> ## Documentation Index
> Fetch the complete documentation index at: https://docs.linquid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML SSO

> Enterprise SAML connection management, enforcement, and SSO runtime endpoints

# SAML SSO

## Management endpoints

* `GET /api/saml/metadata/:workspaceId`
* `POST /api/saml/connections`
* `GET /api/saml/connections`
* `PATCH /api/saml/connections/:id`
* `DELETE /api/saml/connections/:id`
* `PATCH /api/saml/enforce`

## Runtime endpoints

* `GET /api/saml/authorize/:workspaceId`
* `POST /api/saml/callback`
* `GET /api/saml/check`
* `GET /api/saml/logout/:workspaceId`
* `POST /api/saml/logout/callback`
* `GET /api/saml/logout/callback`

## Access and requirements

* Management APIs are session-only and reject API-key auth.
* Management requires workspace admin role.
* Enterprise entitlement required for SAML usage.

## Connection configuration

Connections can be configured using:

* metadata URL
* raw metadata
* manual IdP settings

Validation covers required fields and certificate correctness before activation.

## Enforcement behavior

`PATCH /api/saml/enforce` updates workspace SSO policy.

When enforced, matching users must authenticate via SAML according to configured domain rules.

## Common errors

* `400`: invalid metadata/config payload
* `403`: missing admin role or entitlement
* `404`: connection/workspace not found