anchor.diff:  
   Follow the steps below to enable SSO for your organization. You will also need to set up Buildkite in your identity provider, there are guides available for [Google](/docs/tutorials/google), [Okta](/docs/tutorials/okta), [OneLogin](/docs/tutorials/onelogin), [AD FS](/docs/tutorials/adfs), and [custom SAML setups](/docs/tutorials/custom-saml). 
   
  -## How to enable SSO for your Org
  +<%= toc %>
  +
  +## How to enable SSO with GraphQL
   
   - you need the service URL from Buildkite before you can finish setting up things in your identity provider
   
   - overview: set up a blank SSO provider in Buildkite, do the set up in your SSO provider, come back and update your blank Buildkite SSO to contain the details of your provider
   - the set up on the Buildkite side is done via a series of graphql operations
  -- this guide isn't an api reference and so won't cover every available option
  -- if you haven't used our graphql explorer before, check out our [api guide](/docs/graphql-api#getting-started)
  -- full documentation is available in the graphql explorer
  -
  -### Get your Organization ID
  -
  -- to set up your organization for SSO, you need your Organization ID
  -- this can be found on your Organization Settings page in Buildkite 
  -- this id will be required in all other sso methods
  -
  -### Create your SSO provider
  +
  +This guide is not intended as an API reference, and so won't cover every available option. If you haven't used our graphql explorer, check out our [API guide](/docs/graphql-api#getting-started). Full API documentation is available in the graphql explorer.
  +
  +### Part 1 of 4: Get your Organization ID
  +
  +To begin setting up your organization with SSO, you need your Buildkite Organization ID. This can be found on your 'Organization Settings' page in Buildkite.
  +
  +### Part 2 of 4: Create your SSO provider
   
   - use the create method to create a blank 
   - after you set up your id provider, you will come back and fill in the provider details using the update method
  
positive.code: - generate an API token from your personal settings page that has access to the graphql beta, and use that to log in to the graphql explorer
  - docs can be found in the top right corner, and are searchable
  
  ## Other operations
  
  ### Create a SAML provider with data
  
  
negative.code: - test the login flow, ensure that a user can successfully complete the new authentication and gain access to your buildkite organization before continuing
  - the enable method will error if a successful test hasn't occurred
  
  ### Part 3 of 4: Enable the provider for your organization
  
  - after testing that the new authorisation url works and can log in a user with the correct email domain, you can enable the sso provider for your buildkite organization
  - use the enable method with your provider id, you can retrieve this using the get mutation 
  