Initiate enterprise OAuth (OIDC SSO) authorization
Start an enterprise OIDC SSO flow. The connection is resolved either
from the user’s email domain (which must match exactly one enabled
connection’s email_domain_allowlist) or from an explicit
connection_id; provide exactly one. The provider is derived from the
connection, so no provider path segment is needed. Returns the
authorization URL to redirect the user to. The IdP callback reuses the
per-provider callback endpoint, disambiguated by the connection carried
on the flow state.
Body
Provide exactly one of email or connection_id.
PKCE code challenge (S256) bound to the eventual login finalize.
"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
The email whose domain resolves the enterprise connection.
"jane@acme.com"
Addresses an enterprise connection directly. Accepts a bare id (ocon_…) or an oidc:-prefixed form.
"ocon_01jqebhswje1ka1z7ahr9rfsgt"
URI to redirect to after authentication. Must be allowlisted for the app. Falls back to the connection's default_redirect_uri when omitted.
"https://app.acme.com/callback"
S256 "S256"
The identifier of the dispatch from the front-end SDK.
"123e4567-e89b-12d3-a456-426614174000"
Response
OK
The URL to redirect the user to for OAuth authorization.
"https://accounts.google.com/o/oauth2/v2/auth?client_id=...&redirect_uri=...&scope=openid+email&state=..."