SSO

DriftWise authenticates every user through OIDC today. Self-service SAML 2.0 Single Sign-On — configure your own IdP (Okta, Azure AD, Google Workspace, etc.) without any DriftWise operator involvement — is coming soon. For endpoint shapes see the sso tag of the API reference.

Current state

• GET /orgs/:id/sso-config — always returns {"enabled": false, "configured": false} on plans that include the SSO feature (Team and Enterprise). Free-plan orgs get 402 Payment Required.
• PUT /orgs/:id/sso-config — requires OIDC authentication with owner or admin role (API keys are rejected outright, so the change is always attributable to a specific human) and, once the role and plan gates pass, returns 503 Service Unavailable. There is no way to configure a SAML IdP yet.

Both endpoints are live today. The GET is gated by org membership and plan; the PUT additionally requires an OIDC owner/admin role. Only the underlying SAML configuration capability is not yet built.

What's coming

When self-service SAML SSO ships, an org admin will be able to:

1. Get their DriftWise-hosted ACS URL and SP Entity ID from the Settings > SSO panel — no request to DriftWise required.
2. Point their identity provider's SAML app at those values.
3. Save their IdP's metadata URL and entity ID in DriftWise, which takes effect immediately for future logins.

Every value a customer needs will be rendered directly in the dashboard, consistent with DriftWise's self-service model — see the Self-Service Constraint in the project conventions. There is no "contact us to enable SSO" step planned.

Plan requirements

SSO is gated to the Team and Enterprise plans today, ahead of the feature itself shipping, so the plan check is already in its final shape. Requests to SSO endpoints on the Free plan return 402 Payment Required with the canonical PaymentRequiredResponse body.

Endpoint reference

SSO config endpoints are under the sso tag of the API reference.