SSO, SCIM and licences

Single sign-on providers, SCIM provisioning, forward auth for protected apps and the Enterprise licence.

Sign people in with your identity provider, provision them with SCIM, and put apps behind Cloudgate sign-in with forward auth. On a Self-hosted instance, the Enterprise licence routes activate and check your licence key.

Every request goes to https://cloudgate.octabyte.app/backend on the Hosted instance, or to your console address followed by /backend when you self-host. Send a Personal key in x-api-key and the Organization in x-organization-id; Authentication shows how to make the key, and Errors explains every refusal. The examples setCLOUDGATE_KEY and CLOUDGATE_ORG_ID in the shell first. To do the same in the console, read SSO and SCIM in the user guide.

Single sign-on

GET/sso/show-sign-in

Who can call it: Public: no key needed.

Responses

200 OK: The result, as JSON.

curl https://cloudgate.octabyte.app/backend/sso/show-sign-in

Get SSO enforcement

GET/sso/enforce

Who can call it: Public: no key needed.

Responses

200 OK: The result, as JSON.

curl https://cloudgate.octabyte.app/backend/sso/enforce

Set SSO enforcement

PATCH/sso/enforce

Sets the instance's enforceSSO flag.

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Request body

Field	Type	Notes
`enforceSSO`required	boolean

Responses

200 OK: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X PATCH https://cloudgate.octabyte.app/backend/sso/enforce \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID" \
  -H "content-type: application/json" \
  -d '{
    "enforceSSO": true
  }'

Get the OIDC redirect URI

GET/sso/redirect-uri

The OIDC redirect URI, with {providerId} still in it — the console needs it on the Add dialog, where no provider exists yet.

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl https://cloudgate.octabyte.app/backend/sso/redirect-uri \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

List SSO providers

GET/sso/providers

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl https://cloudgate.octabyte.app/backend/sso/providers \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Register an SSO provider

POST/sso/providers

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Request body

Field	Type	Notes
`providerId`required	string	Not empty.
`issuer`required	string (uri)
`domains`required	array of string	At least 1 item.
`oidcConfig`	object
`oidcConfig.clientId`required	string	Not empty.
`oidcConfig.clientSecret`required	string	Not empty.
`oidcConfig.authorizationEndpoint`	string (uri)
`oidcConfig.tokenEndpoint`	string (uri)
`oidcConfig.userInfoEndpoint`	string (uri)
`oidcConfig.tokenEndpointAuthentication`	string	One of `client_secret_post`, `client_secret_basic`.
`oidcConfig.jwksEndpoint`	string (uri)
`oidcConfig.discoveryEndpoint`	string (uri)
`oidcConfig.skipDiscovery`	boolean
`oidcConfig.scopes`	array of string
`oidcConfig.pkce`	boolean
`oidcConfig.mapping`	object
`oidcConfig.mapping.id`required	string
`oidcConfig.mapping.email`required	string
`oidcConfig.mapping.emailVerified`	string
`oidcConfig.mapping.name`required	string
`oidcConfig.mapping.image`	string
`oidcConfig.mapping.extraFields`	map of any
`overrideUserInfo`	boolean
`trustIssuer`	boolean

Responses

201 Created: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X POST https://cloudgate.octabyte.app/backend/sso/providers \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID" \
  -H "content-type: application/json" \
  -d '{
    "providerId": "fT4CVKXvPHz5tQz5Jp5VA",
    "issuer": "https://northwind.dev",
    "domains": [
      "shop.northwind.dev"
    ]
  }'

Get trusted origins

GET/sso/trusted-origins

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl https://cloudgate.octabyte.app/backend/sso/trusted-origins \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Add trusted origin

POST/sso/trusted-origins

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Request body

Field	Type	Notes
`origin`required	string	Not empty.

