Discover how an email signs in
Tells the login screen, from an email address alone, how that person can sign in: whether password login is enabled for their tenant and which SSO provider, if any, it offers. It is called before login, by an unauthenticated browser, so the login screen can skip a manual tenant field; it changes nothing.
It fails open: an email that resolves to no tenant answers 200 with passwordEnabled=true and no provider, the same answer a tenant with password login and no SSO provider gets. The resolved tenant is never returned; the email is what the browser carries forward to GET /v1/sso/start.
Errors use the envelope, plus fields on body validation errors. 400: Content-Type missing or not application/json (AUT-0009), email missing (AUT-0001) or not an email address (AUT-0009), an unexpected member (AUT-0003). When the authorization server cannot be reached, is too slow to answer, or is failing, the answer is 503 AUT-0033: nothing about the request was wrong, and it may be retried later.

