# Get clients group by ID

Retrieves a clients group by its ID. The clients group ID is a unique identifier for a clients group. <br><br>**Required permissions**: `sso-service:read`.

Endpoint: GET /v1/sso-service/sso-group/{groupId}
Security: ClientAccessToken

## Path parameters:

  - `groupId` (string, required)
    ID of the group to retrieve

## Response 200 fields (application/json):

  - `result` (object, required)

  - `result.id` (string, required)
    ID of the SSO group

  - `result.name` (string, required)
    Name of the SSO group

  - `result.description` (string)
    Short description of the SSO group

  - `result.configuration` (object, required)
    Configuration for the SSO group

  - `result.configuration.journey` (string, required)
    Name of the journey to run within the SSO group.

  - `result.configuration.sessionTimeout` (number, required)
    The time in seconds/minutes/hours/days/weeks after which the session will expire. Default in seconds.

  - `result.configuration.allowSilentLogin` (boolean, required)
    Whether silent login is allowed.

  - `result.configuration.sessionTimeoutGranularity` (string, required)
    Session timeout granularity
    Enum: "seconds", "minutes", "hours", "days", "weeks"

  - `result.clients` (array, required)
    List of clients in the SSO group

  - `result.clients.client_id` (string, required)
    Client ID used for API requests

  - `result.clients.client_secret` (string, required)
    Client secret used to obtain tokens for API authorization

  - `result.clients.client_type` (string)
    Client type
    Enum: "web", "native"

  - `result.clients.name` (string, required)
    Client name displayed in the Admin Portal

  - `result.clients.pkce` (string)
    PKCE configuration for client
    Enum: "enforcePkceInsteadOfClientCredentials", "enforcePkceAlongsideClientCredentials", "allowPkceAlongsideClientCredentials"

  - `result.clients.description` (string)
    Short description of your client, displayed in the Admin Portal

  - `result.clients.resources` (array, required)
    List of resources this client is allowed to explicitly request access to

  - `result.clients.created_at` (string, required)
    Date the client was created

  - `result.clients.updated_at` (string, required)
    Date the client was last updated

  - `result.clients.redirect_uris` (array)
    List of URIs approved for redirects for your client

  - `result.clients.authentication_protocol` (string)
    Authentication protocol used by the client
    Enum: "oidc", "saml"

  - `result.clients.is_third_party` (boolean)
    Whether the client is a third-party client

  - `result.clients.optional_acs_url` (boolean)
    ACS URL for the SAML client

  - `result.clients.sp_acs_url` (string)
    ACS URL for the SAML client

  - `result.clients.sp_entity_id` (string)
    Entity ID for the SAML client

  - `result.clients.metadata_url` (string)
    SAML IDP metadata URL

  - `result.clients.sso_url` (string)
    SAML SSO URL

  - `result.clients.entity_id` (string)
    SAML Entity ID

  - `result.clients.x509_certificate` (string)
    X.509 certificate

  - `result.clients.default_custom_claims` (array)
    List of all the custom claims the client wants to receive by default

## Response 404 fields (application/json):

  - `message` (string, required)

  - `error_code` (number, required)
    Example: 404