Single sign-on

Read the organization's single sign-on connection

Credencial

API key

Permiso

sso.manage

curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/sso" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The connection.

  Esquema

  SSOConnection

  • providerstringobligatorio

    The identity-provider kind: entra (Microsoft Entra ID, registered in Zitadel through its Azure AD template) or oidc (a generic OIDC provider).

    Valores permitidos: "entra""oidc"

  • display_namestringobligatorio

    The name the connection is shown under (also the provider's name in the identity provider's login page).

    1 to 64 characters

  • issuerstringopcional

    oidc connections only: the OIDC issuer URL (https). Absent for entra.

    at most 200 characters

  • tenant_idstringopcional

    entra connections only: the Entra tenant - a tenant GUID or domain, or one of organizations | common | consumers. Absent for oidc.

    at most 253 characters

  • client_idstringobligatorio

    1 to 200 characters

  • scopesarray of stringobligatorio

    The scopes the identity provider is asked for.

    at most 20 items

  • enabledbooleanobligatorio

    Whether the provider is attached to the organization's login policy. A disabled connection is kept but nobody can sign in through it, and the public discovery answers 404.

  • zitadel_idp_idstringobligatorio

    The id of the organization-level identity provider inside the organization's linked Zitadel organization.

  • redirect_uristring (uri)obligatorio

    The redirect URI the customer must register at their identity provider (for Entra: the app registration's Web redirect URI).

  • created_atstring (date-time)obligatorio
  • updated_atstring (date-time)obligatorio
• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Create or update the organization's single sign-on connection

Credencial

API key

Permiso

sso.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X PUT "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/sso" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "provider": "oidc",
  "display_name": "Acme SSO",
  "issuer": "https://idp.example.com",
  "client_id": "ccsio-acme",
  "client_secret": "replace-with-your-client-secret",
  "scopes": [
    "openid",
    "profile",
    "email"
  ],
  "enabled": true
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The connection was updated.

  Esquema

  SSOConnection

  • providerstringobligatorio

    The identity-provider kind: entra (Microsoft Entra ID, registered in Zitadel through its Azure AD template) or oidc (a generic OIDC provider).

    Valores permitidos: "entra""oidc"

  • display_namestringobligatorio

    The name the connection is shown under (also the provider's name in the identity provider's login page).

    1 to 64 characters

  • issuerstringopcional

    oidc connections only: the OIDC issuer URL (https). Absent for entra.

    at most 200 characters

  • tenant_idstringopcional

    entra connections only: the Entra tenant - a tenant GUID or domain, or one of organizations | common | consumers. Absent for oidc.

    at most 253 characters

  • client_idstringobligatorio

    1 to 200 characters

  • scopesarray of stringobligatorio

    The scopes the identity provider is asked for.

    at most 20 items

  • enabledbooleanobligatorio

    Whether the provider is attached to the organization's login policy. A disabled connection is kept but nobody can sign in through it, and the public discovery answers 404.

  • zitadel_idp_idstringobligatorio

    The id of the organization-level identity provider inside the organization's linked Zitadel organization.

  • redirect_uristring (uri)obligatorio

    The redirect URI the customer must register at their identity provider (for Entra: the app registration's Web redirect URI).

  • created_atstring (date-time)obligatorio
  • updated_atstring (date-time)obligatorio
• 201

  The connection was created.

  Esquema

  SSOConnection

  • providerstringobligatorio

    The identity-provider kind: entra (Microsoft Entra ID, registered in Zitadel through its Azure AD template) or oidc (a generic OIDC provider).

    Valores permitidos: "entra""oidc"

  • display_namestringobligatorio

    The name the connection is shown under (also the provider's name in the identity provider's login page).

    1 to 64 characters

  • issuerstringopcional

    oidc connections only: the OIDC issuer URL (https). Absent for entra.

    at most 200 characters

  • tenant_idstringopcional

    entra connections only: the Entra tenant - a tenant GUID or domain, or one of organizations | common | consumers. Absent for oidc.

    at most 253 characters

  • client_idstringobligatorio

    1 to 200 characters

  • scopesarray of stringobligatorio

    The scopes the identity provider is asked for.

    at most 20 items

  • enabledbooleanobligatorio

    Whether the provider is attached to the organization's login policy. A disabled connection is kept but nobody can sign in through it, and the public discovery answers 404.

