---
title: "Ncloud Single Sign-On overview"
slug: "single-sign-on-overview"
tags: ["overview", "Ncloud Single Sign-On"]
updated: 2026-09-17T10:05:38Z
published: 2026-09-17T10:05:38Z
canonical: "api.ncloud-docs.com/single-sign-on-overview"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://api.ncloud-docs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Ncloud Single Sign-On overview

Available in Classic and VPC

Ncloud Single Sign-On is a NAVER Cloud Platform service that builds a system that allows you to access various applications with a single account. The Ncloud Single Sign-On service provides APIs for application, tenant, external IdP, SSO user, group, permission set, assignment, and IP ACL features in a RESTful form.

## Common Ncloud Single Sign-On settings

The following describes commonly used request and response formats in Ncloud Single Sign-On APIs.

### Request

The following describes the common request format.

#### API URL

The request API URL is as follows:

```
https://sso.apigw.ntruss.com
```

#### Request headers

The following describes the request headers.

| Field | Required | Description |
| --- | --- | --- |
| `x-ncp-apigw-timestamp` | Required | This is the number of milliseconds that have elapsed since January 1, 1970 00:00:00 UTC. - Request is considered invalid if the timestamp differs from the current time by more than 5 minutes. - Unix timestamp format. |
| `x-ncp-iam-access-key` | Required | Access key issued on NAVER Cloud Platform - Issue and check access key: See [Create authentication key](/docs/en/common-ncpapi). - Issue and check access key for sub account: See [Create sub account](https://guide.ncloud-docs.com/docs/en/subaccount-use#%EC%84%9C%EB%B8%8C-%EA%B3%84%EC%A0%95-%EC%83%9D%EC%84%B1). |
| `x-ncp-apigw-signature-v2` | Required | Base64-encoded signature that encrypts the request information with a secret key that maps to the access key issued on NAVER Cloud Platform, using the HMAC encryption algorithm (HmacSHA256) - Issue and check secret key: See [Create authentication key](/docs/en/common-ncpapi). - Create signature: See [Create signature](/docs/en/common-ncpapi). |
| `Content-Type` | Optional | Request data format - `application/json` |
| `Accept` | Optional | Response data format - `application/json` |

### Response

The following describes the common response format.

#### Response body

The response body includes the following data:

**ProcessResult**

ProcessResult defines the API processing result. The following describes ProcessResult.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `success` | Boolean | Required | API processing result - `true` \| `false` - `true`: Succeeded - `false`: Failed |
| `id` | String | Optional | Creation/modification result ID - Use in creation, multiple addition/deletion APIs. |
| `message` | String | Optional | API processing result message |

**ErrorResponse** ErrorResponse defines API call failure information. The following describes ErrorResponse.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| errorCode | Integer | Required | Errors |
| message | String | Required | Error message |

#### Response status codes

The following describes the response status codes.

