Hanzo
OpenapiO11y

Returns one auth domain with its SSO configuration, by id.

Returns one auth domain with its SSO configuration, by id.

GET /v1/o11y/domains/{id}

Addresshttps://api.hanzo.ai/v1/o11y/domains/{id}
MethodGET
OperationGetAuthDomain
AuthAuthorization: Bearer $HANZO_API_KEY

Returns one auth domain with its SSO configuration, by id. Admin gate.

Request

1 field.

FieldInTypeRequiredDescription
idpathstringyes

Response

StatusBodyMeaning
200o11y.O11yAuthDomainOutok

200 body — 50 fields.

FieldInTypeAlwaysDescription
databodyo11y.O11yAuthDomain
data.authNProviderInfobodyo11y.O11yAuthNProviderInfo
data.authNProviderInfo.relayStatePathbodystringRelayStatePath is the relay-state path a SAML IdP must be configured with, when the provider needs one.
data.configbodyo11y.O11yAuthDomainConfig
data.config.googleAuthConfigbodyo11y.O11yGoogleConfig
data.config.googleAuthConfig.allowedGroupsbodystring[]AllowedGroups, when set, admits only members of these groups.
data.config.googleAuthConfig.clientIdbodystringClientID is the OAuth application's id.
data.config.googleAuthConfig.clientSecretbodystringClientSecret is the OAuth application's secret.
data.config.googleAuthConfig.domainToAdminEmailbodyobjectDomainToAdminEmail maps each Workspace domain to the admin the service account impersonates; "*" is the fallback.
data.config.googleAuthConfig.domainToAdminEmail.*bodystring
data.config.googleAuthConfig.fetchGroupsbodybooleanFetchGroups reads the user's Workspace groups for role mapping.
data.config.googleAuthConfig.fetchTransitiveGroupMembershipbodybooleanFetchTransitiveGroupMembership also reads groups held through other groups.
data.config.googleAuthConfig.insecureSkipEmailVerifiedbodybooleanInsecureSkipEmailVerified admits addresses Google has not verified.
data.config.googleAuthConfig.redirectURIbodystringRedirectURI is the callback the flow returns to.
data.config.googleAuthConfig.serviceAccountJsonbodystringServiceAccountJSON is the service-account credential used to read groups, when FetchGroups is on.
data.config.oidcConfigbodyo11y.O11yOIDCConfig
data.config.oidcConfig.claimMappingbodyo11y.O11yAttributeMapping
data.config.oidcConfig.claimMapping.emailbodystringEmail is the key carrying the email; defaults to "email".
data.config.oidcConfig.claimMapping.groupsbodystringGroups is the key carrying the group list; defaults to "groups".
data.config.oidcConfig.claimMapping.namebodystringName is the key carrying the display name; defaults to "name".
data.config.oidcConfig.claimMapping.rolebodystringRole is the key carrying the role; defaults to "role".
data.config.oidcConfig.clientIdbodystringClientID is the OAuth application's id.
data.config.oidcConfig.clientSecretbodystringClientSecret is the OAuth application's secret.
data.config.oidcConfig.getUserInfobodybooleanGetUserInfo also queries the userinfo endpoint, for providers whose id tokens are thin.
data.config.oidcConfig.insecureSkipEmailVerifiedbodybooleanInsecureSkipEmailVerified admits addresses the provider has not verified.
data.config.oidcConfig.issuerbodystringIssuer is the provider's issuer URL.
data.config.oidcConfig.issuerAliasbodystringIssuerAlias overrides the issuer for providers whose discovery document disagrees with their issuer URL.
data.config.roleMappingbodyo11y.O11yRoleMapping
data.config.roleMapping.defaultRolebodystringDefaultRole is the role when no group mapping applies.
data.config.roleMapping.groupMappingsbodyobjectGroupMappings maps a provider group name to a role name.
data.config.roleMapping.groupMappings.*bodystring
data.config.roleMapping.useRoleAttributebodybooleanUseRoleAttribute reads the role straight from the provider's role claim instead of the group mappings.
data.config.samlConfigbodyo11y.O11ySAMLConfig
data.config.samlConfig.attributeMappingbodyo11y.O11yAttributeMapping
data.config.samlConfig.attributeMapping.emailbodystringEmail is the key carrying the email; defaults to "email".
data.config.samlConfig.attributeMapping.groupsbodystringGroups is the key carrying the group list; defaults to "groups".
data.config.samlConfig.attributeMapping.namebodystringName is the key carrying the display name; defaults to "name".
data.config.samlConfig.attributeMapping.rolebodystringRole is the key carrying the role; defaults to "role".
data.config.samlConfig.insecureSkipAuthNRequestsSignedbodybooleanInsecureSkipAuthNRequestsSigned skips signing outgoing AuthN requests, for IdPs that refuse signed ones.
data.config.samlConfig.samlCertbodystringSamlCert is the IdP's signing certificate.
data.config.samlConfig.samlEntitybodystringSamlEntity is the IdP's entityID.
data.config.samlConfig.samlIdpbodystringSamlIdp is the IdP's single-sign-on endpoint.
data.config.ssoEnabledbodybooleanSSOEnabled turns enforced SSO on for the domain.
data.config.ssoTypebodystringSSOType picks the provider — saml, google_auth or oidc.
data.createdAtbodystring (date-time)CreatedAt is when it was claimed.
data.idbodystringID is the auth domain id.
data.namebodystringName is the email domain, e.g.
data.orgIdbodystringOrgID is the org that claimed it.
data.updatedAtbodystring (date-time)UpdatedAt is when its configuration last changed.
statusbodystringStatus is "success".

Failure carries the platform error shape — see Errors.

Examples

hanzo o11y domains get <id>

O11y API · All Hanzo APIs · Interactive reference

How is this guide?

On this page