  • zitadel_idp_idstringobligatorio

    The id of the organization-level identity provider inside the organization's linked Zitadel organization.

  • redirect_uristring (uri)obligatorio

    The redirect URI the customer must register at their identity provider (for Entra: the app registration's Web redirect URI).

  • created_atstring (date-time)obligatorio
  • updated_atstring (date-time)obligatorio
• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

{
  "provider": "oidc",
  "display_name": "Acme SSO",
  "issuer": "https://idp.example.com",
  "client_id": "ccsio-acme",
  "scopes": [
    "openid",
    "profile",
    "email"
  ],
  "enabled": true,
  "zitadel_idp_id": "298437125649084512",
  "redirect_uri": "https://login.example.com/idps/callback",
  "created_at": "2026-10-14T10:05:00Z",
  "updated_at": "2026-10-14T10:05:00Z"
}

Remove the organization's single sign-on connection

Credencial

API key

Permiso

sso.manage

curl -X DELETE "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/sso" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 204

  The connection was removed.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Discover an organization's single sign-on (public)

Credencial

Ninguna: una operación pública

Permiso

Ninguno además de la credencial

curl "https://console.latam.ccsio.ai/identity/v1/sso/discovery?organization=<organization>"

Parámetros

Respuestas

• 200

  An enabled connection exists.

  Esquema

  SSODiscovery

  • organizationstringobligatorio

    The id of the organization the lookup resolved to (an organization id, also when the lookup was by alias).

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • zitadel_org_idstringobligatorio

    The organization's linked Zitadel organization: send urn:zitadel:iam:org:id:<zitadel_org_id> as an OIDC scope.

    at least 1 characters

  • zitadel_org_domainstringobligatorio

    The primary domain of that Zitadel organization: send urn:zitadel:iam:org:domain:primary:<zitadel_org_domain> as an OIDC scope too. Zitadel's Login V2 reads the org id scope only for numeric ids, while core's organizations carry custom ones (cp-<ulid>); the domain scope is what tells the login screen which organization is meant.

    at least 1 characters

  • idp_idstringobligatorio

    The organization's identity provider in Zitadel: urn:zitadel:iam:org:idp:id:<idp_id> as an OIDC scope is the hint that skips the provider chooser.

    at least 1 characters

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 429

  The caller used up a budget. `Retry-After` says how many seconds to wait. `error.code` says which budget. Codes: rate-limited (the per-client budget of the public discovery routes), registration-rate-limited (sign-up), support-session-limit (an operator's open support sessions)

• 500

  Platform failure, rendered without internal cause details.

List the organization's single sign-on email domains

Credencial

API key

Permiso

sso.manage

curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/sso/domains" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The domains.

  Esquema

  ListSSODomainsResponse

  • domainsarray of SSODomainobligatorio

    • domainstringobligatorio

      at most 253 characters

    • statusstringobligatorio

      pending: added, the TXT record not yet confirmed. verified: the TXT record matched; the organization now owns the domain for email discovery.

      Valores permitidos: "pending""verified"

    • txt_recordSSODomainTXTRecord or nullobligatorio

      The record to publish while the domain is pending; null once it is verified.

    • created_atstring (date-time)obligatorio
    • verified_atstring (date-time) or nullobligatorio

      null while pending.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Add an email domain to the organization's single sign-on

Credencial

API key

Permiso

sso.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/sso/domains" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "domain": "string"
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 201

  The domain was added, pending.

  Esquema

  SSODomain

  • domainstringobligatorio

    at most 253 characters

  • statusstringobligatorio

    pending: added, the TXT record not yet confirmed. verified: the TXT record matched; the organization now owns the domain for email discovery.

    Valores permitidos: "pending""verified"

  • txt_recordobject or nullobligatorio

    The record to publish while the domain is pending; null once it is verified.