Responses

200 OK: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X POST https://cloudgate.octabyte.app/backend/sso/trusted-origins \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID" \
  -H "content-type: application/json" \
  -d '{
    "origin": "example"
  }'

Update trusted origin

PUT/sso/trusted-origins

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Request body

Field	Type	Notes
`oldOrigin`required	string	Not empty.
`newOrigin`required	string	Not empty.

Responses

200 OK: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X PUT https://cloudgate.octabyte.app/backend/sso/trusted-origins \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID" \
  -H "content-type: application/json" \
  -d '{
    "oldOrigin": "example",
    "newOrigin": "example"
  }'

Remove trusted origin

DELETE/sso/trusted-origins

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Request body

Field	Type	Notes
`origin`required	string	Not empty.

Responses

200 OK: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X DELETE https://cloudgate.octabyte.app/backend/sso/trusted-origins \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID" \
  -H "content-type: application/json" \
  -d '{
    "origin": "example"
  }'

Get an SSO provider

GET/sso/providers/{providerId}

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Parameters

Name	In	Type	Notes
`providerId`required	path	string	The provider's id.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches; 404 Nothing with that id in this Organization. The error body.

curl https://cloudgate.octabyte.app/backend/sso/providers/fT4CVKXvPHz5tQz5Jp5VA \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Update an SSO provider

PUT/sso/providers/{providerId}

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Parameters

Name	In	Type	Notes
`providerId`required	path	string	The provider's id.

Request body

Field	Type	Notes
`providerId`required	string	Not empty.
`issuer`required	string (uri)
`domains`required	array of string	At least 1 item.
`oidcConfig`	object
`oidcConfig.clientId`required	string	Not empty.
`oidcConfig.clientSecret`required	string	Not empty.
`oidcConfig.authorizationEndpoint`	string (uri)
`oidcConfig.tokenEndpoint`	string (uri)
`oidcConfig.userInfoEndpoint`	string (uri)
`oidcConfig.tokenEndpointAuthentication`	string	One of `client_secret_post`, `client_secret_basic`.
`oidcConfig.jwksEndpoint`	string (uri)
`oidcConfig.discoveryEndpoint`	string (uri)
`oidcConfig.skipDiscovery`	boolean
`oidcConfig.scopes`	array of string
`oidcConfig.pkce`	boolean
`oidcConfig.mapping`	object
`oidcConfig.mapping.id`required	string
`oidcConfig.mapping.email`required	string
`oidcConfig.mapping.emailVerified`	string
`oidcConfig.mapping.name`required	string
`oidcConfig.mapping.image`	string
`oidcConfig.mapping.extraFields`	map of any
`overrideUserInfo`	boolean

Responses

200 OK: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches; 404 Nothing with that id in this Organization. The error body.

curl -X PUT https://cloudgate.octabyte.app/backend/sso/providers/fT4CVKXvPHz5tQz5Jp5VA \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID" \
  -H "content-type: application/json" \
  -d '{
    "providerId": "fT4CVKXvPHz5tQz5Jp5VA",
    "issuer": "https://northwind.dev",
    "domains": [
      "shop.northwind.dev"
    ]
  }'

Delete an SSO provider

DELETE/sso/providers/{providerId}

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Parameters

Name	In	Type	Notes
`providerId`required	path	string	The provider's id.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches; 404 Nothing with that id in this Organization. The error body.

curl -X DELETE https://cloudgate.octabyte.app/backend/sso/providers/fT4CVKXvPHz5tQz5Jp5VA \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

List proven domains

GET/sso/proven-domains

Proven domains, Hosted only. The domain is the key: one per Organization, and it is what the owner types and publishes a record for.

