Single sign on
/auth/v1/sso/discoverMojo Up AI Cloud only. Asks whether the email address's domain belongs to a team that uses its own identity provider (single sign-on). The sign-in page calls it before showing the other buttons.
Query Parameters
emailResponse Body
application/json
curl -X GET "https://example.com/auth/v1/sso/discover?email=user%40example.com"{ "sso": true, "label": "string", "enforced": true}/auth/v1/sso/startMojo Up AI Cloud only. Sends the browser to the provider of the team that owns the address's domain: an OpenID Connect provider with login_hint, PKCE and a nonce, or a SAML 2.0 provider with an AuthnRequest. The person returns to redirect_uri with a one-time code and your state, exactly as with the other providers; exchange it at /auth/v1/token.
Query Parameters
emailValue in
- "console"
- "mobile"
Where to return. Must be registered for the client.
The PKCE challenge: base64url SHA-256 of your verifier.
Returned to you unchanged.
length <= 500Response Body
application/json
curl -X GET "https://example.com/auth/v1/sso/start?email=user%40example.com&client=console&redirect_uri=string&code_challenge=string"/auth/v1/callback/ssoMojo Up AI Cloud only. Where the team's provider sends the browser back. Cloud checks the ID token (signature, issuer, audience, nonce, and that the address is in a verified domain of the team), then returns the person to the client with a one-time code. Register https://<cloud api>/auth/v1/callback/sso with the provider; clients do not call it.
Response Body
curl -X GET "https://example.com/auth/v1/callback/sso"/auth/v1/sso/saml/metadataMojo Up AI Cloud only. The metadata an owner gives the team's SAML 2.0 identity provider (Entra ID, Okta and others): the entity ID for the team, the assertion consumer service (HTTP-POST), the name identifier formats read, and that assertions must be signed. Served as application/samlmetadata+xml. Anyone may fetch it; it holds nothing secret.
Query Parameters
The team's organisation id.
Response Body
application/samlmetadata+xml
application/json
curl -X GET "https://example.com/auth/v1/sso/saml/metadata?org=string""string"/auth/v1/sso/saml/acsMojo Up AI Cloud only. Where a team's SAML 2.0 identity provider posts the signed Response (HTTP-POST binding). Cloud checks the Response (strict XML, the destination, the request it answers, the signature against the team's certificate, the issuer, the times, and that the address is in a verified domain of the team), then returns the person to the client with a one-time code, exactly as with OpenID Connect. Register https://<cloud api>/auth/v1/sso/saml/acs with the provider; clients do not call it. A Response that answers no live sign-in (started by the provider, expired or already used) is refused with 400.
Request Body
application/x-www-form-urlencoded
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/auth/v1/sso/saml/acs" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d 'SAMLResponse=string&RelayState=string'