| HTTP status code | Code | Message | Description |
| --- | --- | --- | --- |
| 400 | 400 | The user is not a member of this group. | Input of a user not belonging to the group |
| 400 | 400 | The permission set doesn't exist. | No permission set exists. |
| 400 | 400 | The application name already exists. | Input of an existing application name |
| 400 | 400 | Tenant already exists | Tenant already exists. |
| 400 | 400 | The login ID is already in use. | Login ID already in use entered |
| 400 | 500 | The policy doesn't exist. | Non-existent policy name entered |
| 400 | 9016 | The application does not exist. | Non-existent application ID entered |
| 400 | 9020 | There is a registered identity provider. | External IdP already exists. |
| 400 | 9021 | This identify provider doesn't exist. | Non-existent external IdP |
| 400 | 9023 | The identity provider can't be deleted while the organization is integrated. | Unable to delete identity provider while organization is integrated. |
| 400 | 9024 | Invalid metadata format. | Metadata format error |
| 400 | 9025 | There is no certificate information for signing in the metadata. | No certificate information for signing metadata |
| 400 | 9026 | There are two or more certificates for signing in the metadata. | Two or more certificates for signing exist in the metadata. |
| 400 | 9027 | There is no SingleSignOnService binding in the metadata. | No protocol binding information in metadata |
| 400 | 9028 | There is no SingleSignOnService location in the metadata. | No SAML login URL information mapped to the binding protocol in metadata |
| 400 | 9029 | There is no entityId in the metadata. | No `entityID` information in metadata |
| 400 | 9030 | There is no IdPSSODescriptor in the metadata. | No `IDPSSODescriptor` information in metadata |
| 400 | 9031 | There is no SingleSignOnService in the metadata. | No SingleSignOnService in metadata |
| 400 | 9032 | There is no SingleSignOnService POST binding or Redirect binding in the metadata. | No HTTP-POST or HTTP-Redirect information in metadata |
| 400 | 9033 | The idpSigninUrl value is not in URL format. | idpSigninUrl value format error |
| 400 | 9034 | There is no KeyInfo in the metadata. | No `KeyInfo` information in metadata |
| 400 | 9035 | This is not the master account of the organization. | Organization integration requested with non-master account |
| 400 | 9036 | The organization doesn't exist. | Organization doesn't exist in master account. |
| 400 | 9046 | Invalid certificate format. | Errors in certificate format for metadata signing |
| 400 | 9050 | This user doesn't exist. | Non-existent SSO user ID entered |
| 400 | 9060 | The group name already exists. | Group name already in use entered |
| 400 | 9061 | This group doesn't exist. | Non-existent group ID entered |
| 400 | 9070 | The permission set name already exists. | Permission set name already in use entered |
| 400 | 9071 | At least one policy must be selected. | Policy ID not entered |
| 400 | 9072 | This system managed policy doesn't exist. | Non-existent System Managed policy ID entered |
| 400 | 9073 | The permission set doesn't exist. | Non-existent permission set ID entered |
| 400 | 9080 | Assignment does not exist. | Non-existent assignment ID entered |
| 400 | 9081 | The assignment target doesn't match. | Non-matching assignment target entered |
| 400 | 9083 | The assignment target doesn't exist. | Non-existent assignment target entered |
| 400 | 9084 | An assignment created with the specified account and permission set already exists. | Assignment created with the same information already exists. |
| 400 | 9085 | The assigned account is invalid. | Non-existent account number entered |
| 400 | 9086 | A target already exists in the assignment. | Target information already added entered |
| 400 | 9087 | The Assignment name already exists. | Assignment name already in use entered |
| 400 | 9100 | The IP ACL does not exist. | Non-existent IP ACL ID entered |
| 400 | 9101 | IP ACL destination cannot be empty. | Assignment ID missing |
| 400 | 9102 | A target already exists in the assignment. | Assignment ID already added entered |
| 400 | 9103 | Assignment - remaining IP ACL mapping exists. | Unable to delete because assignment is added to IP ACL. |
| 400 | 9104 | IP ACL destination does not match. | Non-existent assignment - IP ACL mapping information entered |
| 400 | 9105 | Assignment - IP ACL mapping does not exist. | Assignment - IP ACL mapping information that already exists entered |
| 400 | 9106 | Invalid access restriction setting for Assignment. | Assignment access control status is `false` |
| 400 | 9110 | An MFA device already exists. | MFA device already exists for SSO user. |
| 400 | 9111 | Invalid OTP. | Invalid OTP information entered |
| 400 | 9112 | The MFA device does not exist. | MFA device doesn't exist for SSO user. |
| 400 | 9113 | Two-factor authentication not applied. | Two-factor authentication not applied |

Note

For response status codes common to NAVER Cloud Platform, see [Ncloud API response status codes](/docs/en/common-ncpapi#3%EC%9D%91%EB%8B%B5%EC%83%81%ED%83%9C%EC%BD%94%EB%93%9C).

#### Response example

The response example is as follows:

**Succeeded** The following is a sample response upon a successful call.

- ProcessResult

```
{
    "id": "",
    "success": true
}
```

**Failure** The following is a sample response upon a failed call.

```
{
    "errorCode": 9060,
    "message": "The group name already exists."
}
```

## Ncloud Single Sign-On API

The following describes the APIs provided by the Ncloud Single Sign-On service.

### Application

The following describes the application-related APIs.

| API | Description |
| --- | --- |
| [Create application](/docs/en/post-application) | Create application. |
| [Get application list](/docs/en/get-applications) | Get application list. |
| [Get application](/docs/en/get-application) | Get details of a single application. |
| [Edit application](/docs/en/put-application) | Edit application information. |
| [Delete application](/docs/en/delete-application) | Delete application. |
| [Add application tag](/docs/en/post-application-tag) | Add a tag to an application. |
| [Get application tag](/docs/en/get-application-tags) | Get tags added to an application. |
| [Delete application tag](/docs/en/delete-application-tag) | Delete tags added to an application. |
| [Reissue OAuth 2.0 client secret](/docs/en/renewal-client-secret) | Reissue OAuth 2.0 client secret. |

### Tenant

The following describes the tenant-related APIs.

