> ## Documentation Index
> Fetch the complete documentation index at: https://docs.recurso.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Start a SAML Login

> Begin an SP-initiated SAML login by redirecting the browser to the tenant's identity provider.

Begins an SP-initiated SAML login. When the tenant's SSO connection is enabled,
the server builds a SAML `AuthnRequest` and `302`-redirects the browser to the
identity provider's SSO URL. After the user authenticates, the IdP posts the
assertion to
[`POST /auth/saml/{tenantID}/acs`](/api-reference/auth/saml-acs), which opens
the dashboard session.

Navigate a browser to this URL rather than calling it from a server. The SP
details the IdP needs are published at
[`GET /auth/saml/{tenantID}/metadata`](/api-reference/auth/saml-metadata).

## Path Parameters

| Parameter  | Type          | Required | Description                                                            |
| ---------- | ------------- | -------- | ---------------------------------------------------------------------- |
| `tenantID` | string (uuid) | Yes      | The tenant to log in to. Its SSO connection must exist and be enabled. |

## Example Request

```bash theme={null}
curl -i https://api.recurso.dev/auth/saml/d4c3b2a1-0f9e-4765-8321-abcdef012345/login
```

## Example Response

There is no response body. A successful call answers `302 Found` with the IdP
redirect in `Location`:

```http theme={null}
HTTP/1.1 302 Found
Location: https://idp.acme.com/sso/saml?SAMLRequest=rJLNbtswEIRfReBdf9SPIyIS4MYoaiBtjdjtobc1uaoJiKTKXbXJ2xd2UjS5%2BFD0Su5HzszOLYGbZrVe...
```

`SAMLRequest` is the deflated, base64- and URL-encoded `AuthnRequest`
(HTTP-Redirect binding). No `RelayState` is sent: Recurso starts the request
with an empty relay state, and the redirect carries only `SAMLRequest`.

## Errors

| Status | Code             | When                                                                                   | Fix                                                                                          |
| ------ | ---------------- | -------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| `404`  | `not_found`      | `tenantID` is not a valid UUID, or the tenant's SSO connection is missing or disabled. | Enable the tenant's SAML connection in the dashboard, then retry.                            |
| `500`  | `internal_error` | The AuthnRequest could not be built from the stored connection.                        | Re-check the IdP SSO URL and certificate on the connection; if it persists, contact support. |

Errors use the standard envelope — see [Errors](/api-reference/errors).


## OpenAPI

````yaml GET /auth/saml/{tenantID}/login
openapi: 3.1.0
info:
  title: Recurso API
  version: 1.0.0
  description: |
    The Recurso billing engine REST API.

    Authenticate by passing your API key as a bearer token:

        Authorization: Bearer <api_key>

    Obtain an API key by registering a tenant via `POST /auth/register`.
    All authenticated endpoints live under the `/v1` prefix. Mutating
    endpoints support idempotency via the `Idempotency-Key` header.
  license:
    name: MIT
    identifier: MIT
servers:
  - url: https://billing.example.com
    description: >-
      Example deployment — substitute the base URL of your own Recurso
      deployment.
security:
  - bearerAuth: []
tags:
  - name: System
    description: Health, version, and API metadata
  - name: Auth
    description: Tenant registration
  - name: Plans
    description: Product catalog plans
  - name: Customers
    description: Customer management
  - name: Subscriptions
    description: Subscription lifecycle
  - name: Invoices
    description: Invoices, PDFs, and Indian GST e-invoicing
  - name: Coupons
    description: Discounts
  - name: Usage
    description: Metered usage events
  - name: Credit Notes
    description: Customer credits
  - name: Quotes
    description: Quote-to-invoice lifecycle
  - name: Webhooks
    description: Webhook endpoint management and event feed
  - name: Analytics
    description: Revenue analytics
  - name: Checkout
    description: Public hosted checkout for invoices
  - name: Payments
    description: Payment order creation
  - name: Inbound Webhooks
    description: Receivers for payment-gateway callbacks (Razorpay, Stripe)
  - name: Customer Portal
    description: Customer-facing portal — magic-link auth and session-scoped data
  - name: Developer
    description: API key management
  - name: Account
    description: Tenant account settings
  - name: Finance
    description: Ledger accounts, entries, reconciliation, and revenue recognition
  - name: Settings
    description: Tax (GST) and e-invoicing (IRP) configuration
  - name: Consents
    description: Consent records for RBI-compliant recurring billing
  - name: Referrals
    description: Customer referral program
  - name: Gifts
    description: Gift subscriptions
  - name: Mandates
    description: UPI Autopay mandates
  - name: Offline Payments
    description: Virtual accounts and manually recorded payments
  - name: Organizations
    description: Multi-entity organizations grouping several tenants
  - name: Accounting
    description: QuickBooks / Xero accounting integrations
  - name: Churn
    description: Churn risk scoring and alerts
  - name: Cancel Flows
    description: Configurable retention flows shown at cancellation time
  - name: Dunning
    description: Dunning analytics and multi-channel dunning campaigns
paths:
  /auth/saml/{tenantID}/login:
    get:
      tags:
        - Auth
      summary: SP-initiated SAML login (redirect to the IdP)
      description: >-
        302-redirects to the IdP with a SAML AuthnRequest when the tenant's
        connection is enabled; 404 otherwise.
      operationId: samlLogin
      parameters:
        - name: tenantID
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '302':
          description: Redirect to the IdP.
        '404':
          $ref: '#/components/responses/NotFound'
      security: []
components:
  responses:
    NotFound:
      description: The requested resource does not exist.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          description: Structured error detail.
          required:
            - code
            - message
          properties:
            code:
              type: string
              description: Stable machine-readable error code.
              examples:
                - validation_failed
                - unauthorized
                - forbidden
                - not_found
                - conflict
                - rate_limited
                - internal_error
                - invalid_api_key
                - key_mode_mismatch
                - over_refund
                - invoice_not_paid
                - invoice_already_paid
            message:
              type: string
              description: Human-readable explanation.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: API key
      description: >-
        Tenant API key obtained from `POST /auth/register` or `POST
        /v1/developer/keys`.

````