Sundaysky Authentication

generated: '2026-08-13'
method: searched
source: https://help.sundaysky.com/hc/en-us/articles/6000894076957-Using-the-SundaySky-API-to-Connect-Data
docs: https://help.sundaysky.com/hc/en-us/articles/27307608733981-Enabling-Single-Sign-On-SSO-for-Your-SundaySky-Account
note: >-
  SundaySky publishes no OpenAPI, so no securitySchemes could be derived
  mechanically (derive-authentication.py returned 0 profiles). This profile is
  read from the provider's own help-center documentation and confirmed against a
  live probe of the documented endpoint.

summary:
  types:
  - none
  - saml
  api_key_in: []
  oauth2_flows: []
  oauth2_supported: false
  oauth2_note: >-
    SundaySky states explicitly that OAuth is not supported for platform
    authentication. No scopes/ artifact is emitted for this provider.

schemes:
- name: video-id-capability-url
  surface: api
  type: none
  applies_to: https://apis.sundaysky.com/get-video/player-session/{sundayskyVideoId}
  description: >-
    The SundaySky Video API documents no Authorization header, API key, or token.
    The only credential in the documented request is the SundaySky Video ID
    embedded in the URL path — a capability URL. The endpoint is designed to be
    called from a page or server that already holds the video's embed snippet,
    and the account is resolved server-side from the video ID.
  documented_headers:
  - name: Content-Type
    required: true
    value: application/json
  - name: User-Agent
    required: false
    description: >-
      Optional. Lets SundaySky determine the viewer's operating system, device
      type, and browser type for correct rendering and analytics attribution.
  evidence:
  - kind: docs
    url: https://help.sundaysky.com/hc/en-us/articles/6000894076957-Using-the-SundaySky-API-to-Connect-Data
    note: >-
      The article's "Getting the API URL" section lists Headers as Mandatory
      (Content-Type) and Optional (User-Agent) only — no auth header is documented.
  - kind: probe
    url: https://apis.sundaysky.com/get-video/player-session/00000000
    http_status: 500
    fetched: '2026-08-13'
    note: >-
      An unauthenticated POST reaches application logic rather than being
      rejected at an auth boundary — the response is a parameter-validation
      error naming accountId/programId/service/stage, not a 401/403. This
      confirms no bearer credential is required on this route.

- name: saml-sso
  surface: platform
  type: saml
  version: SAML 2.0
  description: >-
    Single Sign-On to the SundaySky platform (Studio, Video Page, Analytics) via
    the customer's own Identity Provider. SundaySky acts as the Service Provider
    and supplies a SAML XML metadata file containing its entity ID, public
    certificate, and login/redirect URL. The customer returns their IdP SSO URL
    and X.509 certificate, or an IdP metadata endpoint URL.
  provisioning: manual
  provisioning_note: >-
    SSO is used for authentication only; it does not provision users. All users
    must be created manually in the platform by an Account owner and assigned a
    user type before they can log in via SSO.
  availability: >-
    Plan-dependent — included on some plans, offered as a paid add-on on others.
    Enabled by SundaySky on request via the customer's Success Manager, not
    self-service.
  docs: https://help.sundaysky.com/hc/en-us/articles/27307608733981-Enabling-Single-Sign-On-SSO-for-Your-SundaySky-Account

- name: password
  surface: platform
  type: password
  description: >-
    Username and password login at https://app.sundaysky.com/ for accounts not
    configured for SSO, with a self-service password reset flow.
  docs: https://help.sundaysky.com/hc/en-us/articles/7302748637597-If-You-Forgot-Your-Password

not_supported:
- protocol: oauth2
  evidence: >-
    "SundaySky supports identity providers that use the SAML 2.0 protocol for
    authentication. OAuth is not currently supported." — Enabling Single Sign-On
    (SSO) for Your SundaySky Account, retrieved 2026-08-13.
- protocol: openid-connect
  evidence: >-
    No OIDC discovery document is served. /.well-known/openid-configuration
    returns 404 on sundaysky.com and 403 on apis.sundaysky.com; the 200 observed
    on app./studio. is an SPA catch-all HTML shell, not a document. See
    well-known/sundaysky-well-known.yml.