Link SSO identity to user

POST

/ssoEnroll

Last modified:2026-09-26 01:50:15

OperationId:SSOEnroll

Links a single sign-on (SSO) identity to an existing user, so the user can later log in through that identity provider. No bearer token is needed. Send the provider's token in idtoken, the provider in vendor, and the user's username and password to prove the account is theirs. vendor is google, apple, office, or the provider_id of an enabled OIDC provider. The user's domain must have single sign-on enabled, and the email in the provider's token must be allowed for that user. The email is added to the user's email list. A 202 means the link was published, not yet applied. Wrong credentials return 401. An invalid provider token, an unsupported vendor, a domain without SSO, or a disallowed email returns 409.

Request

Body Params application/json

Examples

Responses

🟢202Accepted

application/json

Link published. It applies once the event is processed.

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠409Conflict

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/ssoEnroll' \
--header 'Content-Type: application/json' \
--data '{
    "vendor": "google",
    "idtoken": "{{google_id_token}}",
    "username": "{{username}}",
    "password": "{{password}}"
}'

Response Example

202 - Success

{
    "code": 202,
    "message": "Accepted"
}

Modified at 2026-09-26 01:50:15

Get JWT from OAuth grant

List API keys