​

Settings → Security

​

Scope map

​

Org IP allowlist

curl -X POST "https://api.orbit.devotel.io/api/v1/settings/ip-allowlist" \
  -H "Authorization: Bearer $SESSION_JWT" \
  -H "Content-Type: application/json" \
  -d '{ "ip": "198.51.100.0/24", "label": "Berlin office" }'

• The server refuses an add or removal that would lock out the IP you are connecting from (422), so a safe change can’t strand you.
• A blocked session request returns 403 IP_NOT_ALLOWED and is recorded in the audit log. On the SAML login flow the rejection surfaces as a generic unauthorized error rather than a distinct “not allowlisted” code, so an unauthenticated probe can’t enumerate whether an allowlist exists — the same anti-enumeration invariant as the per-key guide’s generic INVALID_API_KEY response.
• Support can still reach a locked-out org through a logged super-admin override — the override itself lands in your audit log.

​

SAML SSO

1. Paste your IdP metadata URL into the enrollment form — the page probes it with POST /api/v1/settings/saml/test-connection, which fetches the metadata, reports whether it’s a valid SAML document, and hints the SSO URL and entity ID it found:

curl -X POST "https://api.orbit.devotel.io/api/v1/settings/saml/test-connection" \
  -H "Authorization: Bearer $SESSION_JWT" \
  -H "Content-Type: application/json" \
  -d '{ "metadataUrl": "https://idp.example-corp.com/federationmetadata/2007-06/federationmetadata.xml" }'

2. Save the configuration with PATCH /api/v1/settings/saml. First-time setup must carry the IdP’s PEM signing certificate (x509Cert); attribute mapping tells Orbit which IdP attributes carry the user’s email and display name:

curl -X PATCH "https://api.orbit.devotel.io/api/v1/settings/saml" \
  -H "Authorization: Bearer $SESSION_JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "ssoUrl": "https://idp.example-corp.com/sso",
    "entityId": "urn:example-corp:orbit",
    "attrEmail": "mail",
    "attrName": "displayName",
    "enabled": true,
    "enforced": false
  }'

• enabled turns SSO on as an available sign-in method. enforced makes SSO the only method — set it only after enabled works for your team in production, or you lock out everyone whose IdP flow fails.
• Once a certificate is stored, omit x509Cert on subsequent PATCHes — the stored one is retained.
• Metadata and SSO URLs are validated to block internal or private addresses (SSRF guard), so test-connection reports a clear failure instead of fetching something it shouldn’t.

​

SCIM provisioning

​

Operator 2FA

​

Audit-log tie

​

See also

• Settings API — endpoint table for SAML, SCIM, and every other Settings surface
• Per-API-key IP allowlist — programmatic API gating per key
• SCIM provisioning — full IdP sync walkthrough
• Verify overview — end-user 2FA factors (separate from operator login)
• Audit log — query and export the trail these controls write