✨ Retrieve SAML2 Settings

GET

http://localhost:8000/api/saml/settings

GET

/api/saml/settings

curl http://localhost:8000/api/saml/settings \
     -H "Authorization: Token  <api_key>"

200response

{
  "acs_url": "http://localhost:8000/saml/saml-token-example/acs",
  "login_url": "http://localhost:8000/saml/saml-token-example/login",
  "logout_url": "http://localhost:8000/saml/saml-token-example/logout",
  "metadata_xml_url": null,
  "nameid_format": "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
  "user_type_capacities": {},
  "domain": "example.com",
  "idp_provider": null,
  "manual_role_management": null,
  "mapping_email": "Email",
  "mapping_first_name": "FirstName",
  "mapping_groups": "Groups",
  "mapping_last_name": "LastName",
  "metadata_url": "",
  "metadata_xml": "",
  "projects_groups": [
    {
      "group": "groups_test",
      "project_id": 42,
      "role": "Inherit"
    }
  ],
  "roles_groups": [
    [
      "Administrator",
      "groups_test"
    ]
  ],
  "token": "saml-token-example",
  "workspaces_groups": [
    [
      "Default workspace",
      "groups_test"
    ]
  ]
}

This endpoint is not available in Label Studio Community Edition. Learn more about Label Studio Enterprise

Retrieve SAML2 settings for the currently active organization.

Authentication

AuthorizationToken

The token (or API key) must be passed as a request header. You can find your user token on the User Account page in Label Studio. Example:

curl https://label-studio-host/api/projects -H “Authorization: Token [your-token]”

Response

acs_urlstring or nullRead-only

login_urlstring or nullRead-only

logout_urlstring or nullRead-only

metadata_xml_urlstring or nullRead-only

nameid_formatstringRead-only

user_type_capacitiesmap from strings to maps from strings to anyRead-only

Live seat usage and limits by seat type (Standard, View Only, Flex).

domainstringOptional3-65536 characters

Organization web domain or domains; use comma separated list with no spaces for multiple. Example:

labelstud.io,humansignal.com

IMPORTANT: DO NOT PUT COMMON DOMAINS LIKE GMAIL.COM, YAHOO.COM, ETC. IN THIS FIELD

idp_providerstring or nullOptional<=256 characters

Identity Provider preset key (e.g. okta, azure, google, custom)

manual_role_managementboolean or nullOptional

Allow manually assigning organization roles instead of IdP-managed groups. None = use billing default.

mapping_emailstring or nullOptional1-1024 characters

Mapping attributes: user email from SAML request

mapping_first_namestring or nullOptional<=1024 characters

Mapping attributes: user first name from SAML request

mapping_groupsstring or nullOptional<=1024 characters

Mapping attributes: groups attribute for user mapping to workspaces and roles

mapping_last_namestring or nullOptional<=1024 characters

Mapping attributes: user last name from SAML request

metadata_urlstringOptional<=65536 characters

URL SAML metadata from IdP

metadata_xmlstringOptional

Metadata XML file

projects_groupslist of objects or nullOptional

Projects to Groups Mapping. List of objects with project_id, group, role.

roles_groupslist of lists of strings or nullOptional

Organization Roles to Groups Mapping. List of [role_name, group_name] pairs.

tokenstringOptional<=256 characters

user_type_groupslist of lists of strings or nullOptional

Seat Types to Groups Mapping. List of [seat_type, group_name] pairs.

workspaces_groupslist of lists of strings or nullOptional

Workspaces to Groups Mapping. List of [workspace_title, group_name] pairs.