Skip to content
Docs

SSO Connection

API Reference
Organizations

SSO Connection

Enable
organizations.sso_connection.enable(strorganization_id, SSOConnectionEnableParams**kwargs) -> SSOConnection
POST/organizations/{organization_id}/sso-connection
Retrieve
organizations.sso_connection.retrieve(strorganization_id, SSOConnectionRetrieveParams**kwargs) -> SSOConnection
GET/organizations/{organization_id}/sso-connection
Update
organizations.sso_connection.update(strorganization_id, SSOConnectionUpdateParams**kwargs) -> SSOConnection
PATCH/organizations/{organization_id}/sso-connection
Disable
organizations.sso_connection.disable(strorganization_id, SSOConnectionDisableParams**kwargs)
DELETE/organizations/{organization_id}/sso-connection
ModelsExpand Collapse
class SSOConnection: …

SSO connection configuration for an organization

id: str

Unique identifier for the SSO connection

client_id: Optional[str]

OAuth 2.0 client ID

client_secret_set: bool

Whether a client secret is configured

created_at: datetime

The time the entity was created in utc

formatdate-time
identifier: str

SSO provider identifier (e.g., issuer URL)

minLength1
maxLength2048
updated_at: datetime

The time the entity was mostly recently updated in utc

formatdate-time
permissions: Optional[Dict[str, Dict[str, bool]]]

Permissions granted to the authenticated principal for this resource. Only populated when the 'expand[]=permissions' query parameter is provided. Keys are resource types (e.g., "organizations"), values are objects mapping permission names to boolean values indicating if the permission is granted.

protocols: Optional[SSOConnectionProtocol]

Protocol configuration for SSO connection

oauth2: Optional[Oauth2]

OAuth 2.0 protocol configuration for SSO connection

authorization_endpoint: Optional[str]

OAuth 2.0 authorization endpoint

formaturi
authorization_parameters: Optional[Dict[str, str]]

Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).

code_challenge_methods_supported: Optional[List[str]]

Supported PKCE code challenge methods

jwks_uri: Optional[str]

JSON Web Key Set endpoint

formaturi
registration_endpoint: Optional[str]

OAuth 2.0 registration endpoint

formaturi
scopes_supported: Optional[List[str]]

Supported OAuth 2.0 scopes

token_endpoint: Optional[str]

OAuth 2.0 token endpoint

formaturi
openid: Optional[Openid]

OpenID Connect protocol configuration for SSO connection

scopes: Optional[List[str]]

Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).

user_identifier_claim: Optional[str]

Name of a top-level string claim in the provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.

userinfo_endpoint: Optional[str]

OpenID Connect UserInfo endpoint

formaturi
class SSOConnectionProtocol: …

Protocol configuration for SSO connection

oauth2: Optional[Oauth2]

OAuth 2.0 protocol configuration for SSO connection

authorization_endpoint: Optional[str]

OAuth 2.0 authorization endpoint

formaturi
authorization_parameters: Optional[Dict[str, str]]

Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).

code_challenge_methods_supported: Optional[List[str]]

Supported PKCE code challenge methods

jwks_uri: Optional[str]

JSON Web Key Set endpoint

formaturi
registration_endpoint: Optional[str]

OAuth 2.0 registration endpoint

formaturi
scopes_supported: Optional[List[str]]

Supported OAuth 2.0 scopes

token_endpoint: Optional[str]

OAuth 2.0 token endpoint

formaturi
openid: Optional[Openid]

OpenID Connect protocol configuration for SSO connection

scopes: Optional[List[str]]

Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).

user_identifier_claim: Optional[str]

Name of a top-level string claim in the provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.

userinfo_endpoint: Optional[str]

OpenID Connect UserInfo endpoint

formaturi