Claims an email domain for the org and configures how its users sign in; the…

Claims an email domain for the org and configures how its users sign in; the answer is the new domain's id.

POST /v1/o11y/domains

O11y → · All API references → · Six flows, four surfaces →


Address	`https://api.hanzo.ai/v1/o11y/domains`
Method	`POST`
Operation	`CreateAuthDomain`
Auth	`Authorization: Bearer $HANZO_API_KEY`

Claims an email domain for the org and configures how its users sign in; the answer is the new domain's id. Admin gate.

Request

42 fields, body application/json (required).

Field	In	Type	Required	Description
`config`	body	o11y.O11yAuthDomainConfig	—
`config.googleAuthConfig`	body	o11y.O11yGoogleConfig	—
`config.googleAuthConfig.allowedGroups`	body	string[]	—	AllowedGroups, when set, admits only members of these groups.
`config.googleAuthConfig.clientId`	body	string	—	ClientID is the OAuth application's id.
`config.googleAuthConfig.clientSecret`	body	string	—	ClientSecret is the OAuth application's secret.
`config.googleAuthConfig.domainToAdminEmail`	body	object	—	DomainToAdminEmail maps each Workspace domain to the admin the service account impersonates; "*" is the fallback.
`config.googleAuthConfig.domainToAdminEmail.*`	body	string	—
`config.googleAuthConfig.fetchGroups`	body	boolean	—	FetchGroups reads the user's Workspace groups for role mapping.
`config.googleAuthConfig.fetchTransitiveGroupMembership`	body	boolean	—	FetchTransitiveGroupMembership also reads groups held through other groups.
`config.googleAuthConfig.insecureSkipEmailVerified`	body	boolean	—	InsecureSkipEmailVerified admits addresses Google has not verified.
`config.googleAuthConfig.redirectURI`	body	string	—	RedirectURI is the callback the flow returns to.
`config.googleAuthConfig.serviceAccountJson`	body	string	—	ServiceAccountJSON is the service-account credential used to read groups, when FetchGroups is on.
`config.oidcConfig`	body	o11y.O11yOIDCConfig	—
`config.oidcConfig.claimMapping`	body	o11y.O11yAttributeMapping	—
`config.oidcConfig.claimMapping.email`	body	string	—	Email is the key carrying the email; defaults to "email".
`config.oidcConfig.claimMapping.groups`	body	string	—	Groups is the key carrying the group list; defaults to "groups".
`config.oidcConfig.claimMapping.name`	body	string	—	Name is the key carrying the display name; defaults to "name".
`config.oidcConfig.claimMapping.role`	body	string	—	Role is the key carrying the role; defaults to "role".
`config.oidcConfig.clientId`	body	string	—	ClientID is the OAuth application's id.
`config.oidcConfig.clientSecret`	body	string	—	ClientSecret is the OAuth application's secret.
`config.oidcConfig.getUserInfo`	body	boolean	—	GetUserInfo also queries the userinfo endpoint, for providers whose id tokens are thin.
`config.oidcConfig.insecureSkipEmailVerified`	body	boolean	—	InsecureSkipEmailVerified admits addresses the provider has not verified.
`config.oidcConfig.issuer`	body	string	—	Issuer is the provider's issuer URL.
`config.oidcConfig.issuerAlias`	body	string	—	IssuerAlias overrides the issuer for providers whose discovery document disagrees with their issuer URL.
`config.roleMapping`	body	o11y.O11yRoleMapping	—
`config.roleMapping.defaultRole`	body	string	—	DefaultRole is the role when no group mapping applies.
`config.roleMapping.groupMappings`	body	object	—	GroupMappings maps a provider group name to a role name.
`config.roleMapping.groupMappings.*`	body	string	—
`config.roleMapping.useRoleAttribute`	body	boolean	—	UseRoleAttribute reads the role straight from the provider's role claim instead of the group mappings.
`config.samlConfig`	body	o11y.O11ySAMLConfig	—
`config.samlConfig.attributeMapping`	body	o11y.O11yAttributeMapping	—
`config.samlConfig.attributeMapping.email`	body	string	—	Email is the key carrying the email; defaults to "email".
`config.samlConfig.attributeMapping.groups`	body	string	—	Groups is the key carrying the group list; defaults to "groups".
`config.samlConfig.attributeMapping.name`	body	string	—	Name is the key carrying the display name; defaults to "name".
`config.samlConfig.attributeMapping.role`	body	string	—	Role is the key carrying the role; defaults to "role".
`config.samlConfig.insecureSkipAuthNRequestsSigned`	body	boolean	—	InsecureSkipAuthNRequestsSigned skips signing outgoing AuthN requests, for IdPs that refuse signed ones.
`config.samlConfig.samlCert`	body	string	—	SamlCert is the IdP's signing certificate.
`config.samlConfig.samlEntity`	body	string	—	SamlEntity is the IdP's entityID.
`config.samlConfig.samlIdp`	body	string	—	SamlIdp is the IdP's single-sign-on endpoint.
`config.ssoEnabled`	body	boolean	—	SSOEnabled turns enforced SSO on for the domain.
`config.ssoType`	body	string	—	SSOType picks the provider — saml, google_auth or oidc.
`name`	body	string	—	Name is the email domain being claimed, e.g.

