# SAML response inspector - Human page: https://happytails.ai/en/developer-tools/saml-response-inspector/ - Markdown: https://happytails.ai/en/developer-tools/saml-response-inspector.md - Structured JSON: https://happytails.ai/agents/en/developer-tools/saml-response-inspector/index.json - Visibility: public ## Tool capabilities | Property | Value | | --- | --- | | Tool ID | `saml-response-inspector` | | Category | developer-tools | | Implementation | Registered implementation. Registration alone is not a production-quality guarantee. | | Browser execution | Use the visible action or interactive controls. | | Browser processing | Browser; see tool notes for network behavior. | | HTTP API | Not callable through HTTP. | | Browser-agent interface | run_current_tool | ### Implementation notes Decoded in your browser; nothing is sent to your identity provider. Up to 1000000 characters. ### Inputs and settings Text input: SAML message. Example or placeholder shown in the interface (not a validated fixture): ```text PHNhbWxwOlJlc3BvbnNlIC4uLg== ``` Paste the SAMLResponse value, a redirect URL or the XML. Up to 1,000,000 characters. Review the settings before running. | Setting | Meaning | Control type | Default | Constraints | | --- | --- | --- | --- | --- | | `time` | Check time windows at (UTC or Unix seconds) | text | "2026-10-16T12:00:00Z" | | | `maskPersonalData` | Mask names, emails and attribute values | checkbox | true | | ### Browser-agent workflow 1. Open the human page in a browser that supports WebMCP. 2. Discover the interface exposed by that page; use its actual schema. 3. Select files on the page first when the tool requires files. 4. Call `run_current_tool` with valid input and settings. 5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links. Calls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution. ### Planning specification Input up to 1000000 characters, decoded messages up to 2000000 bytes, 64 levels and 20000 elements. Decoding runs locally in a background worker. Download a JSON report, plus the decoded XML when masking is off. This describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support. ### Complete machine-readable capability record ```json { "id": "saml-response-inspector", "category": "developer-tools", "built": true, "requirements": "Input up to 1000000 characters, decoded messages up to 2000000 bytes, 64 levels and 20000 elements. Decoding runs locally in a background worker. Download a JSON report, plus the decoded XML when masking is off.", "implementation": { "fields": [ { "key": "time", "label": "Check time windows at (UTC or Unix seconds)", "value": "2026-10-16T12:00:00Z", "type": "text" }, { "key": "maskPersonalData", "label": "Mask names, emails and attribute values", "value": true, "type": "checkbox" } ], "registrationFamily": "crypto-formats-signed-envelopes", "inputMaxLength": 1000000, "inputErrorCode": "CRYPTO_FORMATS_SIGNED_ENVELOPES_TOO_LONG_SAML", "note": "Decoded in your browser; nothing is sent to your identity provider. Up to 1000000 characters.", "experience": { "automatic": false, "single": false, "inputMaxLength": 1000000, "inputMode": "text", "label": "SAML message", "placeholder": "PHNhbWxwOlJlc3BvbnNlIC4uLg==", "help": "Paste the SAMLResponse value, a redirect URL or the XML. Up to 1,000,000 characters. Review the settings before running.", "action": null }, "mode": "explicit", "interactive": false }, "execution": "Browser interface", "api": null, "browser_agent": { "supported": true, "name": "run_current_tool", "discovery": "WebMCP on the human page in a supporting browser", "verification": "See audit/API-AUDIT.md; availability is not verification" } } ``` ## Page guide Decode a SAML response or request in your browser and read its issuer, status, subject, conditions, audience and attributes. Personal data is masked by default, and nothing is sent anywhere. How can we improve this tool? Report a problem or share an idea. Please leave out private information. Your message and the tool name go to our team via PostHog. ### How to use SAML response inspector 1. Paste the SAMLResponse value, the whole redirect URL or the XML. 2. Enter the time to check the validity windows against. 3. Keep masking on if you plan to share the report. 4. Run the tool and review the assertion details. ## Useful next steps - [Base64 encoder decoder](https://happytails.ai/en/developer-tools/base64-encoder-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/base64-encoder-decoder.md)) - [URL encoder decoder](https://happytails.ai/en/developer-tools/url-encoder-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/url-encoder-decoder.md)) - [JWT decoder](https://happytails.ai/en/developer-tools/jwt-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/jwt-decoder.md)) ## Bindings HTTP-POST messages are Base64; HTTP-Redirect messages are raw DEFLATE, then Base64 and URL encoding, as defined in the SAML 2.0 bindings specification (OASIS, March 2005). The tool detects which one you pasted and also accepts plain XML. ### Safe parsing XML with a DOCTYPE or entity declarations is refused before parsing, so entity expansion and external entity attacks cannot run. Depth, element count and size are bounded, and any parser warning stops the run. ### What it shows and does not check Time windows are compared with the time you enter, with NotOnOrAfter exclusive. Times are read as xs:dateTime in UTC, as SAML core section 1.3.3 requires: a time without a zone is UTC, an offset such as +02:00 is applied, and any other form is reported as unreadable-time. Signatures are listed, not verified; use the SAML signature verifier with your identity provider certificate for that. Encrypted assertions are counted but not decrypted.