How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
Beyond Identity

Beyond Identity SSO Configs API

An SSO configuration defines how end users interact with supported SSO protocols and related services. Each configuration type represents a protocol or integration (e.g., SAML, WS-Federation, OIDC, SCIM) supported by Beyond Identity. An SSO configuration provides a flexible framework for managing authentication, provisioning, and other integrations. It abstracts application protocols, inbound and outbound provisioning, and supports named integrations. Additionally, it includes features like user or group assignments, visual tiles in the SSO interface, and compatibility with multiple authentication and provisioning standards. This makes SSO configurations versatile for both authentication and non-authentication use cases.

Documentation Provider Profile APIs.io OpenAPI GitHub

Beyond Identity SSO Configs API is one of 17 APIs that Beyond Identity publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

This API exposes 2 JSON Schema definitions.

Tagged areas include SSO Configs. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and 2 JSON Schemas.

This API exposes 17 operations across 14 paths, and defines 35 schemas. It is described by OpenAPI 3.0.1, at version 1.7.0.

Requests are made against 3 base URLs: https://api-us.beyondidentity.com, https://api-eu.beyondidentity.com, https://api.us1.beyondidentity-gov.com/.

17 operations 14 paths 35 schemas 1 DELETE8 GET1 PATCH7 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.0.1
API Version
1.7.0
Base URL
https://api-us.beyondidentity.com
Authentication
HTTP Bearer
Contact
support@beyondidentity.com
Resource Areas
1

Authentication & Security 1

Beyond Identity SSO Configs API declares 1 security scheme for authenticating requests. It accepts HTTP bearer tokens (JWT) (BearerAuth). By default, every request must be authenticated.

  • BearerAuth — See the [Authentication](section/Authentication) section for details.

Paths & Operations 17

Across 14 paths, the API surfaces 17 operations — 1 DELETE, 8 GET, 1 PATCH, 7 POST. Each is listed below with its method, path, parameters, and response codes.

SSO Configs 17

An SSO configuration defines how end users interact with supported SSO protocols and related services. Each configuration type represents a protocol or integration (e.g., SAML, WS…

POST
/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs
Create a new SSO Config.
CreateSsoConfig 3 params body → 200400401403500
GET
/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs
List SSO Configs for a Realm.
listSsoConfigs 8 params → 200400401403500
GET
/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}
Retrieves an existing SSO Config.
GetSsoConfig 4 params → 200400401403404500
PATCH
/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}
Updates an SSO Config by its ID.
UpdateSsoConfig 4 params body → 200400401403404500
DELETE
/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}
Deletes an SSO Config by its ID.
DeleteSsoConfig 4 params → 200400401403404500
POST
/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}:addIdentities
Associate Identities with an SSO Config
AddIdentitiesToSsoConfig 4 params body → 200400401403404500
POST
/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}:deleteIdentities
Delete Identities from an SSO Config
DeleteIdentitiesFromSsoConfig 4 params body → 200400401403404500
GET
/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}:listIdentityAssociations
List Identities Directly and Indirectly Associated With an SSO Config.
ListIdentitiesForSsoConfig 6 params → 200400401403500
GET
/v1/tenants/{tenant_id}/realms/{realm_id}/identities/{identity_id}/sso-configs/{sso_config_id}/is-identity-assigned
Returns if an identity is assigned to the SSO config id.
IdentityToSSOConfigCheck 4 params → 200400401403500
GET
/v1/tenants/{tenant_id}/realms/{realm_id}/identities/{identity_id}/sso-configs
List SSO configs directly and indirectly associated with an identity.
ListSsoConfigsForIdentity 7 params → 200400401403500
POST
/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}:addGroups
Associate Groups with an SSOConfig
AddGroupsToSsoConfig 4 params body → 200400401403404500
POST
/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}:deleteGroups
Delete Groups from an SSO Config
DeleteGroupsFromSsoConfig 4 params body → 200400401403404500
GET
/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}:listGroupAssociations
List Groups associated with an SSO config.
ListGroupsForSSOConfig 4 params → 200400401403500
GET
/v1/tenants/{tenant_id}/realms/{realm_id}/groups/{group_id}/sso-configs
List SSO Configs associated with a Group.
ListSsoConfigsForGroup 7 params → 200400401403500
POST
/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}/is-group-assigned
Check if any of the groups provided are associated with the SSO Config ID.
SSOIsGroupAssigned 4 params body → 200400401403500
GET
/v1/tenants/{tenant_id}/realms/{realm_id}/applications/{application_id}/sso-configs-id
Returns the ID of the SSO Config associated with the Application.
ApplicationIdToSSOConfigId 4 params → 200400401403500
POST
/v1/tenants/{tenant_id}/realms/{realm_id}/sso-configs/{sso_config_id}/test
Tests an SSO Config.
TestSsoConfig 4 params → 200400401403500

Schemas 35

The contract defines 35 schemas that model the data the API accepts and returns. The most detailed are Traits_v0 (34 properties), SsoConfigSamlPartialUpdate (32 properties), SsoConfigWsFedPartialUpdate (13 properties), SsoConfigWsFed (13 properties). Each schema is shown below with its type and property counts.

