SSO Connection

API Reference

Organizations

SSO Connection

Enable

POST/organizations/{organization_id}/sso-connection

Retrieve

GET/organizations/{organization_id}/sso-connection

Update

PATCH/organizations/{organization_id}/sso-connection

Disable

DELETE/organizations/{organization_id}/sso-connection

ModelsExpand Collapse

SSOConnection = object { id, client_id, client_secret_set, 5 more }

SSO connection configuration for an organization

id: string

Unique identifier for the SSO connection

client_id: string

OAuth 2.0 client ID

client_secret_set: boolean

Whether a client secret is configured

created_at: string

The time the entity was created in utc

formatdate-time

identifier: string

SSO provider identifier (e.g., issuer URL)

minLength1

maxLength2048

updated_at: string

The time the entity was mostly recently updated in utc

formatdate-time

permissions: optional map[map[boolean]]

Permissions granted to the authenticated principal for this resource. Only populated when the 'expand[]=permissions' query parameter is provided. Keys are resource types (e.g., "organizations"), values are objects mapping permission names to boolean values indicating if the permission is granted.

protocols: optional SSOConnectionProtocol { oauth2, openid }

Protocol configuration for SSO connection

oauth2: optional object { authorization_endpoint, authorization_parameters, code_challenge_methods_supported, 4 more }

OAuth 2.0 protocol configuration for SSO connection

authorization_endpoint: optional string

OAuth 2.0 authorization endpoint

formaturi

authorization_parameters: optional map[string]

Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).

code_challenge_methods_supported: optional array of string

Supported PKCE code challenge methods

jwks_uri: optional string

JSON Web Key Set endpoint

formaturi

registration_endpoint: optional string

OAuth 2.0 registration endpoint

formaturi

scopes_supported: optional array of string

Supported OAuth 2.0 scopes

token_endpoint: optional string

OAuth 2.0 token endpoint

formaturi

openid: optional object { scopes, user_identifier_claim, userinfo_endpoint }

OpenID Connect protocol configuration for SSO connection

scopes: optional array of string

Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).

user_identifier_claim: optional string

Name of a top-level string claim in the provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.

userinfo_endpoint: optional string

OpenID Connect UserInfo endpoint

formaturi

SSOConnectionProtocol = object { oauth2, openid }

Protocol configuration for SSO connection

oauth2: optional object { authorization_endpoint, authorization_parameters, code_challenge_methods_supported, 4 more }

OAuth 2.0 protocol configuration for SSO connection

authorization_endpoint: optional string

OAuth 2.0 authorization endpoint

formaturi

authorization_parameters: optional map[string]

Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).

code_challenge_methods_supported: optional array of string

Supported PKCE code challenge methods

jwks_uri: optional string

JSON Web Key Set endpoint

formaturi

registration_endpoint: optional string

OAuth 2.0 registration endpoint

formaturi

scopes_supported: optional array of string

Supported OAuth 2.0 scopes

token_endpoint: optional string

OAuth 2.0 token endpoint

formaturi

openid: optional object { scopes, user_identifier_claim, userinfo_endpoint }

OpenID Connect protocol configuration for SSO connection

scopes: optional array of string

Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).

user_identifier_claim: optional string

Name of a top-level string claim in the provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.

userinfo_endpoint: optional string

OpenID Connect UserInfo endpoint

formaturi