canonical: https://jentic.com/apis/sendgrid.com/twilio-sendgrid-single-sign-on-api

# Sendgrid Twilio SendGrid Single Sign-On API

The Single Sign-On API allows you to manage your SAML 2.0 SSO configurations. You can also work with your SSO integrations using the SSO section of the [Twilio SendGrid application user interface](https://app.sendgrid.com/settings/sso). The Single Sign-On Settings operations allow you to create, retrieve, modify, and delete SSO integrations for your Twilio SendGrid account. Each integration will c. The API exposes 12 endpoints secured with bearer authentication.

## For AI agents

Programmatically create an sso certificate, get an sso certificate. Covers 12 operations with bearer authentication.

## Scope

Does not handle payments, communications, or crm - use for identity and authentication only.

## Capabilities

- Create an SSO Certificate
- Get an SSO Certificate
- Update SSO Certificate
- Delete an SSO Certificate
- Monitor Twilio SendGrid Single Sign-On API operational status and events

## Use cases

### Identity and Authentication Operations

Use the Twilio SendGrid Single Sign-On API to perform identity auth operations programmatically. The API provides 12 endpoints covering core functionality including create an sso certificate, get an sso certificate, update sso certificate.

Example prompt: Call POST /v3/sso/certificates to create an sso certificate

### Automated SSO Certificates Management

Automate sso certificates operations by combining multiple Twilio SendGrid Single Sign-On API endpoints. Agents can get an sso certificate and then update sso certificate in a single workflow.

Example prompt: Call GET /v3/sso/certificates/{cert_id} to get an sso certificate, then verify the result

### AI Agent Integration via Jentic

AI agents discover and call Twilio SendGrid Single Sign-On API endpoints through Jentic without managing credentials directly. An agent searches for the required operation by intent, receives the matching endpoint schema, and executes the call with Jentic-managed authentication. This eliminates the need to read API documentation or handle bearer tokens manually.

Example prompt: Search Jentic for 'create an sso certificate', load the operation schema, and execute with Jentic-managed credentials

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /v3/sso/certificates | Create an SSO Certificate |
| GET | /v3/sso/certificates/{cert_id} | Get an SSO Certificate |
| PATCH | /v3/sso/certificates/{cert_id} | Update SSO Certificate |
| DELETE | /v3/sso/certificates/{cert_id} | Delete an SSO Certificate |
| POST | /v3/sso/integrations | Create an SSO Integration |
| GET | /v3/sso/integrations | Get All SSO Integrations |
| GET | /v3/sso/integrations/{id} | Get an SSO Integration |
| PATCH | /v3/sso/integrations/{id} | Update an SSO Integration |

## Key resources

- **SSO Certificates** — Twilio SendGrid Single Sign-On Certificate Operations
- **SSO Settings** — Twilio SendGrid Single Sign-On Settings Operations
- **SSO Teammates** — Twilio SendGrid Single Sign-On Teammates Operations

## Why Jentic

- **Setup:** Wiring the Twilio SendGrid Single Sign-On API by hand means setting up its bearer token auth, choosing the right US or EU host (api.sendgrid.com or api.eu.sendgrid.com), and handling status codes yourself. Through Jentic you install once, import the Single Sign-On API from the API Directory, store the token once, and your agent calls it.
- **Permission scoping:** The Single Sign-On API puts the certificate and integration ids in the URL path (/v3/sso/certificates/{cert_id} and /v3/sso/integrations/{id}), so a rule can pin your agent to one SSO integration or certificate. You choose the operations it may call, so destructive ones like deleting a certificate are not included unless you add them.
- **Credential handling:** Your Twilio SendGrid token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create an SSO certificate', and Jentic returns the matching Single Sign-On operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Auth0** — Alternative identity auth API
- **Okta** — Alternative identity auth API

## FAQ

### What authentication does the Twilio SendGrid Single Sign-On API use?

The Twilio SendGrid Single Sign-On API uses a Bearer token in the Authorization header. Through Jentic, these credentials are stored encrypted in your Jentic One instance and injected at execution time, so raw secrets never enter the agent context.

### Can I create an sso certificate with the Twilio SendGrid Single Sign-On API?

Yes. Use the POST /v3/sso/certificates endpoint. The API returns structured JSON responses that agents can parse and act on directly.

### What are the rate limits for the Twilio SendGrid Single Sign-On API?

Rate limits are not specified in the OpenAPI spec. Check the vendor documentation for current limits. Through Jentic, rate limiting is handled automatically with retry logic built into the execution layer.

### How do I create an sso certificate through Jentic?

Install the Jentic SDK with pip install jentic, authenticate through Jentic One, the self-hosted execution layer, then search for 'create an sso certificate'. Jentic returns the matching Twilio SendGrid Single Sign-On API operation with its input schema. Load the schema and execute the call - credentials are injected automatically.

### How many endpoints does the Twilio SendGrid Single Sign-On API have?

The Twilio SendGrid Single Sign-On API exposes 12 endpoints covering sso certificates, sso settings, sso teammates operations.

### Can I limit what my agent is allowed to do with the Twilio SendGrid Single Sign-On API?

Yes. Because you run Jentic One yourself, you decide which Single Sign-On operations your agent may call, so you can grant read operations like GET /v3/sso/integrations while withholding destructive ones such as DELETE /v3/sso/certificates/{cert_id}. Since the certificate and integration ids sit in the URL path (/v3/sso/certificates/{cert_id} and /v3/sso/integrations/{id}), your own rules can pin the agent to a single SSO integration or certificate. The bearer token stays in your self-hosted instance and is injected only for the operations you have allowed.