SubjectField
string
Defines which field should be used to populate the subject field of an id token. - id - The user ID is used. - email - The user email is used. - username - The…
SsoConfigWsFed
object
13 properties 10 required
SsoConfigRealityCheckPartialUpdate
object
2 properties 1 required
SsoConfigBookmark
object
4 properties 2 required
SsoConfigPayload
SsoConfigOktaBiIdpPartialUpdate
object
4 properties 1 required
SsoConfigListGroups
object
List Groups associated with an SSO config.
1 property
SsoGroupWithMemberCount
object
A group is a logical collection of identities. Groups are commonly used as a predicate in a policy rule.
8 properties
SsoConfigSamlPartialUpdate
object
32 properties 1 required
SsoConfigOidcIdp
object
7 properties 7 required
SsoConfigWsFedPartialUpdate
object
13 properties 1 required
Error
object
3 properties 2 required
ErrorDetail
object
Additional details for errors designed to support client applications.
1 property 1 required
PkceConfig
string
PKCE code challenge methods supported for applications, as defined by [RFC-7636](https://datatracker.ietf.org/doc/html/rfc7636). Allowable values are: - disabl…
SsoConfigGenericOidcIdpPartialUpdate
object
10 properties 1 required
SsoConfigGenericOidc
object
10 properties 5 required
SsoConfigOktaBiIdp
object
4 properties 3 required
SsoConfigType
string
Describes the type of sso config.
SsoConfigBookmarkPartialUpdate
object
4 properties 1 required
SsoConfigDeleteGroup
object
Request for DeleteGroupsToSsoConfig.
1 property 1 required
SsoConfigPartialUpdatePayload
SsoConfigEntraIdAuthMethodPartial
object
4 properties 1 required
SsoConfigGenericOidcPartialUpdate
object
10 properties 1 required
SsoConfigEntraIdExternalAuthMethod
object
4 properties 3 required
SsoConfig
object
Represents an SSO config as a request body.
3 properties 2 required
SsoConfigEnvelope
object
Represents an SSO config as a request body.
1 property 1 required
SsoConfigRealityCheck
object
2 properties 2 required
TokenEndpointAuthMethod
string
Indicator of the requested authentication method for the token endpoint. Allowable values are: - clientsecretpost: The client uses the HTTP POST parameters as…
SsoConfigPartialUpdate
object
Represents an sso config as an update request body.
1 property 1 required
ApplicationSsoResponse
object
1 property
Identity
object
An identity is a unique identifier that may be used by an end-user to gain access governed by Beyond Identity.
9 properties
SsoConfigAddIdentities
object
Request for AddIdentitiesToSsoConfig.
1 property 1 required
Traits_v0
object
Set of traits associated with an identity.
34 properties 1 required
IdentityProviderTestResponse
object
Represents an SSO config test response body.
5 properties 4 required
Confidentiality
string
The confidentiality of the client, as prescribed by OAuth 2.0 and OIDC. Confidentiality is based on a client's ability to authenticate securely with the author…

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

beyond-identity-sso-configs-api-openapi.yml Raw ↑

Other APIs Beyond Identity publishes across the network.

Beyond Identity Next Generation API
AE Profile APIs.io
Beyond Identity Applications API
AE Profile APIs.io
Beyond Identity Authenticator Configurations API
AE Profile APIs.io
Beyond Identity Credential Binding Jobs API
AE Profile APIs.io
Beyond Identity Credentials API
AE Profile APIs.io
Beyond Identity Groups API
AE Profile APIs.io
Beyond Identity Identities API
AE Profile APIs.io
Beyond Identity Identity Provider API
AE Profile APIs.io
Beyond Identity Launch Mechanisms API
AE Profile APIs.io
Beyond Identity Realms API
AE Profile APIs.io
Beyond Identity Resource Servers API
AE Profile APIs.io
Beyond Identity Roles API
AE Profile APIs.io
#SSO Configs
← Back to B APIs
API Details
ID
beyond-identity:beyond-identity-sso-configs-api
Base URL
https://api-us.beyondidentity.com
Docs
https://developer.beyondidentity.com/api/v1
Provider
Beyond Identity
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=beyond-identity-sso-configs-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/beyond-identity-sso-configs-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of Beyond Identity SSO Configs API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.