    • namestringobligatorio

      The record name: _ccsio-verification.<domain>.

      at most 253 characters

    • valuestringobligatorio

      The record value: ccsio-verification=<token>, the token being 32 random letters and digits.

      pattern ^ccsio-verification=[A-Za-z0-9]{32}$

  • created_atstring (date-time)obligatorio
  • verified_atstring (date-time) or nullobligatorio

    null while pending.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Verify an email domain by its DNS TXT record

Credencial

API key

Permiso

sso.manage

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/sso/domains/{domain}/verify" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The domain is verified.

  Esquema

  SSODomain

  • domainstringobligatorio

    at most 253 characters

  • statusstringobligatorio

    pending: added, the TXT record not yet confirmed. verified: the TXT record matched; the organization now owns the domain for email discovery.

    Valores permitidos: "pending""verified"

  • txt_recordobject or nullobligatorio

    The record to publish while the domain is pending; null once it is verified.

    • namestringobligatorio

      The record name: _ccsio-verification.<domain>.

      at most 253 characters

    • valuestringobligatorio

      The record value: ccsio-verification=<token>, the token being 32 random letters and digits.

      pattern ^ccsio-verification=[A-Za-z0-9]{32}$

  • created_atstring (date-time)obligatorio
  • verified_atstring (date-time) or nullobligatorio

    null while pending.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Remove an email domain from the organization's single sign-on

Credencial

API key

Permiso

sso.manage

curl -X DELETE "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/sso/domains/{domain}" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 204

  The domain was removed.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Discover how a user signs in (public)

Credencial

Ninguna: una operación pública

Permiso

Ninguno además de la credencial

Cuerpo de la solicitud

Cuerpo de hasta 4096 bytes

curl -X POST "https://console.latam.ccsio.ai/identity/v1/login/discovery" \
  -H "Content-Type: application/json" \
  -d 'null'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  How to sign in.

  Esquema

  LoginDiscovery

  • methodstringobligatorio

    sso: the organization's own identity provider. password: the normal Zitadel login (a lookup by email only).

    Valores permitidos: "sso""password"

  • aliasstringopcional

    An organization's alias: the public name its sign-in link is built from (https://<console>/<alias>). 3 to 63 lowercase letters, digits and hyphens, starting and ending with a letter or digit. Unique across the plane and editable by the organization's Root and Admin; the organization's internal id never changes. An alias exists only for an organization with an ENABLED single sign-on connection: setting or changing one without it is refused with 409 alias-requires-sso, and removing or disabling the connection releases the alias (it reads null again). Reserved words (every top-level console path - api, auth, login, logout, register, onboarding, organizations, identity, audit, models, deployments, playground, settings, request-logs, metering, memory, registrars, usage - and common words such as admin, help, docs, static, assets, health, ready, www, console, app) and anything shaped like a generated organization id (org-<26 characters>) are refused with 400 alias-reserved; a malformed one with 400 alias-invalid; one already in use with 409 alias-taken.

    3 to 63 characters · pattern ^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$

  • zitadel_org_idstringopcional

    The organization's linked Zitadel organization: send urn:zitadel:iam:org:id:<zitadel_org_id> as an OIDC scope.

    at least 1 characters

  • zitadel_org_domainstringopcional

    The primary domain of that Zitadel organization: send urn:zitadel:iam:org:domain:primary:<zitadel_org_domain> as an OIDC scope too (Login V2 finds a custom-id organization by it).

    at least 1 characters

  • idp_idstringopcional

    method sso only: the organization's identity provider in Zitadel; urn:zitadel:iam:org:idp:id:<idp_id> is the hint that skips the provider chooser.

    at least 1 characters

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 413

  The body exceeds 4096 bytes. Codes: request-body-too-large

• 429

  The caller used up a budget. `Retry-After` says how many seconds to wait. `error.code` says which budget. Codes: rate-limited (the per-client budget of the public discovery routes), registration-rate-limited (sign-up), support-session-limit (an operator's open support sessions)

• 500

  Platform failure, rendered without internal cause details.