Auth API

Auth endpoints exposed by the Devotel CPaaS API Base path: /auth/saml Endpoint count: 4

GET /auth/saml/{orgSlug}/login

Service-provider-initiated SAML 2.0 login. Generates a SAML AuthnRequest for the organization’s configured identity provider and 302-redirects the browser to the IdP’s SSO URL. Pass an optional redirect target that is signed into the RelayState and honoured after the IdP returns to the callback endpoint. Unauthenticated — this begins the session rather than requiring one.

string

required

URL-safe organization slug that selects the SAML configuration.

string

Optional post-authentication destination, echoed back via RelayState after the IdP round-trip.

cURL

curl "https://api.orbit.devotel.io/auth/saml/{orgSlug}/login" \
  -H "X-API-Key: dv_live_sk_your_key_here"

Node.js

const res = await fetch('https://api.orbit.devotel.io/auth/saml/{orgSlug}/login', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!
  }
});
const data = await res.json();

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/auth/saml/{orgSlug}/login", headers=headers)
print(r.json())

Start SAML single logout

GET /auth/saml/{orgSlug}/logout

Service-provider-initiated SAML 2.0 Single Logout (SLO). Builds a LogoutRequest for the organization’s identity provider and 302-redirects the browser to the IdP’s SLO endpoint; the local Clerk session is destroyed separately by the front-end once the IdP returns. Pass the optional nameId of the subject to log out. When no SLO endpoint is configured the endpoint responds 200 with a logged_out status instead of redirecting.

string

required

URL-safe organization slug that selects the SAML configuration.

string

The SAML NameID of the subject being logged out, included in the LogoutRequest when supplied.

cURL

curl "https://api.orbit.devotel.io/auth/saml/{orgSlug}/logout" \
  -H "X-API-Key: dv_live_sk_your_key_here"

Node.js

const res = await fetch('https://api.orbit.devotel.io/auth/saml/{orgSlug}/logout', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!
  }
});
const data = await res.json();

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/auth/saml/{orgSlug}/logout", headers=headers)
print(r.json())

Download SAML service-provider metadata

GET /auth/saml/{orgSlug}/metadata

Returns Orbit’s SP-side SAML 2.0 metadata as XML. IdP administrators paste this document (or upload the downloaded file) into their SAML application configuration to register Orbit as a service provider — it carries the entity ID, ACS URL, and SP signing details. Served as application/xml with a Content-Disposition: attachment so it downloads cleanly, and cached at the edge because it changes only on entity rotation.

string

required

URL-safe organization slug that selects the SAML configuration.

cURL

curl "https://api.orbit.devotel.io/auth/saml/{orgSlug}/metadata" \
  -H "X-API-Key: dv_live_sk_your_key_here"

Node.js

const res = await fetch('https://api.orbit.devotel.io/auth/saml/{orgSlug}/metadata', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!
  }
});
const data = await res.json();

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/auth/saml/{orgSlug}/metadata", headers=headers)
print(r.json())

Consume the SAML assertion (ACS)

POST /auth/saml/{orgSlug}/callback

SAML 2.0 Assertion Consumer Service. The identity provider POSTs a signed SAMLResponse here after the user authenticates; Orbit verifies the signature, audience and replay window, provisions a user on first login, then 302-redirects the browser to the dashboard sign-in ticket so the session cookie can be minted. This endpoint is called by the IdP, not directly by your application.

string

required

URL-safe organization slug that selects the SAML configuration.

cURL

curl -X POST "https://api.orbit.devotel.io/auth/saml/{orgSlug}/callback" \
  -H "X-API-Key: dv_live_sk_your_key_here"

Node.js

const res = await fetch('https://api.orbit.devotel.io/auth/saml/{orgSlug}/callback', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!
  }
});
const data = await res.json();

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.post("https://api.orbit.devotel.io/auth/saml/{orgSlug}/callback", headers=headers)
print(r.json())

API Reference

All Endpoints

Auth API

Auth API

Start SAML single logout

Download SAML service-provider metadata

Consume the SAML assertion (ACS)

​Auth API

​Start SAML SSO login

​Start SAML single logout

​Download SAML service-provider metadata

​Consume the SAML assertion (ACS)

Auth API

Start SAML SSO login

Start SAML single logout

Download SAML service-provider metadata

Consume the SAML assertion (ACS)