SSO-Anmeldung starten
Answers with the authorize URL as JSON instead of a 302: the desktop and mobile clients have to hand the URL to a system browser, and the web client needs a full-page navigation it controls itself.
Bearer-Token, erhalten über den Login-Endpunkt (POST /rest/login).
Ort: header
Query-Parameter
Which identity provider to start the login with. Required: with more than one provider configurable per workspace there is no sensible default, and guessing one would silently send a person to the wrong directory.
Erlaubte Werte
- "microsoft"
- "google"
Erlaubte Werte
- "web"
- "desktop"
- "mobile"
Client-held PKCE pair (RFC 7636 length bounds). It protects the
exchange code on the deep-link legs, so it is mandatory and only
S256 is accepted — plain would defeat the purpose.
^[A-Za-z0-9\-._~]+$43 <= length <= 128Erlaubte Werte
- "S256"
Open-redirect defence: a relative path and nothing else. host
is a protocol-relative absolute URL and must not pass.
#^/(?!/)[^\s\\]*$#length <= 255Response-Body
application/json
application/json
curl -X GET "https://example.com/sso/redirect?provider=microsoft&client=web&code_challenge=stringstringstringstringstringstringstrings&code_challenge_method=S256"{ "url": "string", "expires_in": 0}