API Reference
OIDC
Platform

Hosted

AdminUpdated Sep 11, 2026

Hosted

Public — no authentication required.

11 routes. Each row is one endpoint with its explanation and whether it honours the Idempotency-Key header.

Method & path

Idem

Explanation

GET /hosted/sign-in

Hosted sign-in page with instance branding. Zero-integration path.

GET /hosted/sign-up

Hosted sign-up page with instance branding.

GET /hosted/user

Hosted account management page with instance branding.

GET /hosted/app.js

Client script for the hosted pages; drives the sign-in flow.

GET /hosted/sso-setup

Account-less hosted SSO self-service setup page, authenticated only by a scoped one-time ticket token.

GET /hosted/sso-setup.js

Client script for the hosted SSO self-service setup page.

POST /hosted/sso-setup/save

Create or edit ONLY the ticket-bound connection for ONLY the ticket-bound organization. Client-supplied org/connection ids are ignored; secrets are write-only.

POST /hosted/sso-setup/complete

Mark a self-service onboarding ticket completed so it can no longer be used.

POST /hosted/sso-setup/scim-token

Mint a SCIM directory-sync bearer token scoped to the ticket-bound organization (only when the profile allows SCIM). Shown once; never read back.

POST /hosted/sso-setup/domains

Claim an email domain for the ticket-bound organization; returns the DNS TXT record to publish.

POST /hosted/sso-setup/domains/verify

Run the DNS-TXT verification for one of the ticket-bound organization’s claimed domains.

Was this page helpful?