# Get SSO provider

Retrieve a single SSO provider by ID.

Source: https://statusdashboard.com/docs/api/security/sso/get

`GET /app/sso/providers/{providerId}`

Returns the full configuration for a single SSO provider. Requires the **SSO** feature entitlement.

The client secret is never returned.

***

## Path parameters
| Parameter    | Description                   |
| ------------ | ----------------------------- |
| `providerId` | The UUID of the SSO provider. |

***

## Request
See [API Basics](/docs/api) for required headers.

This endpoint takes no request body.

***

## Sample request
```bash
curl https://api.statusdashboard.com/app/sso/providers/a1b2c3d4-e5f6-7890-abcd-ef1234567890 \
  -H "Authorization: Bearer bcf847abf5c6:def456"
```

## Sample response — SAML
**Status: `200 OK`**

```json
{
  "providerId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "name": "Acme SAML",
  "providerType": "SAML",
  "cognitoProviderName": "PLATFORM-a1b2c3d4-ef123456",
  "enabled": true,
  "domains": ["acme.com", "acme.org"],
  "samlMetadataXml": "<?xml version=\"1.0\"?>...",
  "idpLogoutUrl": "https://idp.acme.com/saml/logout",
  "createdAt": "2026-01-10T12:00:00.000Z",
  "updatedAt": "2026-04-01T08:00:00.000Z",
  "limits": {
    "domainsPerSSOProvider": 5
  }
}
```

`limits.domainsPerSSOProvider` is the maximum number of email domains this provider may store. Contact support to request an increase.

## Sample response — OIDC
```json
{
  "providerId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "name": "Acme OIDC",
  "providerType": "OIDC",
  "cognitoProviderName": "PLATFORM-b2c3d4e5-f12345678",
  "enabled": true,
  "domains": ["internal.acme.com"],
  "oidcIssuer": "https://dev-12345678.okta.com",
  "oidcClientId": "0oabc123def456ghi789",
  "oidcAuthorizationEndpoint": "https://dev-12345678.okta.com/oauth2/v1/authorize",
  "oidcTokenEndpoint": "https://dev-12345678.okta.com/oauth2/v1/token",
  "oidcUserInfoEndpoint": "https://dev-12345678.okta.com/oauth2/v1/userinfo",
  "oidcJwksUri": "https://dev-12345678.okta.com/oauth2/v1/keys",
  "idpLogoutUrl": "https://dev-12345678.okta.com/oauth2/v1/logout",
  "createdAt": "2026-02-15T09:30:00.000Z",
  "updatedAt": "2026-03-20T14:00:00.000Z",
  "limits": {
    "domainsPerSSOProvider": 5
  }
}
```

***

## Response fields
| Field                          | Type                 | Description                                                                                |
| ------------------------------ | -------------------- | ------------------------------------------------------------------------------------------ |
| `providerId`                   | string               | Unique identifier for the provider.                                                        |
| `name`                         | string               | Display name for the provider.                                                             |
| `providerType`                 | `"SAML"` \| `"OIDC"` | The configured provider protocol.                                                          |
| `cognitoProviderName`          | string               | Internal Cognito identity provider name.                                                   |
| `enabled`                      | boolean              | Whether this provider is active for SSO login.                                             |
| `domains`                      | string\[]            | Email domains that route users to this provider.                                           |
| `samlMetadataXml`              | string \| undefined  | The IdP federation metadata XML (SAML only).                                               |
| `oidcIssuer`                   | string \| undefined  | Issuer URL (OIDC only).                                                                    |
| `oidcClientId`                 | string \| undefined  | Client ID (OIDC only).                                                                     |
| `oidcAuthorizationEndpoint`    | string \| undefined  | Authorization endpoint URL (OIDC only).                                                    |
| `oidcTokenEndpoint`            | string \| undefined  | Token endpoint URL (OIDC only).                                                            |
| `oidcUserInfoEndpoint`         | string \| undefined  | UserInfo endpoint URL (OIDC only).                                                         |
| `oidcJwksUri`                  | string \| undefined  | JWKS URI (OIDC only).                                                                      |
| `idpLogoutUrl`                 | string \| undefined  | The IdP's single logout URL, auto-extracted from metadata on save. Present when available. |
| `createdAt`                    | string               | ISO 8601 timestamp.                                                                        |
| `updatedAt`                    | string               | ISO 8601 timestamp.                                                                        |
| `limits.domainsPerSSOProvider` | number               | Max email domains per SSO provider for your organization.                                  |

***

## Error responses
| Status | When                                                                    |
| ------ | ----------------------------------------------------------------------- |
| `403`  | SSO feature not enabled on the plan.                                    |
| `404`  | SSO provider not found or does not belong to the caller's organization. |