---
title: "Discard pending SSO connection changes"
method: POST
path: "/sso-connections/{id}/discard-pending"
tags: ["Settings"]
---

# Discard pending SSO connection changes

`POST /sso-connections/{id}/discard-pending`

## Request

- Base URL: `https://api.cavuno.com/v1`
- URL: `https://api.cavuno.com/v1/sso-connections/{id}/discard-pending`
- Auth: HTTP bearer

Drops `pendingChanges`. The live settings are untouched.

## Path parameters

- `id` string, required: The SSO connection ID returned by create or list endpoints.

## Response `200`

Successful response.

- SsoConnection
  - `id` string, required: Unique identifier for the SSO connection.
  - `object` 'sso_connection', required
  - `protocol` 'oidc' | 'oauth2_userinfo' | 'saml', required
  - `label` string, required
  - `provider` 'okta' | 'generic_oidc' | 'generic_oauth2', nullable, required: The identity provider the connection is for: `okta`, or `generic_oidc` / `generic_oauth2` for any other provider that supports OpenID Connect or OAuth 2.0. Only used to name the provider in the dashboard’s setup steps; it does not change how sign-in works.
  - `issuer` string, required: The provider issuer URL; empty on a draft not set up yet.
  - `status` 'draft' | 'tested' | 'enabled' | 'disabled', required: Deprecated: use liveConfigTested and offeredToCandidates/offeredToEmployers.
  - `candidateSignInMode` 'off' | 'available' | 'required', required: Deprecated: use per-role connection switches and settings.signInMethods instead.
  - `employerSignInMode` 'off' | 'available' | 'required', required: Deprecated: use per-role connection switches and settings.signInMethods instead.
  - `discoveryUrl` string, nullable, required
  - `authorizationEndpoint` string, nullable, required
  - `tokenEndpoint` string, nullable, required
  - `userinfoEndpoint` string, nullable, required
  - `jwksUri` string, nullable, required
  - `scopes` string[], nullable, required
  - `clientId` string, required: The client ID; empty on a draft not set up yet.
  - `hasClientSecret` boolean, required: Whether a client secret is stored. The secret is never returned.
  - `claimNames` SsoConnectionClaimNames, nullable, required
    - `subject` string, nullable: Claim holding the stable member ID. Defaults to `sub`.
    - `email` string, nullable: Claim holding the email. Defaults to `email`.
    - `emailVerified` string, nullable: Claim saying whether the email is verified. Defaults to `email_verified`.
    - `displayName` string, nullable: Claim holding the display name. Defaults to `name`.
  - `trustedProviderEmail` boolean, required
  - `provisioning` 'auto_create' | 'pre_provisioned_only', required: `auto_create` creates a board account on first sign-in; `pre_provisioned_only` signs in only people who already have one.
  - `offeredToCandidates` boolean, required: Whether candidates can sign in with this connection.
  - `offeredToEmployers` boolean, required: Whether employers can sign in with this connection.
  - `liveConfigTested` boolean, required: A test passed on the live settings, so the connection can be switched on. Until then both switches stay off.
  - `pendingChanges` SsoConnectionPendingChanges, nullable, required: Settings edits on a tested connection wait here until a test passes on them and they are saved in the dashboard; sign-ins keep using the live settings meanwhile.
    - `protocol` 'oidc' | 'oauth2_userinfo', required: `oidc` for OpenID Connect providers (discovery and ID tokens); `oauth2_userinfo` for OAuth 2.0 providers that expose a userinfo endpoint instead.
    - `issuer` string, required
    - `discoveryUrl` string, nullable, required
    - `authorizationEndpoint` string, nullable, required
    - `tokenEndpoint` string, nullable, required
    - `userinfoEndpoint` string, nullable, required
    - `jwksUri` string, nullable, required
    - `scopes` string[], nullable, required
    - `clientId` string, required
    - `hasClientSecret` boolean, required
    - `claimNames` SsoConnectionClaimNames, nullable, required
      - `subject` string, nullable: Claim holding the stable member ID. Defaults to `sub`.
      - `email` string, nullable: Claim holding the email. Defaults to `email`.
      - `emailVerified` string, nullable: Claim saying whether the email is verified. Defaults to `email_verified`.
      - `displayName` string, nullable: Claim holding the display name. Defaults to `name`.
  - `callbackUrl` string, required: The redirect URL to register at the provider.
  - `lastTestPassedAt` string, nullable, required
  - `createdAt` string, required
  - `updatedAt` string, required

## Other responses

- `404`: SSO connection not found.

## Changes

- **2026-10-19** `c34152c38176`: 1 info
  - added the optional property `error/upgrade` to the response with the `404` status

[Operation history](https://skmtc.dev/cavuno/apis/cavuno-v1-rest-api/changes/sso-connections/:id/discard-pending/post.md)

---

[API](https://skmtc.dev/cavuno/apis/cavuno-v1-rest-api.md) · [All operations](https://skmtc.dev/cavuno/apis/cavuno-v1-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cavuno/apis/cavuno-v1-rest-api/revisions/d5974dabff14?raw)