpContact?boolean
unsavedSaml.s4SupportEmail?string
unsavedSaml.allowMergeUsersWithMultipleTenants?boolean
unsavedSaml.oidcLoginIdMappingDefaultOverride?string
unsavedSaml.disableSignRequest?boolean
When true, the AuthnRequest Descope sends to this IdP is left unsigned. Some IdPs (NetIQ Access
Manager for one) reject a signed request when their trusted-provider entry holds no signing
certificate for us, so signing has to be opt-out per SSO configuration. Default false keeps
requests signed, which is the behavior every existing configuration has today.
This is deliberately a separate field from the legacy signRequest (8): that one is never read by
the request-building path and is written as true unconditionally, so repurposing it would change
behavior for every configuration that never set it.
unsavedOauth.enabled?boolean
unsavedOauth.redirectURL?string
unsavedOauth.version?string
unsavedOauth.ssoMergeUsers?boolean
unsavedOauth.additional?boolean
unsavedOauth.mandatoryUserAttributes?array<string>
string
unsavedOauth.lockedTenantId?string
unsavedOauth.allowOverrideRoles?boolean
unsavedOauth.groupPriorityEnabled?boolean
unsavedOauth.blockIfEmailDomainMismatch?boolean
unsavedOauth.markEmailAsUnverified?boolean
unsavedOauth.allowMergeUsersWithMultipleTenants?boolean
doNotCreateUser?boolean
Authenticate against the IdP without creating, updating, or signing in a Descope user.
The exchange returns the IdP attributes/claims but no session JWTs.
Internal flow-action option — should not be documented in open api file or exposed in SDKs.
unsavedSSODomains?array<string>
stringDraft SSO domains for test flows: the setup suite verifies domains before they are
persisted on the tenant, so the email-domain-mismatch check would otherwise run
against an empty persisted list and always fail. Allowed only when test is true.