> ## Documentation Index
> Fetch the complete documentation index at: https://developers.kardinal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Login with Azure SSO



## OpenAPI

````yaml /openapi.yaml post /login/sso/azure
openapi: 3.0.3
info:
  title: Kardinal ARO API
  version: 2.55.0
  description: This document specifies the REST API of Kardinal ARO v2.
  contact:
    url: https://kardinal.ai/
    email: contact@kardinal.ai
servers:
  - url: /api/v2
security:
  - access_token: []
tags:
  - name: Authenticate
    description: How to authenticate, and manage the access and refresh tokens.
  - name: Plan
    description: How to create, retrieve, update and delete plans.
  - name: Resource
    description: How to create, retrieve, update and delete resources in a plan.
  - name: Order
    description: How to create, retrieve, update and delete orders in a plan.
  - name: SimplePlan
    description: How to create a plan through the use of a simple plan.
paths:
  /login/sso/azure:
    post:
      tags:
        - Authenticate
      summary: Login with Azure SSO
      operationId: postLoginWithAzureSSO
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AzureSSOLogin'
      responses:
        '200':
          description: The login succeeded.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/EnvelopedLoginGDPROutput'
                  - $ref: '#/components/schemas/EnvelopedLoginAccessOutput'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/NotAuthenticated'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security: []
components:
  schemas:
    AzureSSOLogin:
      type: object
      description: The payload to use for login through Azure SSO.
      properties:
        accessToken:
          type: string
          example: eyJ0eX...BLfpCt
          description: '[TO_VALIDATE] Description pending review by a Kardinal engineer.'
        idToken:
          type: string
          example: eyJ0eX...viPWrw
          description: '[TO_VALIDATE] Description pending review by a Kardinal engineer.'
      required:
        - accessToken
        - idToken
    EnvelopedLoginGDPROutput:
      type: object
      description: >-
        An object containing a 'gdpr' JSON Web Token, returned by a successful
        login of a user which needs to approve a GDPR policy.
      properties:
        item:
          type: object
          properties:
            gdprToken:
              $ref: '#/components/schemas/GDPRToken'
          description: '[TO_VALIDATE] Description pending review by a Kardinal engineer.'
        access_token:
          allOf:
            - deprecated: true
            - $ref: '#/components/schemas/GDPRToken'
    EnvelopedLoginAccessOutput:
      type: object
      description: >-
        An object containing the access and refresh JSON Web Tokens and the user
        description, returned by a successful login.
      properties:
        item:
          type: object
          properties:
            accessToken:
              $ref: '#/components/schemas/AccessToken'
            refreshToken:
              $ref: '#/components/schemas/RefreshToken'
            user:
              $ref: '#/components/schemas/User'
          description: '[TO_VALIDATE] Description pending review by a Kardinal engineer.'
        access_token:
          allOf:
            - deprecated: true
            - $ref: '#/components/schemas/AccessToken'
        refresh_token:
          allOf:
            - deprecated: true
            - $ref: '#/components/schemas/RefreshToken'
        user:
          allOf:
            - deprecated: true
            - $ref: '#/components/schemas/User'
    GDPRToken:
      type: string
      description: >-
        A JSON Web Token with scope 'gdpr', to be used to approve a GDPR policy,
        valid for 1 hour.
      example: eyJhbGciOiJFZERTQSJ9.eyJhdW...cMp9DA
    AccessToken:
      type: string
      description: >-
        A JSON Web Token with scope 'access', to be used to access protected
        data, valid for 1 hour.
      example: eyJhbGciOiJFZERTQSJ9.eyJhdW...oLXvDw
    RefreshToken:
      type: string
      description: >-
        A JSON Web Token with scope 'refresh', to be used to refresh the access
        token, valid for 30 days.
      example: eyJhbGciOiJFZERTQSJ9.eyJhdW...Ir-9Bg
    User:
      type: object
      description: A user is a person who can use Platform's services.
      properties:
        id:
          type: string
          format: uuid
          description: Kardinal's unique identifier.
          readOnly: true
          example: 483fad31-415d-4d9e-8edd-c8f936e71520
        username:
          $ref: '#/components/schemas/Username'
        type:
          $ref: '#/components/schemas/UserType'
        password:
          writeOnly: true
          description: The user's password.
          allOf:
            - $ref: '#/components/schemas/Password'
        role:
          $ref: '#/components/schemas/Role'
        firstname:
          type: string
          description: The user's first name.
          example: Martin
          nullable: true
        lastname:
          type: string
          description: The user's last name.
          example: DUPONT
          nullable: true
        level:
          $ref: '#/components/schemas/Level'
        countries:
          description: The countries whose data the user is allowed to see.
          allOf:
            - $ref: '#/components/schemas/CountryIds'
        regions:
          description: The regions whose data the user is allowed to see.
          allOf:
            - $ref: '#/components/schemas/RegionIds'
        agencies:
          description: The agencies whose data the user is allowed to see.
          allOf:
            - $ref: '#/components/schemas/AgencyIds'
        active:
          description: Represents whether the user is enabled or disabled internally.
          example: true
          type: boolean
        status:
          $ref: '#/components/schemas/UserStatus'
        lastLoginAt:
          description: Represents the last login date of the user.
          nullable: true
          allOf:
            - $ref: '#/components/schemas/DateTime'
        createdAt:
          description: The user's creation date.
          nullable: false
          readOnly: true
          allOf:
            - $ref: '#/components/schemas/DateTime'
        updatedAt:
          description: The user's last update date.
          nullable: true
          readOnly: true
          allOf:
            - $ref: '#/components/schemas/DateTime'
        clientId:
          description: >
            The id of the client whom the user is linked to.

