1. Docs
  2. API Reference
  3. SsoTestSignInResponseDto

SsoTestSignInResponseDto

Example

JSON
{
  "id": "string",
  "connection_id": "string",
  "environment_id": "string",
  "type": "saml",
  "status": "pending",
  "start_url": "string",
  "started_at": "2026-04-20T12:00:00.000Z",
  "expires_at": "2026-04-20T12:00:00.000Z",
  "outcome": "success",
  "reason": "string",
  "email": "string",
  "first_name": "string",
  "last_name": "string",
  "federated_subject_id": "string",
  "amr": [
    "string"
  ],
  "domain_outcome": "accepted",
  "missing_fields": [
    "string"
  ],
  "received_attributes": [
    "string"
  ],
  "name_id_format": "string",
  "hint": "set_name_id_email",
  "completed_at": "2026-04-20T12:00:00.000Z"
}

Properties

21 properties 21 required

id string Required
connection_id string Required
environment_id string Required
type enum Required
Enumsamloidc
status enum Required
Enumpendingcompleted
start_url string Required

Open in a browser to run the round-trip. Valid until `expires_at`, and only while the test is pending.

started_at string Required
format: date-time
expires_at string Required
format: date-time
outcome enum Required
Enumsuccessfailednullable
reason string Required

Why the test failed, in the sign-in error vocabulary. The provider refused the sign-in (`provider_rejected`); the response did not verify against the connection's certificate (`signature_invalid`), fell outside its validity window (`assertion_expired`), named a different audience (`audience_mismatch`) or a different issuer (`issuer_mismatch`), or could not be verified for another reason (`assertion_invalid`); it had already been used (`assertion_replayed`); a required attribute was absent (`attribute_missing`); the email's domain is not verified for the organization (`email_domain_not_allowed`); or the round trip failed some other way (`sso_error`).

nullable
email string Required
nullable
first_name string Required
nullable
last_name string Required
nullable
federated_subject_id string Required
nullable
amr array of string Required

The authentication methods the identity provider asserted.

domain_outcome enum Required

How the asserted email's domain fared against the bound organization's verified claims. `no_boundary` when the connection is bound to no organization in an Environment without organizations; `unbound` when it is bound to none in an Environment that has them, which refuses the sign-in.

Enumacceptedno_boundaryunboundnot_listednot_verifiedunknownnullable
missing_fields array of string Required

The required fields the provider's response did not satisfy (`email`, `federated_subject_id`); empty on a pass.

received_attributes array of string Required

The attribute names the response carried, sorted. Names only, never values.

name_id_format string Required

The SAML Name ID format's last segment (`unspecified`, `emailAddress`, `persistent`); null for OIDC or when none came.

nullable
hint enum Required

The one thing to change, when the test can name it: the provider's Name ID format should be the email address (`set_name_id_email`), an email attribute or scope has to be added (`add_email_attribute`), or a stable subject has to be sent (`send_name_id`). Null when the report of names is the guidance.

Enumset_name_id_emailadd_email_attributesend_name_idnullable
completed_at string Required
format: date-timenullable
Was this page helpful?

Tell us how we can improve this guide.

Canopy