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl https://cloudgate.octabyte.app/backend/sso/proven-domains \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Add proven domain

POST/sso/proven-domains

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Request body

Field	Type	Notes
`domain`required	string

Responses

201 Created: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X POST https://cloudgate.octabyte.app/backend/sso/proven-domains \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID" \
  -H "content-type: application/json" \
  -d '{
    "domain": "shop.northwind.dev"
  }'

Check proven domain

POST/sso/proven-domains/{domain}/check

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Parameters

Name	In	Type	Notes
`domain`required	path	string	Domain.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches; 404 Nothing with that id in this Organization. The error body.

curl -X POST https://cloudgate.octabyte.app/backend/sso/proven-domains/northwind.dev/check \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Remove proven domain

DELETE/sso/proven-domains/{domain}

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Parameters

Name	In	Type	Notes
`domain`required	path	string	Domain.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches; 404 Nothing with that id in this Organization. The error body.

curl -X DELETE https://cloudgate.octabyte.app/backend/sso/proven-domains/northwind.dev \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

SCIM

List SCIM providers

GET/scim/providers

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl https://cloudgate.octabyte.app/backend/scim/providers \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Generate a SCIM token

POST/scim/providers

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Request body

Field	Type	Notes
`providerId`required	string	1 to 64 characters. Matches `^[a-z0-9][a-z0-9-]*$`.

Responses

201 Created: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X POST https://cloudgate.octabyte.app/backend/scim/providers \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID" \
  -H "content-type: application/json" \
  -d '{
    "providerId": "fT4CVKXvPHz5tQz5Jp5VA"
  }'

Delete a SCIM provider

DELETE/scim/providers/{providerId}

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Parameters

Name	In	Type	Notes
`providerId`required	path	string	The provider's id.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches; 404 Nothing with that id in this Organization. The error body.

curl -X DELETE https://cloudgate.octabyte.app/backend/scim/providers/fT4CVKXvPHz5tQz5Jp5VA \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Forward auth

Get auth domain

GET/forward-auth/settings

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Parameters

Name	In	Type	Notes
`serverId`	query	string or null	Not empty. Default `null`.

Responses

200 OK: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl https://cloudgate.octabyte.app/backend/forward-auth/settings \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Set auth domain

PUT/forward-auth/settings

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Request body

Field	Type	Notes
`serverId`	string or null	Not empty. Default `null`.
`authDomain`required	string
`https`	boolean	Default `true`.
`certificateType`	string	One of `none`, `letsencrypt`, `custom`. Default `"letsencrypt"`.
`customCertResolver`	string

Responses

200 OK: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X PUT https://cloudgate.octabyte.app/backend/forward-auth/settings \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID" \
  -H "content-type: application/json" \
  -d '{
    "authDomain": "shop.northwind.dev"
  }'

Remove auth domain

DELETE/forward-auth/settings

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Parameters

Name	In	Type	Notes
`serverId`	query	string or null	Not empty. Default `null`.

Responses

200 OK: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X DELETE https://cloudgate.octabyte.app/backend/forward-auth/settings \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

List forward-auth providers

GET/forward-auth/providers

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl https://cloudgate.octabyte.app/backend/forward-auth/providers \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Server status

GET/forward-auth/servers

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl https://cloudgate.octabyte.app/backend/forward-auth/servers \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Deploy on server

POST/forward-auth/proxy

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Request body

Field	Type	Notes
`serverId`	string or null	Not empty. Default `null`.
`providerId`required	string	Not empty.

Responses

200 OK: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X POST https://cloudgate.octabyte.app/backend/forward-auth/proxy \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID" \
  -H "content-type: application/json" \
  -d '{
    "providerId": "fT4CVKXvPHz5tQz5Jp5VA"
  }'

Remove on server

DELETE/forward-auth/proxy

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Parameters

Name	In	Type	Notes
`serverId`	query	string or null	Not empty. Default `null`.

