passive SAML for APIs