ENTERPRISE

Federation control plane

Manage organization-bound federation metadata and let verified organization domains discover inbound OIDC sign-in.

GET/api/auth/federation/capabilities

Read provider-level enterprise federation capability status

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/auth/federation/capabilities'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

public

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/auth/federation/discovery

Discover a verified-domain federation connection

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/auth/federation/discovery'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

same-origin browser request

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/auth/federation/oidc/start

Start a guarded inbound OIDC authorization-code transaction

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/auth/federation/oidc/start'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

browser origin + federation gate

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/auth/federation/oidc/callback

Complete a single-use inbound OIDC transaction

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/auth/federation/oidc/callback'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

canonical callback + signed provider response

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/organizations/{id}/federation/connections/{connection_id}/health

Run a read-only provider metadata preflight

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/organizations/YOUR_ID/federation/connections/{connection_id}/health'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

organization session + exact origin

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/organizations/{id}/federation/connections

List organization federation metadata

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/organizations/YOUR_ID/federation/connections'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

membership

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/organizations/{id}/federation/connections

Register federation metadata

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/organizations/YOUR_ID/federation/connections'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

admin + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

PATCH/api/organizations/{id}/federation/connections/{connection_id}

Activate or disable federation metadata after bounded provider validation

This operation is part of the public Lucion Identity contract.

Safe request

curl -X PATCH 'https://identity.lucionglobal.com/api/organizations/YOUR_ID/federation/connections/{connection_id}'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

admin + step-up + idempotency

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

DELETE/api/organizations/{id}/federation/connections/{connection_id}

Delete a disabled federation connection

This operation is part of the public Lucion Identity contract.

Safe request

curl -X DELETE 'https://identity.lucionglobal.com/api/organizations/YOUR_ID/federation/connections/{connection_id}'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

admin + step-up + idempotency

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

Provider	Current boundary
Inbound OIDC	PKCE, signed RS256 ID-token validation, verified-email JIT membership, and single-use transactions are enabled only behind AUTH_FEDERATION_MODE.
SAML 2.0	Activation requires bounded XML metadata with a matching entity ID, HTTPS SSO endpoint, and signing certificate marker; assertion protocol execution remains independently gated pending conformance review.
Preflight	The read-only health route re-fetches bounded provider metadata and returns only safe validation state/classification; it never mutates a connection or returns the provider body.
Discovery	Only verified-domain, active connections are returned; each connection carries its protocol status. The callback also re-checks that the verified email domain belongs to the transaction organization.