Responses

200 OK: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X DELETE https://cloudgate.octabyte.app/backend/forward-auth/proxy \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Get domain status

GET/forward-auth/domains/{domainId}

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Parameters

Name	In	Type	Notes
`domainId`required	path	string	The Domain's id.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches; 404 Nothing with that id in this Organization. The error body.

curl https://cloudgate.octabyte.app/backend/forward-auth/domains/6MZy6JYxZ28Cxm9jWJgGj \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Enable on domain

POST/forward-auth/domains/{domainId}/enable

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Parameters

Name	In	Type	Notes
`domainId`required	path	string	The Domain's id.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches; 404 Nothing with that id in this Organization. The error body.

curl -X POST https://cloudgate.octabyte.app/backend/forward-auth/domains/6MZy6JYxZ28Cxm9jWJgGj/enable \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Disable on domain

POST/forward-auth/domains/{domainId}/disable

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Parameters

Name	In	Type	Notes
`domainId`required	path	string	The Domain's id.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches; 404 Nothing with that id in this Organization. The error body.

curl -X POST https://cloudgate.octabyte.app/backend/forward-auth/domains/6MZy6JYxZ28Cxm9jWJgGj/disable \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Licence

Get licence status

GET/license/status

Whether the organization is licensed (licensed), with the stored state that produced the answer, so a console can warn before an expiry and tell a refused license from a missing one.

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl https://cloudgate.octabyte.app/backend/license/status \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Get enterprise settings

GET/license/settings

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl https://cloudgate.octabyte.app/backend/license/settings \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Update enterprise settings

PATCH/license/settings

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Request body

Field	Type	Notes
`enableEnterpriseFeatures`required	boolean

Responses

200 OK: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X PATCH https://cloudgate.octabyte.app/backend/license/settings \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID" \
  -H "content-type: application/json" \
  -d '{
    "enableEnterpriseFeatures": true
  }'

Activate a licence

POST/license/activate

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Request body

Field	Type	Notes
`licenseKey`required	string	Not empty.

Responses

200 OK: The result, as JSON.
Refusals: 400 Validation failed; details names each field; 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X POST https://cloudgate.octabyte.app/backend/license/activate \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID" \
  -H "content-type: application/json" \
  -d '{
    "licenseKey": "<secret>"
  }'

Validate a licence key

POST/license/validate

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X POST https://cloudgate.octabyte.app/backend/license/validate \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Check the licence now

POST/license/check-now

"I've renewed, check now": re-activates the stored key, answering with the license status that results.

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X POST https://cloudgate.octabyte.app/backend/license/check-now \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Deactivate the licence

POST/license/deactivate

Who can call it: Any signed-in member. The route names no permission of its own; Cloudgate checks your role and your access to what it touches as it runs.

Responses

200 OK: The result, as JSON.
Refusals: 401 No key, or the key is not valid; 403 You may not reach what it touches. The error body.

curl -X POST https://cloudgate.octabyte.app/backend/license/deactivate \
  -H "x-api-key: $CLOUDGATE_KEY" \
  -H "x-organization-id: $CLOUDGATE_ORG_ID"

Something missing or wrong on this page? Email support@octabyte.io, or start a free trial and try it in the console.

Single sign-on

Check whether SSO sign-in shows

Responses

Get SSO enforcement

Responses

Set SSO enforcement

Request body

Responses

Get the OIDC redirect URI

Responses

List SSO providers

Responses

Register an SSO provider

Request body

Responses

Get trusted origins

Responses

Add trusted origin

Request body

Responses

Update trusted origin

Request body

Responses

Remove trusted origin

Request body

Responses

Get an SSO provider

Parameters

Responses

Update an SSO provider

Parameters

Request body

Responses

Delete an SSO provider

Parameters

Responses

List proven domains

Responses

Add proven domain

Request body

Responses

Check proven domain

Parameters

Responses

Remove proven domain

Parameters

Responses

SCIM

List SCIM providers

Responses

Generate a SCIM token

Request body

Responses

Delete a SCIM provider

Parameters

Responses

Forward auth

Get auth domain

Parameters

Responses

Set auth domain

Request body

Responses

Remove auth domain

Parameters

Responses

List forward-auth providers

Responses

Server status

Responses

Deploy on server

Request body

Responses

Remove on server

Parameters

Responses

Get domain status

Parameters

Responses

Enable on domain