idstring required
Unique identifier for the SSO connection.
object'sso_connection' required
protocol'oidc' | 'oauth2_userinfo' | 'saml' required
provider'okta' | 'generic_oidc' | 'generic_oauth2' nullable required
The identity provider the connection is for: okta, or generic_oidc / generic_oauth2 for any other provider that supports OpenID Connect or OAuth 2.0. Only used to name the provider in the dashboard’s setup steps; it does not change how sign-in works.
issuerstring required
The provider issuer URL; empty on a draft not set up yet.
status'draft' | 'tested' | 'enabled' | 'disabled' required
Deprecated: use liveConfigTested and offeredToCandidates/offeredToEmployers.
candidateSignInMode'off' | 'available' | 'required' required
Deprecated: use per-role connection switches and settings.signInMethods instead.
employerSignInMode'off' | 'available' | 'required' required
Deprecated: use per-role connection switches and settings.signInMethods instead.
discoveryUrlstring nullable required
authorizationEndpointstring nullable required
tokenEndpointstring nullable required
userinfoEndpointstring nullable required
jwksUristring nullable required
scopesstring[] nullable required
clientIdstring required
The client ID; empty on a draft not set up yet.
hasClientSecretboolean required
Whether a client secret is stored. The secret is never returned.
trustedProviderEmailboolean required
provisioning'auto_create' | 'pre_provisioned_only' required
auto_create creates a board account on first sign-in; pre_provisioned_only signs in only people who already have one.
offeredToCandidatesboolean required
Whether candidates can sign in with this connection.
offeredToEmployersboolean required
Whether employers can sign in with this connection.
liveConfigTestedboolean required
A test passed on the live settings, so the connection can be switched on. Until then both switches stay off.
callbackUrlstring required
The redirect URL to register at the provider.
lastTestPassedAtstring nullable required