--- title: Logout Settings description: Enables and configures single logout (SLO) settings for applications using OIDC, SAML, and WS-Federation protocols. component: pingone-api page_id: pingone-api:platform:applications/logout-settings/index canonical_url: https://developer.pingidentity.com/pingone-api/platform/applications/logout-settings/index.html llms_txt: https://developer.pingidentity.com/pingone-api/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-10-16 page_aliases: ["applications/applications-settings.adoc"] section_ids: logout-settings-data-model: Logout settings data model --- # Logout Settings The Logout Settings service enables or disables single logout (SLO) for applications using OIDC, SAML, and WS-Federation protocols. ## Logout settings data model | Property | Type | Required? | Mutable? | Description | | -------------------------------------- | --------- | --------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `environment.id` | String | N/A | Read-only | The environment associated with the application. | | `enableCrossProtocolSLO` | Boolean | Optional | Mutable | Enables or disables cross protocol single logout (SLO). Defaults to `false`. If enabled, and PingOne receives one of the following supported protocol logout requests:- An OpenID Connect (OIDC) relying party (RP)-initiated logout at `{{authPath}}/{{envID}}/as/signoff` - A WS-Federation wa=wsignout1.0 request at `/wsf/prp/{appID}` - A SAML 2.0 SLO request from a SAML application at `/saml20/idp/slo` - A SAML 2.0 SLO request from a SAML IdP at `/saml20/sp/slo` - An HTTP GET request at `/saml20/startslo`PingOne sends the following logout requests to applications and IdPs associated with the same session:- OIDC front-channel logout requests to OIDC-based applications - WS-Federation wa=wsignoutcleanup1.0 cleanup requests to WS-FED applications - SAML 2.0 SLO to and from SAML applications - SAML 2.0 SLO to and from SAML IdPsPingOne sends asynchronous OIDC and WS-Federation logout messages first, followed by SAML 2.0 logout messages. | | `enableAltOidcPostLogoutUriValidation` | Boolean | Optional | Mutable | When set to `true`, enables validation of the `post_logout_redirect_uri` parameter for [Post Signoff (Cross-Protocol)](../../../auth/openid-connect-oauth-2/authorization/post-signoff-cross-protocol.html) against the values for the `postLogoutRedirectUris` property. This is applicable only when the request does not include the `id_token_hint` parameter or includes one, but without a valid ID token as its value. When enabled, PingOne uses these redirect URIs instead of the application's signoff URLs. When cross-protocol logout is enabled, this setting is automatically enabled and can't be disabled. | | `postLogoutRedirectUris` | String\[] | Optional | Mutable | The URLs that the browser can be redirected to after logout. Each entry must be an absolute URL, and cannot contain a fragment component. Case-insensitive matching is used to determine whether the URI in the request is allowed. Wildcards are not accepted.PingOne always validates `post_logout_redirect_uri` values against this list for requests sent to `{{authPath}}/{{envID}}/as/signoff` and `/saml20/startslo`. If there is no match, PingOne aborts the logout requests.If `enableAltOidcPostLogoutUriValidation` is enabled, the `post_logout_redirect_uri` value must match one of these URLs exactly when:- The OIDC RP-initiated request does not include the `id_token_hint` parameter or includes one without a valid ID token as its value. - The the request includes the `post_logout_redirect_uri` parameter.For WS-Federation sign-off requests to `/wsf/prp/`, PingOne always validates the `wreply` value against this list. If there is no match, PingOne aborts the logout requests. |