# SSO-Anmeldung starten

`GET https://{tenant}.stamp.eu/rest/sso/redirect`

Answers with the authorize URL as JSON instead of a 302: the desktop
and mobile clients have to hand the URL to a system browser, and the
web client needs a full-page navigation it controls itself.

## Query-Parameter

| Name | Typ | Pflicht | Beschreibung |
| --- | --- | --- | --- |
| `provider` | `microsoft`, `google` | ja | Which identity provider to start the login with. Required: with more than one provider configurable per workspace there is no sensible default, and guessing one would silently send a person to the wrong directory. |
| `client` | `web`, `desktop`, `mobile` | ja |  |
| `code_challenge` | string | ja | Client-held PKCE pair (RFC 7636 length bounds). It protects the exchange code on the deep-link legs, so it is mandatory and only S256 is accepted — `plain` would defeat the purpose. |
| `code_challenge_method` | `S256` | ja |  |
| `return` | string \| null | nein | Open-redirect defence: a relative path and nothing else. `host` is a protocol-relative absolute URL and must not pass. |

## Antworten

### 200

| Feld | Typ | Pflicht |
| --- | --- | --- |
| `url` | string | ja |
| `expires_in` | integer | ja |

### 422: Validation error

| Feld | Typ | Pflicht | Beschreibung |
| --- | --- | --- | --- |
| `message` | string | ja | Errors overview. |
| `errors` | object | ja | A detailed description of each field that failed validation. |