Clerk SAML API

openapi: 3.2.0
info:
  title: Clerk Frontend SAML API
  version: v1
  description: The Clerk REST Frontend API, meant to be accessed from a browser or native environment.
  x-logo:
    url: https://clerk.com/_next/image?url=%2Fimages%2Fclerk-logo.svg&w=96&q=75
    altText: Clerk docs
    href: https://clerk.com/docs
  contact:
    email: support@clerk.com
    name: Clerk Team
    url: https://clerk.com/support
  termsOfService: https://clerk.com/terms
  license:
    name: MIT
    url: https://github.com/clerk/javascript/blob/main/LICENSE
servers:
- url: https://{domain}.clerk.accounts.dev
  variables:
    domain:
      default: example-destined-camel-13
      description: Your Development Instance Frontend API Domain.
security:
- {}
- DevBrowser: []
- ProductionBrowser: []
- ProductionNativeApp: []
  ProductionNativeFlag: []
tags:
- name: SAML
  description: Used in authentication flows using SAML.
paths:
  /v1/saml/metadata/{saml_connection_id}.xml:
    get:
      summary: SAML Metadata
      description: The Service Provider's SAML metadata
      operationId: samlMetadata
      security:
      - {}
      - DevBrowser: []
      tags:
      - SAML
      parameters:
      - in: path
        name: saml_connection_id
        required: true
        schema:
          type: string
        description: The ID of the SAML Connection
      responses:
        '200':
          description: OK
        '400':
          $ref: '#/components/responses/ClerkErrors'
        '404':
          $ref: '#/components/responses/ClerkErrors'
  /v1/saml/acs/{saml_connection_id}:
    post:
      summary: SAML ACS
      description: The SAML Assertion Consumer Service (ACS) endpoint, which processes SAML Responses by the IdP.
      operationId: acs
      security:
      - {}
      - DevBrowser: []
      tags:
      - SAML
      parameters:
      - in: path
        name: saml_connection_id
        required: true
        schema:
          type: string
        description: The ID of the SAML Connection
      responses:
        '302':
          description: OK
        '303':
          description: OK
        '400':
          $ref: '#/components/responses/ClerkErrors'
        '401':
          $ref: '#/components/responses/ClerkErrors'
        '403':
          $ref: '#/components/responses/ClerkErrors'
        '404':
          $ref: '#/components/responses/ClerkErrors'
components:
  schemas:
    ClerkErrors:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ClerkError'
        meta:
          type: object
        clerk_trace_id:
          type: string
      required:
      - errors
    ClerkError:
      type: object
      properties:
        message:
          type: string
        long_message:
          type: string
        code:
          type: string
        meta:
          type: object
      required:
      - message
      - long_message
      - code
  responses:
    ClerkErrors:
      description: Request was not successful
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ClerkErrors'
  securitySchemes:
    ProductionBrowser:
      type: apiKey
      in: cookie
      name: __client
      description: 'The Client API token sent in the form of a browser cookie.


        Used to authenticate production browser applications.'
    DevBrowser:
      type: apiKey
      in: query
      name: __dev_session
      description: 'A Dev Browser API token sent as a query parameter.


        Used to authenticate only dev instances.


        To generate a dev instance API token you must first make a request to `/v1/dev_browser`

        and copy it from the response.'
    ProductionNativeApp:
      type: http
      scheme: bearer
      description: 'The Client API token sent in the `Authorization` header.


        Used to authenticate native applications.'
    ProductionNativeFlag:
      type: apiKey
      in: query
      name: _is_native
      description: 'If sent and the value is true, it instructs the server to parse the API token from the `Authorization` header.


        It should always be set to true when using the `Authorization` header authentication strategy.'
    ClientCredentials:
      type: http
      scheme: basic
      description: HTTP Basic Authentication using Client ID as username and Client Secret as password.
x-tagGroups:
- name: Environment
  tags:
  - Environment
- name: Client
  tags:
  - Client
  - Sessions
  - Sign Ins
  - Sign Ups
- name: User
  tags:
  - User
  - Active Sessions
  - Email Addresses
  - Phone Numbers
  - Web3 Wallets
  - Passkeys
  - External Accounts
  - TOTP
  - Backup Codes
  - Organizations Memberships
  - API Keys
- name: Organizations
  tags:
  - Organization
  - Organization Creation Defaults
  - Invitations
  - Membership Requests
  - Members
  - Domains
  - Roles
- name: Billing
  tags:
  - Plans
  - Subscriptions
  - Subscription Items
  - Checkouts
  - Payment Methods
  - Statements
  - Payment Attempts
- name: Other
  tags:
  - Well Known
  - DevBrowser
  - DevTools
  - Health
  - OAuth2 Identity Provider
  - OAuth2 Callbacks
  - SAML
  - Waitlist
  - Enterprise Connections