            It can be empty for a user which level is greater than 'owner'.


            When creating a new user, this id can be left empty if:

            - the caller has the level 'region' or 'country' or 'owner': in this
            case, the clientId of the new user is inherited from the clientId of
            the caller,

            - the new user has a level greater than 'owner'.
          allOf:
            - $ref: '#/components/schemas/ClientId'
        gdprInfo:
          type: object
          properties:
            version:
              type: string
            approvedAt:
              $ref: '#/components/schemas/DateTime'
          description: '[TO_VALIDATE] Description pending review by a Kardinal engineer.'
        managedClientsIds:
          type: array
          description: >-
            For an 'admin' user only: the ids of the clients which are managed
            by this user.
          items:
            $ref: '#/components/schemas/ClientId'
      required:
        - username
    EnvelopedErrors:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/Error'
      description: '[TO_VALIDATE] Description pending review by a Kardinal engineer.'
    Username:
      type: string
      description: >-
        The username is used for login, it is unique for each user, it can be
        either an email (for clients) or a regular username (for Kardinal's
        internal users).
      example: martin.dupont@kardinal.ai
      oneOf:
        - $ref: '#/components/schemas/RegexNotEmpty'
        - $ref: '#/components/schemas/Email'
    UserType:
      type: string
      description: The user type.
      enum:
        - standard
        - api
        - simpleApi
        - mobile
      default: standard
      example: standard
    Password:
      type: string
      format: password
      description: |
        A user password must contain at least:
        - 1 number,
        - 1 uppercase letter,
        - 1 lowercase letter,
        - 1 special character amongst the following:
          !"#$%&'()*+,-./:;<=>?@[]^_`{|}~
        - 12 characters.
        And it must not exceed 72 bytes.
      allOf:
        - type: string
          pattern: .*[0-9]{1}
        - type: string
          pattern: .*[A-Z]{1}
        - type: string
          pattern: .*[a-z]{1}
        - type: string
          pattern: .*[!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~]{1}
        - type: string
          pattern: ^.{12,72}$
    Role:
      type: string
      description: The user's role.
      enum:
        - analyst
        - expert
        - super
      default: analyst
      example: expert
    Level:
      type: string
      description: The user's level.
      enum:
        - super
        - platformAdmin
        - admin
        - owner
        - country
        - region
        - agency
      default: agency
      example: country
    CountryIds:
      type: array
      description: A list of country identifiers.
      items:
        $ref: '#/components/schemas/CountryId'
      example:
        - LND_France
        - LND_Belgique
    RegionIds:
      type: array
      description: A list of region identifiers.
      items:
        $ref: '#/components/schemas/RegionId'
      example:
        - LND_Ile-de-France
        - LND_Grand-Ouest
    AgencyIds:
      type: array
      description: A list of agency identifiers.
      items:
        $ref: '#/components/schemas/AgencyId'
      example:
        - LND_Agency-01
        - LND_Agency-42
    UserStatus:
      type: string
      description: The user's status.
      enum:
        - enabled
        - disabled
        - pending
      example: pending
      readOnly: true
    DateTime:
      type: string
      description: >-
        A full calendar date time, expressed in the ISO8601 **date** format:
        YYYY-MM-DDThh:mm:ssZ.
      example: '2019-11-15T12:34:56Z'
    ClientId:
      description: The client id.
      example: LND_FR
      allOf:
        - $ref: '#/components/schemas/RegexPrefixedIdValidation'
    Error:
      type: object
      readOnly: true
      properties:
        code:
          type: string
          description: '[TO_VALIDATE] Description pending review by a Kardinal engineer.'
        message:
          type: string
          description: '[TO_VALIDATE] Description pending review by a Kardinal engineer.'
        properties:
          $ref: '#/components/schemas/ErrorProperties'
      required:
        - message
        - code
      description: '[TO_VALIDATE] Description pending review by a Kardinal engineer.'
    RegexNotEmpty:
      type: string
      description: Not empty string.
      pattern: .+
    Email:
      type: string
      description: A valid email address.
      format: email
      example: martin.dupont@kardinal.ai
    CountryId:
      description: The country id.
      readOnly: true
      example: LND_France
      allOf:
        - $ref: '#/components/schemas/RegexPrefixedIdValidation'
    RegionId:
      description: The region id.
      readOnly: true
      example: LND_Ile-de-France
      allOf:
        - $ref: '#/components/schemas/RegexPrefixedIdValidation'
    AgencyId:
      description: The agency id.
      readOnly: true
      example: LND_Agency-42
      allOf:
        - $ref: '#/components/schemas/RegexPrefixedIdValidation'
    RegexPrefixedIdValidation:
      type: string
      description: An id beginning with a prefix and an underscore.
      pattern: ^[A-Z]{3,6}_[a-zA-Z0-9-._~:@!$,]+$
    ErrorProperties:
      type: object
      additionalProperties:
        type: string
      description: '[TO_VALIDATE] Description pending review by a Kardinal engineer.'
  responses:
    BadRequest:
      description: >-
        The server could not understand the request due to invalid content (bad
        syntax, bad format, bad values, etc).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/EnvelopedErrors'
    NotAuthenticated:
      description: The caller is not authenticated.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/EnvelopedErrors'
    Forbidden:
      description: The caller is not allowed to perform this action.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/EnvelopedErrors'
    InternalServerError:
      description: An internal server error has occurred.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/EnvelopedErrors'
  securitySchemes:
    access_token:
      type: http
      scheme: bearer
      bearerFormat: JWT

````