SSO Domain Discovery

​

Identifier-first login step — determines whether an email's domain is federated to an SSO provider.

  • Returns federated: true with a server-derived redirectUrl when the domain has an active, enabled, domain-verified SSO provider.
  • Returns federated: false when there is no such provider, or when the provider's domain has not been verified or is disabled.

Security notes:

  • This endpoint answers "is the DOMAIN federated?", not "does the USER exist?". Two different emails on the same domain return identical responses.
  • redirectUrl is server-derived from the provider record and server config. It is never built from request input (no open redirect risk).
  • Rate-limited by IP to prevent domain enumeration.

Body

required
application/json
  • email
    Type: stringFormat: email
    required

    The email address to check — only the domain part is used

Responses

  • application/json
  • application/json
  • 429

    Rate limit exceeded

  • application/json
Request Example for post/auth/sso/lookup
curl https://api.gpcn.com/v1/auth/sso/lookup \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": ""
}'

{
  "success": true,
  "data": {
    "federated": true,
    "redirectUrl": "https://auth.example.com/v1/auth/sign-in/sso?providerId=my-provider"
  }
}

Lookup result

Previous
Get 2FA Status
Next
Authentication - API Keys