> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Preflight an SSO provider configuration

> Validates a CANDIDATE OAuth SSO provider configuration and writes nothing — no provider, no application-provider link, no application update. Returns whether the configuration is well-formed, whether the OIDC endpoints could be resolved, whether the identity provider accepted the client credentials, and whether the identity provider authorizes this deployment's SSO callback as a redirect URI, plus the endpoints the checks used. Returns 200 even when a check does not pass; a 4xx means the request itself could not be evaluated. The tenant is resolved from the authenticated identity, never from the payload, and the client secret is never echoed back.



## OpenAPI

````yaml /en/openapi/v3-current/AM-identity.yaml post /v1/sso/provider/preflight
openapi: 3.0.1
info:
  contact: {}
  description: This is a swagger documentation for the Identity API
  termsOfService: http://swagger.io/terms/
  title: Identity API
  version: 1.0.0
servers:
  - url: //localhost:4001/
security: []
paths:
  /v1/sso/provider/preflight:
    post:
      tags:
        - SSO
      summary: Preflight an SSO provider configuration
      description: >-
        Validates a CANDIDATE OAuth SSO provider configuration and writes
        nothing — no provider, no application-provider link, no application
        update. Returns whether the configuration is well-formed, whether the
        OIDC endpoints could be resolved, whether the identity provider accepted
        the client credentials, and whether the identity provider authorizes
        this deployment's SSO callback as a redirect URI, plus the endpoints the
        checks used. Returns 200 even when a check does not pass; a 4xx means
        the request itself could not be evaluated. The tenant is resolved from
        the authenticated identity, never from the payload, and the client
        secret is never echoed back.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SSOProviderConfigInput'
        description: Candidate SSO Provider Configuration
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SSOProviderPreflight'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/pkg.HTTPError'
          description: Bad Request
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/pkg.HTTPError'
          description: Unauthorized
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/pkg.HTTPError'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/pkg.HTTPError'
          description: Not Found
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/pkg.HTTPError'
          description: Internal Server Error
      security:
        - BearerAuth: []
components:
  schemas:
    SSOProviderConfigInput:
      description: SSOProviderConfigInput payload
      example:
        clientId: clientId
        disablePasswordLogin: true
        issuerUrl: issuerUrl
        customTokenUrl: customTokenUrl
        domain: https://your-org.okta.com
        name: name
        clientSecret: clientSecret
        customUserInfoUrl: customUserInfoUrl
        scopes: scopes
        type: Google
        customAuthUrl: customAuthUrl
      properties:
        clientId:
          type: string
        clientSecret:
          description: >-
            #nosec G117 -- write-only credential, never echoed back in any
            response
          type: string
        customAuthUrl:
          type: string
        customTokenUrl:
          type: string
        customUserInfoUrl:
          type: string
        disablePasswordLogin:
          example: true
          type: boolean
        domain:
          description: >-
            Domain is REQUIRED for Type=Okta and ignored otherwise: Casdoor
            derives an

            Okta provider's authorize, token and userinfo endpoints from it, and
            no

            constant can stand in because they are per-org. Either the org URL

            (https://<org>.okta.com) or an authorization server base

            (https://<org>.okta.com/oauth2/default) is accepted; the org URL is

            completed to its authorization server on write.
          example: https://your-org.okta.com
          type: string
        issuerUrl:
          type: string
        name:
          type: string
        scopes:
          type: string
        type:
          enum:
            - Google
            - AzureAD
            - Okta
            - Custom
          example: Google
          type: string
      required:
        - clientId
        - clientSecret
        - type
      type: object
    SSOProviderPreflight:
      description: SSOProviderPreflight payload
      example:
        tokenEndpoint: https://oauth2.googleapis.com/token
        redirectUriAcceptedByIdp: true
        discoveryOk: true
        userinfoEndpoint: https://openidconnect.googleapis.com/v1/userinfo
        configValid: true
        credentialsValid: true
        authorizationEndpoint: https://accounts.google.com/o/oauth2/v2/auth
      properties:
        authorizationEndpoint:
          example: https://accounts.google.com/o/oauth2/v2/auth
          type: string
        configValid:
          type: boolean
        credentialsValid:
          type: boolean
        discoveryOk:
          type: boolean
        redirectUriAcceptedByIdp:
          description: >-
            RedirectUriAcceptedByIdp reports whether the identity provider
            redirected

            the probe back to this deployment's SSO callback. RFC 6749 §3.1.2.4
            forbids

            an authorization server from redirecting to an unregistered
            redirect_uri,

            so a redirect that arrives proves the callback is authorized. False
            means

            "not proven": an unreachable authorization endpoint, a reply
            carrying no

            Location and any other inconclusive answer all read false, so read
            it as

            not confirmed rather than as proof the callback is absent from the

            provider's authorized-redirect list.
          type: boolean
        tokenEndpoint:
          example: https://oauth2.googleapis.com/token
          type: string
        userinfoEndpoint:
          example: https://openidconnect.googleapis.com/v1/userinfo
          type: string
      type: object
    pkg.HTTPError:
      properties:
        code:
          type: string
        entityType:
          type: string
        err:
          type: object
        message:
          type: string
        title:
          type: string
      type: object
  securitySchemes:
    BearerAuth:
      description: 'Bearer authentication. Send Authorization: Bearer <token>.'
      in: header
      name: Authorization
      type: apiKey

````