Pre-flight check whether an email is bound to an org with SSO enforced (F4.ENTERPRISE.02)
POST /auth/check-sso-enforcement
POST
/auth/check-sso-enforcement
Deliberately public (no auth) — called BEFORE any Keycloak token exists, ahead of a password-grant login attempt, so the frontend can redirect straight to SSO instead of showing a password field. A user belonging to >1 organisation is considered enforced if ANY of their organisations has sso_enforced: true. Fails open (enforced: false) on any internal error — this is a UX hardening check, not the primary auth gate.
Request Body required
Section titled “Request Body required ”object
email
required
string format: email
Responses
Section titled “ Responses ”OK
object
enforced
boolean
Email is required