APIs for enterprise single sign-on (SSO) via SAML 2.0 and OIDC protocols using a Bring Your Own IDP (BYOIDP) model. These endpoints enable organizations to authenticate users through their own identity provider (e.g., Okta, Azure AD).

The flow is protocol-agnostic from the client's perspective:

1. Client initiates login → GET /api2/idp/login → 302 redirect to enterprise IDP
2. IDP authenticates the user and returns to GIS (SAML: POST /api2/saml/callback, OIDC: GET /api2/oidc/callback)
3. GIS resolves the guest identity and redirects to redirect_uri?code=<one_time_code>
4. Client exchanges the one-time code for tokens → POST /api2/idp/token

The protocol (SAML vs OIDC) is determined by the BusinessMapping record for the client. The client parameter must reference an OAuth application with the Advance Auth scope and IDP authentication must be enabled for the business.