Skip to main content

Discover Realm

POST 
/auth/discover-realm

Unauthenticated home-realm-discovery lookup for the frontend deep-link flow -- resolves ?tenant=<armor_tenant_id> BEFORE the browser is sent to /auth/login so the UI can render an IdP-specific continue button.

Uniform response shape whether the tenant doesn't exist at all or exists but has no SSO configured -- this must never become a tenant-enumeration oracle: an attacker probing tenant slugs must not be able to distinguish "no such tenant" from "tenant exists, SSO not configured" from the response shape or any other observable signal.

Request​

Responses​

Successful Response

Response Headers
    Idempotency-Replayed

    true when this response was replayed from the idempotency cache for a repeated Idempotency-Key instead of re-executing.

    RateLimit

    Current tenant quota state (draft-ietf-httpapi-ratelimit-headers structured field): "tenant";r=<remaining>;t=<seconds-to-reset>. Emitted on every response when per-tenant rate limiting is enabled (ARMOR_TENANT_RATE_LIMIT_PER_MIN > 0; off by default).

    RateLimit-Policy

    The quota policy the RateLimit header reports against: "tenant";q=<limit>;w=<window-seconds>.

    X-Correlation-Id

    Request correlation id — present on every response; quote it when reporting an issue. Error bodies carry the same value as correlation_id.

Was this helpful?

Optional comments unlock after a short time on this docs site.

Ask the docs

Tier-scoped answers from this portal corpus (extractive; no external LLM).

Comments

Loading comments…

Suggest an edit

Propose a correction. Staff review every suggestion and open a draft PR; nothing publishes without CI.