Response

Status	Body	Meaning
`201`	o11y.O11yCreatedOut	created

201 body — 3 fields.

Field	In	Type	Always	Description
`data`	body	o11y.O11yCreated	—
`data.id`	body	string	—	ID is the new record's id.
`status`	body	string	—	Status is "success".

Failure carries the platform error shape — see Errors.

Examples

hanzo o11y domains create

import { Configuration, O11yApi } from 'hanzoai';

const api = new O11yApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.createAuthDomain({ config: {"googleAuthConfig":{"allowedGroups":["<allowedGroups>"],"clientId":"<clientId>","clientSecret":"<clientSecret>","domainToAdminEmail":{}},"oidcConfig":{"claimMapping":{"email":"<email>","groups":"<groups>","name":"<name>","role":"<role>"},"clientId":"<clientId>","clientSecret":"<clientSecret>","getUserInfo":false},"roleMapping":{"defaultRole":"<defaultRole>","groupMappings":{},"useRoleAttribute":false},"samlConfig":{"attributeMapping":{"email":"<email>","groups":"<groups>","name":"<name>","role":"<role>"},"insecureSkipAuthNRequestsSigned":false,"samlCert":"<samlCert>","samlEntity":"<samlEntity>"}}, name: "<name>" });

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import O11yApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = O11yApi(client).create_auth_domain(config={"googleAuthConfig":{"allowedGroups":["<allowedGroups>"],"clientId":"<clientId>","clientSecret":"<clientSecret>","domainToAdminEmail":{}},"oidcConfig":{"claimMapping":{"email":"<email>","groups":"<groups>","name":"<name>","role":"<role>"},"clientId":"<clientId>","clientSecret":"<clientSecret>","getUserInfo":false},"roleMapping":{"defaultRole":"<defaultRole>","groupMappings":{},"useRoleAttribute":false},"samlConfig":{"attributeMapping":{"email":"<email>","groups":"<groups>","name":"<name>","role":"<role>"},"insecureSkipAuthNRequestsSigned":false,"samlCert":"<samlCert>","samlEntity":"<samlEntity>"}}, name="<name>")

cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)

resp, _, err := client.O11yAPI.CreateAuthDomain(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_cloud::apis::{configuration::Configuration, o11y_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = o11y_api::create_auth_domain(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.O11yApi;

ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));

var result = new O11yApi(client).createAuthDomain();

curl -X POST https://api.hanzo.ai/v1/o11y/domains \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "config": {
         "googleAuthConfig": {
           "allowedGroups": [
             "<allowedGroups>"
           ],
           "clientId": "<clientId>",
           "clientSecret": "<clientSecret>",
           "domainToAdminEmail": {}
         },
         "oidcConfig": {
           "claimMapping": {
             "email": "<email>",
             "groups": "<groups>",
             "name": "<name>",
             "role": "<role>"
           },
           "clientId": "<clientId>",
           "clientSecret": "<clientSecret>",
           "getUserInfo": false
         },
         "roleMapping": {
           "defaultRole": "<defaultRole>",
           "groupMappings": {},
           "useRoleAttribute": false
         },
         "samlConfig": {
           "attributeMapping": {
             "email": "<email>",
             "groups": "<groups>",
             "name": "<name>",
             "role": "<role>"
           },
           "insecureSkipAuthNRequestsSigned": false,
           "samlCert": "<samlCert>",
           "samlEntity": "<samlEntity>"
         }
       },
       "name": "<name>"
     }'

The door reaches o11y through the o11y tool, which names its 340 operations with its own verbs — this one among them, under a name only the door declares. describe explains any of them:

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "get_o11y_alert_last"
         }
       }
     }'

O11y API · All Hanzo APIs · Interactive reference

Claims an email domain for the org and configures how its users sign in; the…

Request

Response

Examples

On this page