| API | Description |
| --- | --- |
| [Create tenant](/docs/en/post-tenant) | Create tenant. |
| [Get tenant](/docs/en/get-tenant) | Get tenant. |
| [Edit tenant](/docs/en/put-tenant) | Edit tenant information. |
| [Delete tenant](/docs/en/delete-tenant) | Delete tenant. |
| [Add tenant tag](/docs/en/post-tenant-tag) | Add a tag to a tenant. |
| [Get tenant tag](/docs/en/get-tenant-tags) | Get tags added to a tenant. |
| [Delete tenant tag](/docs/en/delete-tenant-tag) | Delete tags added to a tenant. |

### External IdP

The following describes the external IdP-related APIs.

| API | Description |
| --- | --- |
| [Get external IdP](/docs/en/get-external-idp) | Get external IdP. |
| [Create external IdP](/docs/en/post-external-idp) | Create external IdP. |
| [Edit external IdP](/docs/en/put-external-idp) | Edit external IdP information. |
| [Delete External IdP](/docs/en/delete-external-idp) | Delete external IdP. |
| [Get IdP certificate list](/docs/en/get-idp-certificates) | Get IdP certificate list. |
| [Get IdP certificate](/docs/en/get-idp-certificate) | Get IdP certificate. |
| [Register IdP certificate](/docs/en/post-idp-certificate) | Register IdP certificate. |
| [Delete IdP certificate](/docs/en/delete-idp-certificate) | Delete IdP certificate. |
| [Get IdP certificate notifications](/docs/en/get-idp-certificate-notification) | Get IdP certificate notifications. |
| [Set IdP certificate notifications](/docs/en/put-idp-certificate-notification) | Set IdP certificate notifications. |
| [Get SP certificate list](/docs/en/get-sp-certificates) | Get SP certificate list. |
| [Get SP certificate](/docs/en/get-sp-certificate) | Get SP certificate. |
| [Download SP certificate](/docs/en/download-sp-certificate) | Download SP certificate. |
| [Register SP certificate](/docs/en/post-sp-certificate) | Register SP certificate. |
| [Enable SP certificate](/docs/en/activate-sp-certificate) | Enable SP certificate. |
| [Delete SP certificate](/docs/en/delete-sp-certificate) | Delete SP certificate. |
| [Get SP certificate notifications](/docs/en/get-sp-certificate-notification) | Get SP certificate notifications. |
| [Set SP certificate notifications](/docs/en/put-sp-certificate-notification) | Set SP certificate notifications. |
| [Get attribute mapper](/docs/en/get-attribute-mapper) | Get attribute mapper. |
| [Edit attribute mapper](/docs/en/modify-attribute-mapeer) | Edit attribute mapper. |
| [Parse external IdP metadata](/docs/en/parse-external-idp-metadata) | Parse external IdP metadata. |
| [Get Ncloud Single Sign-On metadata](/docs/en/get-sp-metadata) | Get Ncloud Single Sign-On metadata. |
| [Get Ncloud Single Sign-On URL data](/docs/en/get-sp-url-data) | Get Ncloud Single Sign-On URL data. |
| [Set external IDP login](/docs/en/put-login-setting) | Set external IDP login information. |
| [Set Organization integration](/docs/en/post-organization) | Integrate Organization. |
| [Get notification recipient list](/docs/en/get-notification-recipients) | Get notification recipient list. |
| [Get notification recipient group list](/docs/en/get-notification-recipients-groups) | Get notification recipient group list. |

### SSO User

The following describes the SSO user-related APIs.

