# Get all single sign-on IdP group mappings

`GET /api/configuration/authentication/consumer-sso-idp-groups`

- **Success:** `200 OK`
- **Products:** Operator (`FOH`)
- **Features:** Front of House Generic Access (`FOHGENERIC`)

HTML version: [Get all single sign-on IdP group mappings](https://support.gladstonesoftware.cloud/reference/configuration/get-all-single-sign-on-idp-group-mappings)

## Overview

Lists the rules that decide what a consumer gets when they sign in through an external identity provider. Each mapping says: members who arrive carrying group `X` from the IdP are placed on price level `Y` at site `Z`. A price level is the pricing tier a member sits in, which determines what they pay; a site is one physical centre.

**Call this before you call [Update IdP group mappings list](update-idp-group-mappings-list.md).** That endpoint takes the complete set of mappings, not a delta: any existing mapping whose `id` is absent from the list you send is deleted. So the safe sequence is read the full list here, modify the entries you care about, and send everything back — including the entries you are not changing, with their `id` values intact. Sending only the one mapping you want to add wipes out the rest.

The response is a JSON array. There is no paging and no filter of any kind. When no mappings are configured you get `200` with `[]` — never `204` and never `404`.

Nothing is hidden. Mappings have no enabled, active or archived flag, so every mapping is returned and there is no such thing as a retired-but-preserved mapping — the only way to stop one applying is to delete it, either individually with [Delete an IdP group mapping](delete-an-idp-group-mapping.md) or by omitting it from the update list.

Updating or deleting a mapping through this API is visible on the next call; a change made any other way can take up to six hours to appear.

## Endpoint

`GET {base_url}/api/configuration/authentication/consumer-sso-idp-groups`

`{base_url}` is the environment URL issued to your integration. See [Authenticating with Gladstone APIs](../../guides/authenticating-with-gladstone-apis.md).

## Sample request

```bash title="cURL"
curl -X GET '{base_url}/api/configuration/authentication/consumer-sso-idp-groups' \
  -H 'Authorization: Bearer {accessToken}' \
  -H 'X-Use-SSO: true'
```

## Response fields

| Field | Type | Description |
|-------|------|-------------|
| `[].id` | integer (int32) | The mapping's numeric identifier, assigned by Gladstone when the mapping is created. Tenant-local — it identifies a mapping, not an IdP group, and means nothing in another tenant or environment. You need it for two things: passing to [Delete an IdP group mapping](delete-an-idp-group-mapping.md), and echoing back in [Update IdP group mappings list](update-idp-group-mappings-list.md) so that an existing mapping is updated rather than deleted and recreated. In that update, an entry with no `id` (or an `id` below 1) is treated as new, and an unknown `id` is rejected with a `400`. |
| `[].groupName` | string | The operator's own label for the mapping, used to recognise it in an administration screen. Mandatory, up to 255 characters, and trimmed of surrounding whitespace when written. It plays no part in matching a member to a mapping — that is `idpGroupID`'s job — so treat it as a display string. Names must be unique within the tenant when the mapping list is updated: the update endpoint rejects duplicates, comparing case-insensitively. |
| `[].idpGroupID` | string | The group identifier as the external identity provider issues it, and the value a signing-in member is matched against. Mandatory, up to 255 characters, trimmed on write, and **unique across the tenant**, so one IdP group can never map to two different price levels or sites. This value is chosen by whoever administers the identity provider, not by Gladstone; the format is whatever that provider emits. |
| `[].priceLevelID` | string | The price level a member from this IdP group is placed on — the tier that governs what they are charged. Mandatory and never null, and always refers to a price level that exists in the tenant. Up to 15 characters, operator-defined and tenant-local, matching the ids returned by [Get all price levels](get-all-price-levels.md). The update endpoint verifies the price level exists before accepting a mapping and rejects unknown values with a `400`. |
| `[].siteId` | string | The site (individual centre) the mapping applies to. Operator-defined, up to 15 characters, tenant-local, and matching the ids from [Get all sites](get-all-sites-with-optional-filtering.md); any value present resolves to a real site. **This can be `null`.** The update endpoint requires a value, but mappings written before that rule existed, or created by other means, may come back with no site. Handle `null` rather than assuming a site is always present. |

## Sample response

```json title="200 OK"
[
  {
    "id": 12345,
    "groupName": "string",
    "idpGroupID": "string",
    "priceLevelID": "string",
    "siteId": "string"
  }
]
```

## Errors

| Status | Meaning | When |
|--------|---------|------|
| `500` | Internal server error | Any unexpected server-side failure while reading the mappings. The body is empty, so there is no detail to act on. Retry; no change to the request avoids it. |