Get the SAML single sign-on configuration

GET 
/config/sso

Returns the SAML SSO settings.

If none exist yet, a default (disabled) document is created and returned. Required role: admin or superadmin. The response to the call that creates the default document includes type: "saml_config" and __v; later reads omit type.

Responses

200

The SSO configuration.

401

No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.

403

The token's role is not allowed for this operation, or the token's scopes exclude the route (Scope not allowed by token).