Get all single sign-on IdP group mappings

GET /api/configuration/authentication/consumer-sso-idp-groups

Success: 200 OK

Products: Operator (FOH)
Features: Front of House Generic Access (FOHGENERIC)

Overview

Lists the rules that decide what a consumer gets when they sign in through an external identity provider. Each mapping says: members who arrive carrying group X from the IdP are placed on price level Y at site Z. A price level is the pricing tier a member sits in, which determines what they pay; a site is one physical centre.

Call this before you call Update IdP group mappings list. That endpoint takes the complete set of mappings, not a delta: any existing mapping whose id is absent from the list you send is deleted. So the safe sequence is read the full list here, modify the entries you care about, and send everything back — including the entries you are not changing, with their id values intact. Sending only the one mapping you want to add wipes out the rest.

The response is a JSON array. There is no paging and no filter of any kind. When no mappings are configured you get 200 with [] — never 204 and never 404.

Nothing is hidden. Mappings have no enabled, active or archived flag, so every mapping is returned and there is no such thing as a retired-but-preserved mapping — the only way to stop one applying is to delete it, either individually with Delete an IdP group mapping or by omitting it from the update list.

Updating or deleting a mapping through this API is visible on the next call; a change made any other way can take up to six hours to appear.

Endpoint

GET {base_url}/api/configuration/authentication/consumer-sso-idp-groups

{base_url} is the environment URL issued to your integration. See Authenticating with Gladstone APIs.

Sample request

cURL

curl -X GET '{base_url}/api/configuration/authentication/consumer-sso-idp-groups' \
  -H 'Authorization: Bearer {accessToken}' \
  -H 'X-Use-SSO: true'

Response fields

Field	Type	Description
`[].id`	integer (int32)	The mapping's numeric identifier, assigned by Gladstone when the mapping is created. Tenant-local — it identifies a mapping, not an IdP group, and means nothing in another tenant or environment. You need it for two things: passing to Delete an IdP group mapping, and echoing back in Update IdP group mappings list so that an existing mapping is updated rather than deleted and recreated. In that update, an entry with no `id` (or an `id` below 1) is treated as new, and an unknown `id` is rejected with a `400`.
`[].groupName`	string	The operator's own label for the mapping, used to recognise it in an administration screen. Mandatory, up to 255 characters, and trimmed of surrounding whitespace when written. It plays no part in matching a member to a mapping — that is `idpGroupID`'s job — so treat it as a display string. Names must be unique within the tenant when the mapping list is updated: the update endpoint rejects duplicates, comparing case-insensitively.
`[].idpGroupID`	string	The group identifier as the external identity provider issues it, and the value a signing-in member is matched against. Mandatory, up to 255 characters, trimmed on write, and unique across the tenant, so one IdP group can never map to two different price levels or sites. This value is chosen by whoever administers the identity provider, not by Gladstone; the format is whatever that provider emits.
`[].priceLevelID`	string	The price level a member from this IdP group is placed on — the tier that governs what they are charged. Mandatory and never null, and always refers to a price level that exists in the tenant. Up to 15 characters, operator-defined and tenant-local, matching the ids returned by Get all price levels. The update endpoint verifies the price level exists before accepting a mapping and rejects unknown values with a `400`.
`[].siteId`	string	The site (individual centre) the mapping applies to. Operator-defined, up to 15 characters, tenant-local, and matching the ids from Get all sites; any value present resolves to a real site. This can be `null`. The update endpoint requires a value, but mappings written before that rule existed, or created by other means, may come back with no site. Handle `null` rather than assuming a site is always present.

Sample response

200 OK

[
  {
    "id": 12345,
    "groupName": "string",
    "idpGroupID": "string",
    "priceLevelID": "string",
    "siteId": "string"
  }
]

Errors

Status	Meaning	When
`500`	Internal server error	Any unexpected server-side failure while reading the mappings. The body is empty, so there is no detail to act on. Retry; no change to the request avoids it.

This page as markdown · All pages · llms.txt