Identity Provider Operations#

The identity surface has three parts: a readiness view that tells you whether a tenant's SSO is fully configured, the SSO runtime endpoints that execute the OIDC/SAML flows, and SCIM v2 endpoints for provisioning users and groups from your IdP.

Inspect tenant identity readiness#

curl "https://api.intended.so/admin/identity?tenantId=tenant_acme_prod" \
  -H "Authorization: Bearer $INTENDED_API_KEY" \
  -H "x-tenant-id: tenant_acme_prod"

The identity object reports readiness, identityProviderType (oidc · saml · null), the issuer / metadata URL, domainHints, allowPasswordFallback, breakGlassEnabled / breakGlassContacts, and a metadata.runtime block listing exactly which configuration fields are still missing.

Readiness states#

Readiness is derived from the configuration, not stored independently:

For OIDC, ready requires issuer, client ID, client secret, and redirect URI. For SAML, it requires the SP entity ID, the ACS URL, the IdP signing certificate, and an IdP metadata URL or SSO URL.

SSO runtime endpoints#

The SSO flows are public (skip-auth) routes — they are how a user obtains a session — so they are not behind the admin permission check. The portal app uses the /amp/* prefix; the backoffice app uses /ebo/*.

Portal (OIDC + SAML):

• GET /amp/auth/sso/start
• GET /amp/auth/sso/callback
• POST /amp/auth/sso/saml/acs

Backoffice (OIDC):

• GET /ebo/auth/sso/start
• GET /ebo/auth/sso/callback

SCIM v2 provisioning#

SCIM lets your IdP provision and deprovision users and groups directly. Six endpoints are implemented (no DELETE — deactivation is via a SCIM PATCH setting active: false):

• GET /scim/v2/Users · POST /scim/v2/Users · PATCH /scim/v2/Users/:id
• GET /scim/v2/Groups · POST /scim/v2/Groups · PATCH /scim/v2/Groups/:id

SCIM authentication and scope#

SCIM does not use the enterprise admin permission model. Instead each call requires a verified tenant context (legacy_header credentials are rejected) plus a SCIM-capable scope or permission:

• An API key must carry one of the scopes admin:config:write, account:team:invite, or account:team:read.
• A portal session must hold the admin:config:write permission.

The x-tenant-id header, if present, must match the verified tenant context.

Create a user#

curl -X POST https://api.intended.so/scim/v2/Users \
  -H "Authorization: Bearer $INTENDED_API_KEY" \
  -H "x-tenant-id: tenant_acme_prod" \
  -H "Content-Type: application/scim+json" \
  -d '{
    "userName": "alice@acme.com",
    "externalId": "idp-user-123",
    "name": { "givenName": "Alice", "familyName": "Ng" },
    "emails": [{ "value": "alice@acme.com", "primary": true }],
    "active": true
  }'

SCIM role values from the IdP are mapped to portal roles (owner/admin → admin, reviewer/approver → approver, operator/developer → operator, auditor/read_only → viewer, otherwise viewer).

Failure modes#

Admin identity endpoint:

SCIM endpoints:

Next Steps#

• Roles and Token Governance
• Tenant Administration
• Audit Export