| API | Description |
| --- | --- |
| [Get SSO user list](/docs/en/get-users) | Get SSO user list. |
| [Get SSO user](/docs/en/get-user) | Get details of a single SSO user. |
| [Create SSO user](/docs/en/post-user) | Create a single SSO user. |
| [Bulk create SSO users](/docs/en/post-users) | Bulk create SSO users of one or more. |
| [Edit SSO user](/docs/en/put-user) | Edit SSO user information. |
| [Bulk delete SSO users](/docs/en/delete-users) | Bulk delete SSO users of one or more. |
| [Delete SSO user](/docs/en/delete-user) | Delete SSO user. |
| [Check SSO user login ID](/docs/en/validate-user-login-id) | Check validity and duplication of SSO user login ID. |
| [Get SSO user access rule](/docs/en/get-user-access-rule) | Get SSO user access rule. |
| [Edit SSO user access rule](/docs/en/put-user-access-rule) | Edit SSO user access rule. |
| [Get SSO user profile](/docs/en/get-user-profile) | Get SSO user profile. |
| [Get SSO user group list](/docs/en/get-user-groups) | Get group list. |
| [Get SSO user group](/docs/en/get-user-group) | Get single group details. |
| [Add SSO user group](/docs/en/post-user-to-group) | Add SSO user to group. |
| [Delete SSO user group](/docs/en/delete-user-from-group) | Delete SSO user from group. |
| [Set SSO user status](/docs/en/change-user-status) | Enable or disable SSO user. |
| [Get SSO user session](/docs/en/get-user-session) | Get SSO user session. |
| [Expire SSO user session](/docs/en/expire-user-session) | Expire SSO user session. |
| [Get SSO user assignment list](/docs/en/get-user-assignments) | Get the list of assignments the SSO user belongs to. |
| [Delete SSO user assignment](/docs/en/delete-user-from-assignment) | Delete SSO user from assignment. |
| [Get SSO user MFA device list](/docs/en/get-user-mfa-devices) | Get MFA device owned by SSO user. |
| [Add SSO user MFA device](/docs/en/add-user-mfa-devices) | Add MFA device to SSO user. |
| [Delete SSO user MFA device](/docs/en/delete-user-mfa-devices) | Delete MFA device owned by SSO user. |
| [Get SSO user tag](/docs/en/get-user-tags) | Get tags added to a SSO user. |
| [Add SSO user tag](/docs/en/post-user-tag) | Add a tag to an SSO user. |
| [Delete SSO user tag](/docs/en/delete-user-tag) | Delete a tag added to a SSO user. |

### Group

The following describes the group-related APIs.

| API | Description |
| --- | --- |
| [Get group list](/docs/en/get-groups) | Get group list. |
| [Get group](/docs/en/get-group) | Get single group details. |
| [Create group](/docs/en/post-group) | Create group. |
| [Edit group](/docs/en/put-group) | Edit group information. |
| [Delete group list](/docs/en/delete-groups) | Bulk delete groups of one or more. |
| [Delete group](/docs/en/delete-group) | Delete group. |
| [Check group name](/docs/en/validate-group-name) | Check validity and duplication of group name. |
| [Get SSO user list of group](/docs/en/get-group-users) | Get the list of SSO users in the group. |
| [Add SSO user to group](/docs/en/post-group-to-user) | Add group to SSO user. |
| [Delete SSO user of group](/docs/en/delete-group-from-user) | Delete SSO user from group. |
| [Get group assignment list](/docs/en/get-group-assignments) | Get the list of assignments the group belongs to. |
| [Delete group assignment](/docs/en/delete-group-from-assignment) | Delete group from assignment. |
| [Get group tag](/docs/en/get-group-tags) | Get tags added to a group. |
| [Add group tag](/docs/en/post-group-tag) | Add tag to group |
| [Delete group tag](/docs/en/delete-group-tag) | Delete a tag added to a group. |

### Permission Set

The following describes the permission set-related APIs.

| API | Description |
| --- | --- |
| [Get permission set list](/docs/en/get-permission-sets) | Get permission set list. |
| [Get permission set](/docs/en/get-permission-set) | Get details of a single permission set. |
| [Create permission set](/docs/en/post-permission-set) | Create permission set. |
| [Edit permission set](/docs/en/put-permission-set) | Edit permission set information. |
| [Delete permission set list](/docs/en/delete-permission-sets) | Bulk delete permission sets of one or more. |
| [Delete permission set](/docs/en/delete-permission-set) | Delete permission set. |
| [Check permission set name](/docs/en/validate-permission-set-name) | Check validity and duplication of permission set name. |
| [Delete permission set policy](/docs/en/delete-policy-from-permission-set) | Delete policy assigned to permission set. |
| [Get system managed policy list](/docs/en/get-policies) | Get the list of System Managed policies that can be assigned to permission set. |
| [Check existence of user created policy](/docs/en/exists-policy) | Check for the existence of User Created policy in permission set. |
| [Get permission set tag](/docs/en/get-permission-set-tags) | Get tags added to a permission set. |
| [Add permission set tag](/docs/en/post-permission-set-tag) | Add a tag to a permission set. |
| [Delete permission set tag](/docs/en/delete-permission-set-tag) | Delete a tag added to a permission set. |

### Assignment

The following describes the assignment-related APIs.

