API Reference
Getting Started
Core Concepts
Backend API — Guides
Frontend API — Guides
OAuth & OpenID Connect — Guides
Enterprise: SSO & SCIM — Guides
Webhooks — Guides
SDKs
Backend API (BAPI)
Frontend API (FAPI)
Dashboard API
Public API
SCIM
OIDC
Platform

Sso Connections

AdminUpdated Sep 11, 2026

Sso Connections

Dashboard API — authenticated by an Atlas console (platform-instance) session, not a key.

12 routes. Each row is one endpoint with its explanation and whether it honours the Idempotency-Key header.

Method & path

Idem

Explanation

GET /v1/dashboard/accounts/:accountId/instances/:instanceId/sso_connections

List enterprise SSO connections. The OIDC client secret is never returned.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/sso_connections

Create an enterprise SSO connection. The client secret is write-only.

GET /v1/dashboard/accounts/:accountId/instances/:instanceId/sso_connections/:connectionId

Read one SSO connection. Reports has_secret only, never the secret.

PATCH /v1/dashboard/accounts/:accountId/instances/:instanceId/sso_connections/:connectionId

Update an SSO connection. Omitting the secret leaves the stored one untouched.

DELETE /v1/dashboard/accounts/:accountId/instances/:instanceId/sso_connections/:connectionId

Delete an SSO connection and its domain routing.

GET /v1/dashboard/accounts/:accountId/instances/:instanceId/sso_connections/atlas

Whether "Sign in with Atlas" is enabled on this instance, and whether the deployment offers it.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/sso_connections/atlas

Enable "Sign in with Atlas" — provisions an Atlas-ID OP client + preset OIDC connection. Owner/admin. Idempotent.

DELETE /v1/dashboard/accounts/:accountId/instances/:instanceId/sso_connections/atlas

Disable "Sign in with Atlas" — removes the preset connection. Owner/admin.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/sso_connections/:connectionId/test

Validate discovery: issuer reachable and issuer-match (RFC 8414). Not the client.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/sso_connections/:connectionId/test_login

Begin an interactive OIDC test login (opened in a popup); the callback shows the returned claims and provisions nothing.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/sso_connections/:connectionId/import_saml_metadata

Parse an IdP SAML EntityDescriptor and populate the entity id, SSO URL and signing certificate.

GET /v1/dashboard/accounts/:accountId/instances/:instanceId/sso_connections/:connectionId/saml_metadata

SP metadata XML for a SAML connection, plus the ACS URL and SP entity id the operator registers with their IdP.

Was this page helpful?