# Get SSO configuration for specific application in the organization

Get SSO configuration for specific application in the organization. **Required permissions**: `organizations:read`, `orgs:read`.

Endpoint: GET /v1/organizations/{organization_id}/applications/{app_id}/sso
Security: AdminAccessToken

## Security:

  - `AdminAccessToken` (unknown)
    oauth2

## Path parameters:

  - `organization_id` (string, required)
    ID of the organization

  - `app_id` (string, required)
    ID of the application

## Response 200 fields (application/json):

  - `result` (object, required)

  - `result.app_id` (string, required)
    ID of the application

  - `result.name` (string, required)
    Name of the SSO configuration

  - `result.enabled` (boolean, required)
    Indicates whether the SSO configuration is enabled

  - `result.sso_provider` (string)
    SSO provider type
    Enum: "SAML", "OIDC"

  - `result.configuration` (any, required)
    Configuration of the SSO provider

  - `result.configuration.service_provider` (object, required)

  - `result.configuration.service_provider.acs_url` (string, required)
    Assertion consumer service URL of the application, which receives the SAML response.

  - `result.configuration.service_provider.entity_id` (string, required)
    Entity ID that identifies the SAML service provider

  - `result.configuration.service_provider.default_redirect_uri` (string)
    Default redirect URI for the application

  - `result.configuration.identity_provider` (object, required)

  - `result.configuration.identity_provider.entity_id` (string, required)
    Entity ID of the identity provider

  - `result.configuration.identity_provider.sso_url` (string, required)
    Single sign-on URL of the SAML identity provider, which will receive the authentication request

  - `result.configuration.identity_provider.signing_certificates` (array, required)
    Certificates used to validate the signature of the SAML response. Provided by the SAML identity provider.

  - `result.configuration.identity_provider.sign_saml_requests` (boolean)
    Signing SAML Requests

  - `result.configuration.identity_provider.nameid_type` (string)
    Type of identifier in the SAML nameId (email, phone_number, username, etc.)

  - `result.configuration.client_id` (string, required)
    The client ID of the OIDC provider

  - `result.configuration.client_secret` (string, required)
    The client secret of the OIDC provider

  - `result.configuration.issuer_url` (string, required)
    The issuer URL of the OIDC provider

  - `result.configuration.email_attr` (string)
    The email attribute on the decoded token to be used as the user email

  - `result.configuration.redirect_uri` (string)
    Redirect URI for backend-driven flows

  - `result.configuration.identifier_type` (string)
    The identifier type used to look up the user during authentication (e.g. email, phone_number, username)

  - `result.group_role_mapping` (object)
    Group-to-role mapping configuration

  - `result.group_role_mapping.enabled` (boolean, required)
    Whether group-to-role mapping is enabled for this SSO configuration

  - `result.group_role_mapping.group_claim_name` (string)
    Attribute/claim in the SSO response that carries the group names

  - `result.group_role_mapping.mappings` (array, required)
    Mappings of federated IdP group name to Mosaic role IDs

  - `result.group_role_mapping.mappings.idp_group_name` (string, required)
    Federated IdP group name as it appears in the SSO response

  - `result.group_role_mapping.mappings.role_ids` (array, required)
    Mosaic role IDs to assign for this group (1 group to N roles)

  - `result.group_role_mapping.default_role_ids` (array, required)
    Fallback Mosaic role IDs used when no mapping resolves