SSO

Updated Oct 18, 2026

Log in to Asqav through your identity provider via SAML 2.0. Business and Enterprise tiers. Works with Okta, Azure AD / Entra, Google Workspace, OneLogin, and any SAML 2.0 compliant IdP.

Service provider URLs

Every Business and Enterprise organization has a dedicated SP endpoint. Replace {org_id} with your organization id (shown in Settings).

Parameter	Value
SP Entity ID	`https://www.asqav.com/saml/{org_id}`
ACS URL	`https://api.asqav.com/api/v1/saml/{org_id}/acs`
SP Metadata	`https://api.asqav.com/api/v1/saml/{org_id}/metadata`
Login URL	`https://api.asqav.com/api/v1/saml/{org_id}/login`
Name ID format	`emailAddress`
Binding	HTTP-POST

Identity provider setup

Create a SAML app in your IdP. Configure:

Single Sign-On URL: the ACS URL above
Audience / Entity ID: the SP Entity ID above
Name ID format: EmailAddress
Attribute mapping: send at minimum email (mandatory) and name (optional). Common claim URIs like http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress are auto-detected.

Download the IdP metadata XML and extract the SSO URL, entity id, and X.509 certificate (PEM).

Register the config with Asqav

bash

curl -X POST https://api.asqav.com/api/v1/saml \
  -H "X-API-Key: sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "idp_entity_id": "https://idp.example.com/saml",
    "idp_sso_url": "https://idp.example.com/sso",
    "idp_x509_cert": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----",
    "attribute_mapping": {"email": "email", "name": "displayName"},
    "require_encrypted_assertion": false
  }'

To inspect or update the configuration later:

bash

GET    /api/v1/saml
PATCH  /api/v1/saml
DELETE /api/v1/saml

Login flow

Send users to /api/v1/saml/{org_id}/login. Asqav redirects to your IdP. On success the IdP posts the assertion to the ACS URL, Asqav creates or links the user to your organization, and issues session cookies.

IdP-initiated login

Off by default. Set allow_idp_initiated to true in the config if your IdP pushes assertions directly. SP-initiated flow is recommended for most deployments.

Identity provisioning

Provisioning is just-in-time on first assertion: when the IdP asserts an email Asqav has never seen, Asqav creates the user and adds them to your organization in the same step - no invite, no pre-registration. An assertion for an email that already belongs to a different organization is refused with a 403 and no session is issued.

SCIM is not supported today; all provisioning flows through the SAML assertion described above.

Verification

After configuring, open an incognito window and hit the login URL. A successful round trip lands you in the Asqav dashboard with a user provisioned from your IdP attributes. Errors are returned on the login page with query params like ?error=saml_failed or ?error=saml_no_email. Check your IdP attribute mapping if you see them.

References

SAML 2.0 Core, OASIS
RFC 7644: SCIM Protocol, IETF