> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Discover how an email signs in

> Tells the login screen, from an email address alone, how that person can sign in: whether password login is enabled for their tenant and which SSO provider, if any, it offers. It is called before login, by an unauthenticated browser, so the login screen can skip a manual tenant field; it changes nothing.

It fails open: an email that resolves to no tenant answers 200 with passwordEnabled=true and no provider, the same answer a tenant with password login and no SSO provider gets. The resolved tenant is never returned; the email is what the browser carries forward to GET /v1/sso/start.

Errors use the {code, title, message} envelope, plus fields on body validation errors. 400: Content-Type missing or not application/json (AUT-0009), email missing (AUT-0001) or not an email address (AUT-0009), an unexpected member (AUT-0003). When the authorization server cannot be reached, is too slow to answer, or is failing, the answer is 503 AUT-0033: nothing about the request was wrong, and it may be retried later.



## OpenAPI

````yaml /pt/openapi/v3-current/AM-auth.yaml post /v1/sso/discover
openapi: 3.1.0
info:
  contact:
    name: Lerian Studio
    url: https://lerian.studio
  description: OpenAPI 3.1 surface for the Access Manager auth component.
  license:
    name: Lerian Studio General License
  title: Plugin Access Manager — Auth API
  version: v1
servers:
  - url: https://auth.sandbox.lerian.net
security: []
tags:
  - description: >-
      OAuth2 token issuance: request an access token, refresh it, and log out.
      Public issuer endpoints.
    name: OAuth
  - description: >-
      Single sign-on through the tenant's identity provider: discover how an
      email signs in, then start the login. Public, called by the browser before
      login.
    name: SSO
  - description: >-
      Multi-factor authentication challenge and verification during the login
      flow. Public (identity is carried by the MFA token, not a Bearer token).
    name: MFA
  - description: >-
      Token-secured routes: enforce a permission, list the caller's permissions,
      and fetch OIDC user info. Require a Bearer token, validated in the use
      case.
    name: User Permission
paths:
  /v1/sso/discover:
    post:
      tags:
        - SSO
      summary: Discover how an email signs in
      description: >-
        Tells the login screen, from an email address alone, how that person can
        sign in: whether password login is enabled for their tenant and which
        SSO provider, if any, it offers. It is called before login, by an
        unauthenticated browser, so the login screen can skip a manual tenant
        field; it changes nothing.


        It fails open: an email that resolves to no tenant answers 200 with
        passwordEnabled=true and no provider, the same answer a tenant with
        password login and no SSO provider gets. The resolved tenant is never
        returned; the email is what the browser carries forward to GET
        /v1/sso/start.


        Errors use the {code, title, message} envelope, plus fields on body
        validation errors. 400: Content-Type missing or not application/json
        (AUT-0009), email missing (AUT-0001) or not an email address (AUT-0009),
        an unexpected member (AUT-0003). When the authorization server cannot be
        reached, is too slow to answer, or is failing, the answer is 503
        AUT-0033: nothing about the request was wrong, and it may be retried
        later.
      operationId: discoverSSO
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SSODiscoveryInput'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SSODiscoveryResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Bad Request
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Internal Server Error
        '503':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Service Unavailable
components:
  schemas:
    SSODiscoveryInput:
      additionalProperties: false
      properties:
        email:
          examples:
            - user@acme.com
          type: string
      required:
        - email
      type: object
    SSODiscoveryResponse:
      additionalProperties: false
      properties:
        passwordEnabled:
          type: boolean
        provider:
          $ref: '#/components/schemas/SSOProviderListItem'
      required:
        - passwordEnabled
      type: object
    HTTPError:
      additionalProperties: false
      properties:
        code:
          description: >-
            Stable, machine-readable error code (AUT-NNNN). Branch on this, not
            on the message.
          examples:
            - AUT-0009
          type: string
        fields:
          additionalProperties: {}
          description: >-
            Present on body validation errors: each offending member mapped to
            what is wrong with it (AUT-0001 missing, AUT-0009 invalid) or, for
            AUT-0003, to the unexpected value that was sent.
          type: object
        message:
          description: Human-readable explanation of this occurrence.
          type: string
        title:
          description: Short, human-readable summary of the error class.
          examples:
            - Bad Request
          type: string
      type: object
    SSOProviderListItem:
      additionalProperties: false
      properties:
        displayName:
          type: string
        id:
          type: string
        type:
          type: string
      required:
        - id
        - displayName
        - type
      type: object

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.