---
title: SP adapter scripting API
description: Access bindings and objects available to SP adapter scripts in PingAM for customizing SAML single sign-on, logout, and name identifier management functions
component: pingam
version: 8
page_id: pingam:am-scripting:saml2-sp-adapter-api
canonical_url: https://docs.pingidentity.com/pingam/8.1/am-scripting/saml2-sp-adapter-api.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-06-01T14:34:20Z
page_aliases: ["scripting-guide:saml2-sp-adapter-api.adoc"]
superseded_by: https://docs.pingidentity.com/pingam/8.1/am-scripting/saml2-sp-adapter-api.html
---

# SP adapter scripting API

|   |                                                                                                                                                                    |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|   | The SP adapter script is a legacy script and therefore has access to all the *legacy* [common bindings](script-bindings.html) in addition to those described here. |

| Binding                 | Description                                                                                                                                                                                                                                                                                                        |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `authnRequest`          | The original authentication request sent from the SP.Only available to single sign-on functions.Refer to [AuthnRequest](../_attachments/apidocs/com/sun/identity/saml2/protocol/AuthnRequest.html).                                                                                                                |
| `binding`               | The binding used for the name identifier request: `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect` or `urn:oasis:names:tc:SAML:2.0:bindings:SOAP`Not available to single sign-on functions.                                                                                                                    |
| `failureCode`           | The failure code associated with the error that has occurred. For possible values, refer to [SPAdapter](../_attachments/apidocs/org/forgerock/openam/saml2/plugins/SPAdapter.html).Only available to `preSendFailureResponse`.                                                                                     |
| `hostedEntityId`        | The entity ID for the hosted SP.                                                                                                                                                                                                                                                                                   |
| `idpEntityID`           | The entity ID for the IDP that sends the sign-on request.                                                                                                                                                                                                                                                          |
| `idRequest`             | The [ManageNameIDRequest](../_attachments/apidocs/com/sun/identity/saml2/protocol/ManageNameIDRequest.html) object for the name identifier request.Only available to `postNewNameIDSuccess` and `postTerminateNameIDSuccess`.                                                                                      |
| `idResponse`            | The [ManageNameIDResponse](../_attachments/apidocs/com/sun/identity/saml2/protocol/ManageNameIDResponse.html) object for the name identifier request.Only available to `postNewNameIDSuccess` and `postTerminateNameIDSuccess`.                                                                                    |
| `isFederation`          | A boolean indicating whether federation is True if using federation, otherwise false.Only available to the `postSingleSignOnSuccess` function.                                                                                                                                                                     |
| `logoutRequest`         | The single logout [LogoutRequest](../_attachments/apidocs/com/sun/identity/saml2/protocol/LogoutRequest.html).Only available to `preSingleLogoutProcess` and `postSingleLogoutProcess`.                                                                                                                            |
| `logoutResponse`        | The single logout [LogoutResponse](../_attachments/apidocs/com/sun/identity/saml2/protocol/LogoutResponse.html).Only available to `preSingleLogoutProcess` and `postSingleLogoutProcess`.                                                                                                                          |
| `out`                   | The [PrintWriter](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/io/PrintWriter.html) for writing to.Only available to `postSingleSignOnSuccess`.                                                                                                                                               |
| `profile`               | The protocol profile used: `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST`, `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact` or `urn:oasis:names:tc:SAML:2.0:bindings:PAOS`.Available to `preSingleSignOnProcess`, `postSingleSignOnSuccess`, and `postSingleSignOnFailure`.                                  |
| `request`               | The [HttpServletRequest](https://tomcat.apache.org/tomcat-10.0-doc/servletapi/jakarta/servlet/http/HttpServletRequest.html) object.Always present.                                                                                                                                                                 |
| `response`              | The [HttpServletResponse](https://tomcat.apache.org/tomcat-10.0-doc/servletapi/jakarta/servlet/http/HttpServletResponse.html) object.Always present.                                                                                                                                                               |
| `session`               | Only available to `postSingleSignOnSuccess`.Contains a representation of the user's single sign-on session object. Refer to the [SSOToken](../_attachments/apidocs/com/iplanet/sso/SSOToken.html) interface for information about SSO token and authentication information, as well as session-related properties. |
| `spAdapterScriptHelper` | The [SpAdapterScriptHelper](../_attachments/apidocs/com/sun/identity/saml2/plugins/scripted/SpAdapterScriptHelper.html) instance contains supporting methods that provide context information when customizing the SP adapter plugin points.Always present.                                                        |
| `res`                   | The SSO Response received from the IdP.Available to `preSingleSignOnProcess`, `postSingleSignOnSuccess`, and `postSingleSignOnFailure`.                                                                                                                                                                            |
| `userId`                | The unique universal ID of the user associated with the request.Not available to single sign-on functions.                                                                                                                                                                                                         |