> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# sazabi sso

> Command reference for sazabi sso.

`sazabi sso` — Set up single sign-on. Subcommands: `status`, `domains`, `connect`, `disconnect`, `connection`, `break-glass`, `scim`.

## `sazabi sso`

Set up single sign-on

Claim and verify your email domains, connect your SAML or OIDC identity provider, and test the connection. Turning SSO enforcement on or off and choosing break-glass owners happen only in the dashboard.

```txt theme={"system"}
sazabi sso <subcommand>
```

### `sazabi sso status`

Show the connection, domains and whether SSO is enforced

```txt theme={"system"}
sazabi sso status [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |

### `sazabi sso domains`

Claim and verify SSO domains

```txt theme={"system"}
sazabi sso domains <subcommand>
```

#### `sazabi sso domains list`

List claimed domains

```txt theme={"system"}
sazabi sso domains list [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |

#### `sazabi sso domains claim`

Claim a domain and get its TXT record

```txt theme={"system"}
sazabi sso domains claim <domain> [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |

#### `sazabi sso domains verify`

Look up a claimed domain's TXT record now

```txt theme={"system"}
sazabi sso domains verify <domain> [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |

#### `sazabi sso domains remove`

Remove a claimed domain

```txt theme={"system"}
sazabi sso domains remove <domain> [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |

### `sazabi sso connect`

Connect your SAML or OIDC identity provider

If the organization already has an SSO connection, connect replaces its identity settings.

```txt theme={"system"}
sazabi sso connect [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |
| `--protocol` | string | Yes | saml or oidc |
| `--issuer` | string | No | The identity provider's issuer or entity ID |
| `--client-id` | string | No | OIDC client ID |
| `--client-secret-file` | string | No | File holding the OIDC client secret ('-' reads stdin) |
| `--sso-url` | string | No | SAML SSO URL |
| `--certificate-file` | string | No | PEM file with an IdP signing certificate; repeat once to hold two while rotating |
| `--metadata-url` | string | No | SAML metadata URL to re-fetch, or 'none' to clear it |
| `--default-role` | string | No | Role for new members: member or viewer |
| `--enable-jit` | boolean | No | Add people to the organization at their first SSO sign-in |
| `--disable-jit` | boolean | No | Stop adding people at their first SSO sign-in |
| `--enable-scim-only` | boolean | No | Refuse SSO sign-in to people SCIM never provisioned |
| `--disable-scim-only` | boolean | No | Let people SCIM never provisioned sign in again |
| `--max-session-age` | string | No | Seconds before an SSO session must sign in again, or 'none' |
| `--enable` | boolean | No | Turn the connection on |
| `--disable` | boolean | No | Turn the connection off |

### `sazabi sso disconnect`

Delete the SSO connection and end the access it granted

```txt theme={"system"}
sazabi sso disconnect [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |
| `--yes` | boolean | No | Disconnect without asking for confirmation |

### `sazabi sso connection`

Read and test the SSO connection

```txt theme={"system"}
sazabi sso connection <subcommand>
```

#### `sazabi sso connection get`

Show the connection and what to register with your provider

Includes the service-provider details to register with your identity provider.

```txt theme={"system"}
sazabi sso connection get [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |

#### `sazabi sso connection test`

Sign in through the connection to test it

```txt theme={"system"}
sazabi sso connection test [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |
| `--no-wait` | boolean | No | Print the browser link and exit without waiting |

### `sazabi sso break-glass`

List the owners who can sign in while SSO is enforced

Break-glass owners sign in with an email code and an authenticator while SSO is enforced. Only an owner signed in to the dashboard chooses them.

```txt theme={"system"}
sazabi sso break-glass <subcommand>
```

#### `sazabi sso break-glass list`

List break-glass owners

```txt theme={"system"}
sazabi sso break-glass list [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |

### `sazabi sso scim`

Manage SCIM provisioning

SCIM lets your identity provider add and remove members. Each new token is printed once and never saved.

```txt theme={"system"}
sazabi sso scim <subcommand>
```

#### `sazabi sso scim status`

Show whether SCIM is on or paused, and its tokens

```txt theme={"system"}
sazabi sso scim status [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |

#### `sazabi sso scim enable`

Turn SCIM on and print its first token

```txt theme={"system"}
sazabi sso scim enable [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |
| `--expires-at` | string | No | When the new token stops working (ISO 8601) |

#### `sazabi sso scim rotate-token`

Print a new SCIM token; the old one works 24 hours

```txt theme={"system"}
sazabi sso scim rotate-token [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |
| `--expires-at` | string | No | When the new token stops working (ISO 8601) |

#### `sazabi sso scim disable`

Turn SCIM off and revoke every token

```txt theme={"system"}
sazabi sso scim disable [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |
| `--yes` | boolean | No | Turn SCIM off without asking |

#### `sazabi sso scim pause`

Pause SCIM so it refuses your identity provider's changes

While SCIM is paused, your identity provider's changes are refused and it retries them; reads still work. SCIM also pauses itself when deactivations cross the threshold.

```txt theme={"system"}
sazabi sso scim pause [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |

#### `sazabi sso scim resume`

Resume SCIM after it paused

```txt theme={"system"}
sazabi sso scim resume [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |

#### `sazabi sso scim set-threshold`

Set how many deactivations an hour SCIM allows before it pauses

```txt theme={"system"}
sazabi sso scim set-threshold [count] [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |
| `--default` | boolean | No | Go back to the default threshold, the larger of 10 and 10% of the connection's active SCIM records |

```bash theme={"system"}
sazabi sso scim set-threshold 50
sazabi sso scim set-threshold --default
```

#### `sazabi sso scim list-members`

List members with a SCIM record, including after SCIM is off

Lists every member SCIM provisioned, including after SCIM is turned off or the SSO connection is deleted, so you can review whom to remove by hand.

```txt theme={"system"}
sazabi sso scim list-members [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |
| `--limit` | string | No | Maximum number of members to return (1 to 500) |
| `--cursor` | string | No | Pagination cursor from the previous response |

#### `sazabi sso scim mismatch-report`

List SSO sign-ins without a SCIM record, and unused records

Lists members who signed in with SSO in the last 30 days without a SCIM record, and SCIM records whose user never signed in with SSO. Each group holds at most 500 rows.

```txt theme={"system"}
sazabi sso scim mismatch-report [options]
```

| Flag | Type | Required | Description |
| - | - | - | - |
| `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) |
| `--api-base-url` | string | No | Override API base URL |
| `--json` | boolean | No | Output as JSON |
| `--organization-id` | string | No | Override active organization ID |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.