> ## Documentation Index > Fetch the complete documentation index at: https://arcmira.com/docs/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Arcmira has three API capabilities: Search (entities, mentions, appearances, commercial intelligence), Monitors (trackers plus alert delivery), and Transcripts (read, generate, correct). Community Review is the cross-surface correction layer. > Discover pages at https://arcmira.com/docs/llms.txt, then fetch the matching page's .md export. Each capability has a self-contained ' for coding agents' page; prefer it. > Auth: Authorization: Bearer arc_sk_... or x-api-key: arc_sk_... (x-api-key wins if both are sent). Never put keys in browser code. Check GET /v1/me for tier, scopes, and remaining rows before metered pulls. > Search: resolve names with GET /v1/entities/lookup and pin ent_* IDs before pulling metered rows. Only person entities have appearances. Mention and recommendation rows carry canonical numeric timestamps in start_seconds/end_seconds (integer seconds; 0 means full episode); the MM:SS string fields are deprecated. Commercial routes need Pro+ tier AND the recommendations:read scope and bill 10 rows per row. > Monitors: a tracker watches one entity; a monitor groups trackers with shared delivery (email, Slack, HMAC-signed webhooks). Create trackers with POST /v1/trackers, then attach by id: POST /v1/monitors/{id}/trackers { trackerIds: [...] }. Each fired alert occurrence debits 100 rows. Poll GET /v1/monitors/{id}/alerts?n= for recent deliveries. Send Idempotency-Key on every POST/PATCH. > Transcripts: switch on the access field (unlocked, locked, premium_pending, not_transcribed, unauthenticated). Honor Retry-After when polling POST /v1/transcriptions jobs. Corrections (POST /v1/videos/{video_id}/corrections; kinds line_edit, speaker_reassign, speaker_identify, add_person, entity_tag, segment_rewrite) cost 0 rows; anchored kinds need revision + anchor.contentHash (djb2 base-36); handle 409 (re-anchor) and 412 (expectedSeq). segment_rewrite replaces an inclusive segment range with new segments (empty replacements array deletes; timestamps repaired server-side). > Community Review is free (0 rows) and surface-typed: POST /v1/feedback with a type matching the surface you called, the reproducing query, and corrections targeting public IDs (ent_*, men_*, com_*). Nothing auto-applies. Do not send untyped notes. > Errors: switch on error.code, follow doc_url, quote X-Request-Id to support. Honor Retry-After on 429. Retries of POST/PATCH must reuse the same Idempotency-Key; replays return Idempotency-Replayed: true. > Teams Admin API: GET /v1/team/members, /v1/team/spend, /v1/team/usage-events (cursor-paginated, 90-day bound) are read-only and require a team-scoped API key created by a team admin; personal keys get 403 team_key_required. # SSO > Configure SAML 2.0 or OIDC single sign-on: domain verification, provider setup, JIT provisioning, and enforcement. SAML 2.0 and OIDC SSO are included on Teams at no additional cost. Authenticate members through your existing identity provider (Okta, Entra ID, Google Workspace, and any other SAML or OIDC IdP), with automatic enrollment on first sign-in. ## Prerequisites * An Arcmira Teams plan and an Admin (or Unpaid Admin) role on the team * Admin access to your identity provider * A verified domain ### Verify your domain 1. Go to **Dashboard → Settings → Domains** and add your domain. Arcmira shows a DNS TXT record to create: ```text theme={null} Name: _arcmira-verify.example.com Value: arcmira-verify=tok_9f2c81d4a7 ``` 2. Create the record with your DNS provider, then click **Verify**. DNS propagation can take a few minutes. A domain can be verified by one team at a time, and consumer email domains (gmail.com and similar) cannot be claimed. ## Configure a provider In **Dashboard → Settings → Single Sign-On**, add a connection with: * **Provider ID**: a short slug for the connection (for example `okta-prod`). It becomes part of your service-provider URLs. * **Issuer / Entity ID**: your IdP's issuer value. * **Domain**: the verified domain whose users sign in through this provider. * **SAML**: paste your IdP's metadata XML. * **OIDC**: enter the client ID, client secret, and discovery endpoint (an `https://` URL; Arcmira resolves the discovery document at registration). ### Service provider endpoints Configure your IdP's SAML application with Arcmira's SP endpoints, substituting your provider ID: | Endpoint | URL | | -------------------------------- | -------------------------------------------------------------------------------- | | SP metadata | `https://api.arcmira.com/api/auth/sso/saml2/sp/metadata?providerId={providerId}` | | ACS (assertion consumer service) | `https://api.arcmira.com/api/auth/sso/saml2/sp/acs/{providerId}` | ## Just-in-time provisioning The first SSO sign-in from a verified-domain email creates the Arcmira account (when none exists) and enrolls it into the team automatically, as a Member on a Standard seat. Seats expand automatically to fit and the addition is prorated, the same as an invited member. ## Enforcement The **Enforce SSO** toggle in the Single Sign-On section blocks password and Google sign-in for every verified-domain email, leaving SSO as the only way in. Members sign in via the "Use single sign-on (SSO) instead" link on the sign-in page. Enforcement applies to every account whose email matches a verified domain, including admins. Confirm an SSO sign-in works end to end before enabling it. Enforcement requires a configured provider, and removing the last provider disables it automatically so a domain is never locked out. ## Multiple domains Verify each domain separately in **Settings → Domains**, then register a connection per domain. Each domain goes through DNS verification independently. ## Troubleshooting * Confirm the domain shows as verified in **Settings → Domains**. * Confirm the provider ID in your IdP's SP URLs matches the one you registered. * For SAML, re-paste the current IdP metadata XML if certificates rotated. * For OIDC, confirm the discovery endpoint is reachable over `https://` and the client secret is current. * If sign-in works but the user is not on the team, check that their email is on the verified domain: JIT enrollment keys off the email domain. * Still stuck? [Contact support](/docs/support) with the provider ID and the time of the failed sign-in attempt.