Sign-In Providers API

The sign-in provider endpoints power the Providers, Link approvals, Invitations, and Log tabs in the UI. All management endpoints require the Admin user role.

All endpoints are served from your Qualytics deployment (e.g., https://your-instance.qualytics.io). The paths below include the /api prefix.

Invitations

The invitation endpoints require an enabled Email & Password sign-in provider. See Invite a User for the flow.

Invite User

Endpoint: POST /api/auth/db/invite

Permission: Admin user role

Request Body:

{
  "email": "new.user@example.com",
  "role": "Member"
}

role is optional and defaults to Member. The response includes the invitation status, its expiration time, and the invitation link so you can share it manually when email delivery is not configured.

List Invitations

Endpoint: GET /api/auth/db/invitations

Permission: Admin user role

Query Parameters:

Revoke Invitation

Endpoint: DELETE /api/auth/db/invitations/{id}

Permission: Admin user role

Only invitations with the pending status can be revoked.

Providers

List Providers

Endpoint: GET /api/auth/providers

Permission: Admin user role

Returns a paginated list of provider configurations. Secrets (client secret, certificate) are never returned. Supports provider_type and enabled filters and sorting by name or created date.

Get Provider

Endpoint: GET /api/auth/providers/{id}

Permission: Admin user role

Create Provider

Endpoint: POST /api/auth/providers

Permission: Admin user role

The body depends on the provider type (oidc, saml2, or password). A minimal OIDC example:

{
  "display_name": "Corporate SSO",
  "provider_type": "oidc",
  "oidc_discovery_url": "https://idp.example.com/.well-known/openid-configuration",
  "oidc_client_id": "your-client-id",
  "oidc_client_secret": "your-client-secret"
}

Only one password provider can exist; creating a second one fails.

Update Provider

Endpoint: PUT /api/auth/providers/{id}

Permission: Admin user role

The body must include expected_configuration_version (returned by the read endpoints). If another administrator changed the provider in the meantime, the update fails with a conflict and you reload the provider first. Disabling a provider is an update with "enabled": false.

Delete Provider

Endpoint: DELETE /api/auth/providers/{id}

Permission: Admin user role

Fails with a conflict while users are still associated with the provider, or, once the deployment uses the new authentication mode, when it is the last enabled provider.

Preview Metadata (Discovery)

Endpoint: POST /api/auth/providers/oidc/discover and POST /api/auth/providers/saml2/discover

Permission: Admin user role

Fetches the identity provider's discovery document or SAML metadata and returns the values that would be filled in, without saving anything.

Run Diagnostics

Endpoint: POST /api/auth/providers/{id}/diagnose (saved provider) and POST /api/auth/providers/diagnose (unsaved configuration)

Permission: Admin user role

Returns the list of checks with a pass, fail, warning, or skipped status each, plus an overall status. Not supported for the password provider type.

Google Workspace Authorization

Endpoint: POST /api/auth/providers/{id}/google-workspace/authorize, POST /api/auth/providers/{id}/google-workspace/verify, and DELETE /api/auth/providers/{id}/google-workspace/authorization

Permission: Admin user role

Starts, verifies, and removes the Google Workspace administrator authorization used to fetch group membership. The authorization link returned by the authorize endpoint is single-use and short-lived.

Link Approvals

List Pending Links

Endpoint: GET /api/auth/links/pending

Permission: Admin user role

Each pending request carries the requester's account, the provider, the subject identifier reported by the identity provider, the trust evidence (verified email, allowed domain, signed assertion), and the request time.

Approve or Reject a Link

Endpoint: POST /api/auth/links/{id}/approve and POST /api/auth/links/{id}/reject

Permission: Admin user role

Approval works on a pending request and also on one that was previously rejected, so a rejection can be reversed. Rejection works only on a pending request.

Remove a Link

Endpoint: DELETE /api/auth/links/{id}

Permission: Admin user role

Removes the link between an account and a provider, whatever its state. Use it to clear a mistaken rejection or a pre-created link: the person's next sign-in through that provider starts the linking flow again, following the provider's current linking settings.

Bulk Approve

Endpoint: POST /api/auth/links/bulk-approve

Permission: Admin user role

Approves pending links by ID list or for an entire provider.

Pre-Create Links Before the Switch

Endpoint: POST /api/auth/providers/{id}/backfill-links

Permission: Admin user role

Pre-creates approved links between existing users and an OIDC or SAML provider, so existing users do not land in the approval queue when the deployment switches to the new authentication mode. Runs as a dry run by default; DELETE /api/auth/providers/{id}/backfill-links removes unused pre-created links.

Sign-In Log

List Auth Events

Endpoint: GET /api/auth/audit

Permission: Admin user role

Query Parameters:

Events are sortable by timestamp, event type, and outcome. Each event includes the user, provider, IP address, outcome, and a details object; secrets are masked.

Sign-In (Public Endpoints)

These endpoints serve the sign-in page itself and require no authentication: