Access and testing - Rima Partner API

Rima must confirm test identities and connection settings before Sandbox testing. After your IdP authenticates a user, Rima checks the identity and the user’s Rima access.

Sign-in state	Behavior
First sign-in	Rima looks for an existing account with the asserted email, then records a link from the `providerId` and OIDC `sub` or SAML NameID. A new account requires a pending, unexpired Rima invitation.
Repeat sign-in	Rima uses the recorded provider and subject link.
Existing account	The account needs Rima membership or an eligible invitation. An eligible invitation can be accepted automatically when exactly one matches the Rima launch.
Ineligible access	Missing, expired, wrong-tenant, or ambiguous invitations do not grant access. Admin and superadmin accounts are rejected by this flow.

Verify the Sandbox connection

Rima supplies mapped fixture identities, the required account and invitation states, destinations, and reset instructions. Your team supplies IdP test identities. Together, test:

First sign-in, repeat sign-in, and reuse of the identity link.
Existing membership, one eligible invitation, and no eligible invitation.
Invalid or missing claims and IdP or Rima service failures. Failed authentication must not grant access.

Prepare production

After Sandbox verification, Rima provides separate production registration settings and confirms a pilot identity and launch URL. Register those values in your production IdP, run a pilot sign-in, and agree on contacts and credential or certificate ownership before activation.

​First and repeat sign-in

​Verify the Sandbox connection

​Prepare production

First and repeat sign-in

Verify the Sandbox connection

Prepare production