Get SAML service-provider metadata

Returns Grid's SAML 2.0 service-provider metadata (application/samlmetadata+xml, unsigned) for your identity provider to import.

• Entity ID (audience): always urn:grid:saml:{parentCustomerId}, even when customerId is a sub-organization.
• ACS URL: /auth/sso/saml/{customerId}/acs for the customerId you request, with the HTTP-POST binding.

Request one metadata document per session target: the parent for parent sessions, each direct sub-organization for its own sessions. The parent must have the SSO module enabled and a SAML configuration saved; otherwise this returns SSO_MODULE_NOT_ENABLED, SSO_SAML_CONFIGURATION_NOT_FOUND, or CUSTOMER_NOT_FOUND.