# Single Sign-On

Login users using an external SAML identity provider (IDP). B2B apps can use this to allow their business customers or partners to provide SSO login for their members (see [Organizations](/openapi/user/organizations.openapi.json)).


## Servers

Sandbox environment
```
https://api.sbx.transmitsecurity.io/cis
```

US production environment
```
https://api.transmitsecurity.io/cis
```

EU production environment
```
https://api.eu.transmitsecurity.io/cis
```

CA production environment
```
https://api.ca.transmitsecurity.io/cis
```

AU production environment
```
https://api.au.transmitsecurity.io/cis
```

JP production environment
```
https://api.gasne1-ts01.transmitsecurity.io/cis
```

## Security

### bearer

Type: http
Scheme: bearer
Bearer Format: JWT

### UserAccessToken

A token returned upon end-user authentication, which provides access to resources and data for the user and app for which it was generated

Type: http
Scheme: bearer
Bearer Format: JWT

### AdminAccessToken

[object Object]

Type: oauth2
Token URL: /oidc/token
Scopes:

### ClientAccessToken

[object Object]

Type: oauth2
Token URL: /oidc/token
Scopes:

### OrgAdminAccessToken

A token returned upon B2B authentication for a user that has the organizationAdmin or organizationCreator role.

Type: oauth2
Token URL: /oidc/token
Scopes:

## Download OpenAPI description

 - [Single Sign-On](https://developer.transmitsecurity.com/_bundle/openapi/user/sso.openapi.yaml)

 - [GET /v1/auth/sso/start](https://developer.transmitsecurity.com/openapi/user/sso.openapi/other/startssologin.md): Initiates an SSO login flow with an external identity provider (IDP). This results in a POST redirect to the IDP configured for the organization, which is determined based on the domain of the user's
 - [GET /v1/auth/sso/saml/start](https://developer.transmitsecurity.com/openapi/user/sso.openapi/other/startsamllogin.md): Initiates an SSO login flow with a SAML identity provider (IDP). This results in a POST redirect to the SAML IDP configured for the organization, which is determined based on the domain of the user's
 - [POST /v1/auth/sso/saml/complete](https://developer.transmitsecurity.com/openapi/user/sso.openapi/other/completesamllogin.md): Completes the SSO login using the SAML response received directly from the SAML IDP (via your ACS URL). If the user is authenticated and the SAML response is valid, Transmit will redirect to your redi