Fetches and parses a SAML identity provider (IdP) metadata document from a URL. It returns the IdP certificate, sign-in URL, sign-out URL, and identifier format when those values are available in the metadata.
The Import IdP metadata button at the top of Manage > Workspace > Settings > SAML uses this endpoint to prefill the corresponding SAML settings. The imported values can be reviewed and edited before they are saved. This endpoint does not save or change any workspace settings.
The metadata request is subject to SSRF protection and the workspace's SSRF allowlist. It has a 20-second timeout and a 1 MB response-size limit.
Permission required:
test-admin-options
Changelog
| Version | Description |
|---|---|
| 8.8.0 | Added |
The authenticated user token.
The authenticated user ID.
{
"url": "https://idp.example.com/metadata"
}The URL of the SAML IdP metadata document.
The metadata was parsed successfully.
{
"entryPoint": "https://idp.example.com/sso/saml",
"idpSLORedirectURL": "https://idp.example.com/slo/saml",
"cert": "-----BEGIN CERTIFICATE-----\nMIIDdzCCAl+gAwIBAgIEXAMPLEONLY\n-----END CERTIFICATE-----",
"identifierFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
"warnings": [],
"success": true
}The IdP URL where Rocket.Chat sends SAML sign-in requests.
The IdP URL where Rocket.Chat sends SAML sign-out requests.
The IdP signing certificate in PEM format.
The first SAML NameID format found in the metadata. The SAML settings page applies this value when the Enterprise-only Identifier Format setting is available.
Warnings about missing or multiple usable values in the metadata.
The request is invalid, the metadata cannot be fetched or parsed, or the URL is blocked.
{
"success": false,
"error": "SAML_Metadata_url_blocked"
}{
"success": false,
"error": "SAML_Metadata_fetch_failed"
}{
"success": false,
"error": "SAML_Metadata_too_large"
}{
"success": false,
"error": "SAML_Metadata_invalid"
}Unauthorized
{
"status": "error",
"message": "You must be logged in to do this."
}Forbidden
{
"success": false,
"error": "User does not have the permissions required for this action [error-unauthorized]"
}