Hanzo
Sign InGet API Key
OpenapiO11y

Lists the org's auth domains — the email domains whose SSO configuration this…

Lists the org's auth domains — the email domains whose SSO configuration this org owns.

GET /v1/o11y/domains

O11y → · All API references → · Six flows, four surfaces →

Addresshttps://api.hanzo.ai/v1/o11y/domains
MethodGET
OperationListAuthDomains
AuthAuthorization: Bearer $HANZO_API_KEY

Lists the org's auth domains — the email domains whose SSO configuration this org owns. Admin gate.

Request

GET /v1/o11y/domains takes no parameters and no body — the credential is the whole request.

Response

StatusBodyMeaning
200o11y.O11yAuthDomainsOutok

200 body — 50 fields.

FieldInTypeAlwaysDescription
databodyo11y.O11yAuthDomain[]—Data holds the domains.
data[].authNProviderInfobodyo11y.O11yAuthNProviderInfo—
data[].authNProviderInfo.relayStatePathbodystring—RelayStatePath is the relay-state path a SAML IdP must be configured with, when the provider needs one.
data[].configbodyo11y.O11yAuthDomainConfig—
data[].config.googleAuthConfigbodyo11y.O11yGoogleConfig—
data[].config.googleAuthConfig.allowedGroupsbodystring[]—AllowedGroups, when set, admits only members of these groups.
data[].config.googleAuthConfig.clientIdbodystring—ClientID is the OAuth application's id.
data[].config.googleAuthConfig.clientSecretbodystring—ClientSecret is the OAuth application's secret.
data[].config.googleAuthConfig.domainToAdminEmailbodyobject—DomainToAdminEmail maps each Workspace domain to the admin the service account impersonates; "*" is the fallback.
data[].config.googleAuthConfig.domainToAdminEmail.*bodystring—
data[].config.googleAuthConfig.fetchGroupsbodyboolean—FetchGroups reads the user's Workspace groups for role mapping.
data[].config.googleAuthConfig.fetchTransitiveGroupMembershipbodyboolean—FetchTransitiveGroupMembership also reads groups held through other groups.
data[].config.googleAuthConfig.insecureSkipEmailVerifiedbodyboolean—InsecureSkipEmailVerified admits addresses Google has not verified.
data[].config.googleAuthConfig.redirectURIbodystring—RedirectURI is the callback the flow returns to.
data[].config.googleAuthConfig.serviceAccountJsonbodystring—ServiceAccountJSON is the service-account credential used to read groups, when FetchGroups is on.
data[].config.oidcConfigbodyo11y.O11yOIDCConfig—
data[].config.oidcConfig.claimMappingbodyo11y.O11yAttributeMapping—
data[].config.oidcConfig.claimMapping.emailbodystring—Email is the key carrying the email; defaults to "email".
data[].config.oidcConfig.claimMapping.groupsbodystring—Groups is the key carrying the group list; defaults to "groups".
data[].config.oidcConfig.claimMapping.namebodystring—Name is the key carrying the display name; defaults to "name".
data[].config.oidcConfig.claimMapping.rolebodystring—Role is the key carrying the role; defaults to "role".
data[].config.oidcConfig.clientIdbodystring—ClientID is the OAuth application's id.
data[].config.oidcConfig.clientSecretbodystring—ClientSecret is the OAuth application's secret.
data[].config.oidcConfig.getUserInfobodyboolean—GetUserInfo also queries the userinfo endpoint, for providers whose id tokens are thin.
data[].config.oidcConfig.insecureSkipEmailVerifiedbodyboolean—InsecureSkipEmailVerified admits addresses the provider has not verified.
data[].config.oidcConfig.issuerbodystring—Issuer is the provider's issuer URL.
data[].config.oidcConfig.issuerAliasbodystring—IssuerAlias overrides the issuer for providers whose discovery document disagrees with their issuer URL.
data[].config.roleMappingbodyo11y.O11yRoleMapping—
data[].config.roleMapping.defaultRolebodystring—DefaultRole is the role when no group mapping applies.
data[].config.roleMapping.groupMappingsbodyobject—GroupMappings maps a provider group name to a role name.
data[].config.roleMapping.groupMappings.*bodystring—
data[].config.roleMapping.useRoleAttributebodyboolean—UseRoleAttribute reads the role straight from the provider's role claim instead of the group mappings.
data[].config.samlConfigbodyo11y.O11ySAMLConfig—
data[].config.samlConfig.attributeMappingbodyo11y.O11yAttributeMapping—
data[].config.samlConfig.attributeMapping.emailbodystring—Email is the key carrying the email; defaults to "email".
data[].config.samlConfig.attributeMapping.groupsbodystring—Groups is the key carrying the group list; defaults to "groups".
data[].config.samlConfig.attributeMapping.namebodystring—Name is the key carrying the display name; defaults to "name".
data[].config.samlConfig.attributeMapping.rolebodystring—Role is the key carrying the role; defaults to "role".
data[].config.samlConfig.insecureSkipAuthNRequestsSignedbodyboolean—InsecureSkipAuthNRequestsSigned skips signing outgoing AuthN requests, for IdPs that refuse signed ones.
data[].config.samlConfig.samlCertbodystring—SamlCert is the IdP's signing certificate.
data[].config.samlConfig.samlEntitybodystring—SamlEntity is the IdP's entityID.
data[].config.samlConfig.samlIdpbodystring—SamlIdp is the IdP's single-sign-on endpoint.
data[].config.ssoEnabledbodyboolean—SSOEnabled turns enforced SSO on for the domain.
data[].config.ssoTypebodystring—SSOType picks the provider — saml, google_auth or oidc.
data[].createdAtbodystring (date-time)—CreatedAt is when it was claimed.
data[].idbodystring—ID is the auth domain id.
data[].namebodystring—Name is the email domain, e.g.
data[].orgIdbodystring—OrgID is the org that claimed it.
data[].updatedAtbodystring (date-time)—UpdatedAt is when its configuration last changed.
statusbodystring—Status is "success".

Failure carries the platform error shape — see Errors.

Examples

hanzo o11y domains list

O11y API · All Hanzo APIs · Interactive reference

How is this guide?

On this page

RequestResponseExamples