# API: Single sign-on

| Method | Path | What it does | Scope |
|---|---|---|---|
| POST | `/v1/scim/tokens` | A directory token for SCIM provisioning (shown once) (owner) (web app only) | `security:write` |
| DELETE | `/v1/scim/tokens/:id` | Revoke a directory token (owner) (web app only) | `security:write` |
| GET | `/v1/sso` | This organization's identity providers and email domains (owner) | `security:write` |
| POST | `/v1/sso/connections` | Connect an OpenID Connect identity provider (checked against its discovery document) (owner) (web app only) | `security:write` |
| DELETE | `/v1/sso/connections/:id` | Remove a provider (its domains stop sending people to it) (owner) (web app only) | `security:write` |
| PATCH | `/v1/sso/connections/:id` | Turn a provider on or off, or change its default role or secret (owner) (web app only) | `security:write` |
| POST | `/v1/sso/domains` | Add an email domain to verify (a DNS TXT record) and send its people to a provider (owner) (web app only) | `security:write` |
| DELETE | `/v1/sso/domains/:domain` | Remove a domain (owner) (web app only) | `security:write` |
| PATCH | `/v1/sso/domains/:domain` | Require single sign-on for this domain's people (owners keep their password, to get back in if the provider fails) (owner) (web app only) | `security:write` |
| POST | `/v1/sso/domains/:domain/verify` | Check the domain's DNS TXT record; once it's there, the domain is this organization's for sign-in (owner) (web app only) | `security:write` |

## Examples

### GET /v1/sso

This organization's identity providers and email domains (owner)

```bash
curl -s "https://api.closefinch.com/v1/sso" \
  -H "Authorization: Bearer $RA_API_KEY"
```

```js
const res = await fetch(`https://api.closefinch.com/v1/sso`, {
  method: "GET",
  headers: { authorization: `Bearer ${process.env.RA_API_KEY}` },
});
const data = await res.json();
```

Request and response schemas: [https://www.closefinch.com/openapi.json](https://www.closefinch.com/openapi.json). All resources: [API reference](https://www.closefinch.com/docs/api).