| API | Description |
| --- | --- |
| [Get assignment list](/docs/en/get-assignments) | Get assignment list. |
| [Get assignment](/docs/en/get-assignment) | Get details of a single assignment. |
| [Create assignment](/docs/en/post-assignment) | Create assignment. |
| [Edit assignment](/docs/en/put-assignment) | Edit assignment information. |
| [Delete assignment](/docs/en/delete-assignment) | Delete assignment. |
| [Set assignment status](/docs/en/change-assignment-status) | Enable or disable assignment. |
| [Get assignment target list](/docs/en/get-assignment-targets) | Get the list of targets (SSO users, groups) added to assignment. |
| [Add assignment target](/docs/en/post-assignment-targets) | Add target (SSO user, group) to assignment. |
| [Delete assignment target](/docs/en/delete-assignment-targets) | Delete target (SSO user, group) from assignment. |
| [Get IP ACL assignment list](/docs/en/get-assignments-ip-acls) | Get the list of IP ACLs added to assignment. |
| [Add IP ACL to assignment](/docs/en/add-assignment-ip-acls) | Add IP ACL to assignment. |
| [Delete IP ACL from assignment](/docs/en/delete-assignment-ip-acls) | Delete IP ACL added to assignment. |
| [Get assignment account list](/docs/en/get-accounts) | Get the list of accounts added to organization. |
| [Check existence of user created policy](/docs/en/get-assignment-exists-policy) | Check for the existence of User Created policy in target account. |
| [Get assignment tag](/docs/en/get-assignment-tags) | Get tags added to an assignment. |
| [Add assignment tag](/docs/en/post-assignment-tag) | Add a tag to an assignment. |
| [Delete assignment tag](/docs/en/delete-assignment-tag) | Delete a tag added to an assignment. |

### IP ACL

The following describes the IP ACL-related APIs.

| API | Description |
| --- | --- |
| [Get IP ACL list](/docs/en/get-ip-acls) | Get IP ACL list. |
| [Get IP ACL](/docs/en/get-ip-acl) | Get details of a single IP ACL. |
| [Create IP ACL](/docs/en/post-ip-acl) | Create IP ACL. |
| [Edit IP ACL](/docs/en/put-ip-acl) | Edit IP ACL information. |
| [Delete IP ACL list](/docs/en/delete-ip-acls) | Bulk delete IP ACLs of one or more. |
| [Delete IP ACL](/docs/en/delete-ip-acl) | Delete IP ACL. |
| [Check IP ACL name](/docs/en/validate-ip-acl-name) | Check validity and duplication of IP ACL name. |
| [Get IP ACL assignment list](/docs/en/get-ip-acl-assignments) | Get the list of assignments added to IP ACL. |
| [Add assignment to IP ACL](/docs/en/add-ip-acl-to-assignments) | Add assignment to IP ACL. |
| [Delete assignment of IP ACL](/docs/en/delete-ip-acl-assignments) | Delete assignment from IP ACL. |
| [Get IP ACL tag](/docs/en/get-ip-acl-tags) | Get tags added to an IP ACL. |
| [Add IP ACL tag](/docs/en/post-ip-acl-tag) | Add a tag to an IP ACL. |
| [Delete IP ACL tag](/docs/en/delete-ip-acl-tag) | Delete a tag added to an IP ACL. |

## Ncloud Single Sign-On related resources

NAVER Cloud Platform provides a variety of related resources to help users better understand Ncloud Single Sign-On APIs.

- Ncloud Single Sign-On API guide
  - [Create signature](/docs/en/common-ncpapi): How to create a signature to add to the request header
  - [API Gateway user guide](https://guide.ncloud-docs.com/docs/en/apigw-apigw-1): How to issue the API key to be added to the request header
  - [Sub Account User Guides](https://guide.ncloud-docs.com/docs/en/subaccount-overview): How to issue the access key to be added to the request header
  - [Common Ncloud response status codes](/docs/en/common-ncpapi#3-%EC%9D%91%EB%8B%B5-%EC%83%81%ED%83%9C-%EC%BD%94%EB%93%9C): Information on common response status codes of NAVER Cloud Platform used by the Ncloud Single Sign-On service
- Ncloud Single Sign-On service guide
  - [Ncloud Single Sign-On user guide](https://guide.ncloud-docs.com/docs/en/sso-overview): How to use Ncloud Single Sign-On from the NAVER Cloud Platform console
  - [Ncloud user environment guide](https://guide.ncloud-docs.com/docs/en/environment-environment-1-1): Explore VPC and Classic environments and supported services.
  - [Pricing and features](https://www.ncloud.com/product/management/NcloudSingleSignon): View pricing details and key capabilities.
  - [Latest service news](https://www.ncloud.com/intro/news): The latest news on Ncloud Single Sign-On service
  - [FAQ](https://www.ncloud.com/support/faq/prod?categoryCode2=MGMT&categoryCode3=SV_0210&page=1): Frequently asked questions from the Ncloud Single Sign-On service users
  - [Contact Support](https://www.ncloud.com/support/question/general): Get help if you can't find what you need in the API guide.