---
title: "List SSO connections"
method: GET
path: "/sso-connections"
tags: ["Settings"]
---

# List SSO connections

`GET /sso-connections`

## Request

- Base URL: `https://api.cavuno.com/v1`
- URL: `https://api.cavuno.com/v1/sso-connections`
- Auth: HTTP bearer

Returns the board’s SSO connections, oldest first. A board has at most five.

## Response `200`

Successful response.

- object
  - `object` 'list', required
  - `url` string, required
  - `hasMore` boolean, required
  - `nextCursor` string, nullable, required
  - `data` SsoConnection[], required
    - `id` string, required: Unique identifier for the SSO connection.
    - `object` 'sso_connection', required
    - `protocol` 'oidc' | 'oauth2_userinfo' | 'saml', required
    - `label` string, required
    - `provider` 'okta' | 'generic_oidc' | 'generic_oauth2', nullable, required: The identity provider the connection is for: `okta`, or `generic_oidc` / `generic_oauth2` for any other provider that supports OpenID Connect or OAuth 2.0. Only used to name the provider in the dashboard’s setup steps; it does not change how sign-in works.
    - `issuer` string, required: The provider issuer URL; empty on a draft not set up yet.
    - `status` 'draft' | 'tested' | 'enabled' | 'disabled', required: Deprecated: use liveConfigTested and offeredToCandidates/offeredToEmployers.
    - `candidateSignInMode` 'off' | 'available' | 'required', required: Deprecated: use per-role connection switches and settings.signInMethods instead.
    - `employerSignInMode` 'off' | 'available' | 'required', required: Deprecated: use per-role connection switches and settings.signInMethods instead.
    - `discoveryUrl` string, nullable, required
    - `authorizationEndpoint` string, nullable, required
    - `tokenEndpoint` string, nullable, required
    - `userinfoEndpoint` string, nullable, required
    - `jwksUri` string, nullable, required
    - `scopes` string[], nullable, required
    - `clientId` string, required: The client ID; empty on a draft not set up yet.
    - `hasClientSecret` boolean, required: Whether a client secret is stored. The secret is never returned.
    - `claimNames` SsoConnectionClaimNames, nullable, required
      - `subject` string, nullable: Claim holding the stable member ID. Defaults to `sub`.
      - `email` string, nullable: Claim holding the email. Defaults to `email`.
      - `emailVerified` string, nullable: Claim saying whether the email is verified. Defaults to `email_verified`.
      - `displayName` string, nullable: Claim holding the display name. Defaults to `name`.
    - `trustedProviderEmail` boolean, required
    - `provisioning` 'auto_create' | 'pre_provisioned_only', required: `auto_create` creates a board account on first sign-in; `pre_provisioned_only` signs in only people who already have one.
    - `offeredToCandidates` boolean, required: Whether candidates can sign in with this connection.
    - `offeredToEmployers` boolean, required: Whether employers can sign in with this connection.
    - `liveConfigTested` boolean, required: A test passed on the live settings, so the connection can be switched on. Until then both switches stay off.
    - `pendingChanges` SsoConnectionPendingChanges, nullable, required: Settings edits on a tested connection wait here until a test passes on them and they are saved in the dashboard; sign-ins keep using the live settings meanwhile.
      - `protocol` 'oidc' | 'oauth2_userinfo', required: `oidc` for OpenID Connect providers (discovery and ID tokens); `oauth2_userinfo` for OAuth 2.0 providers that expose a userinfo endpoint instead.
      - `issuer` string, required
      - `discoveryUrl` string, nullable, required
      - `authorizationEndpoint` string, nullable, required
      - `tokenEndpoint` string, nullable, required
      - `userinfoEndpoint` string, nullable, required
      - `jwksUri` string, nullable, required
      - `scopes` string[], nullable, required
      - `clientId` string, required
      - `hasClientSecret` boolean, required
      - `claimNames` SsoConnectionClaimNames, nullable, required
        - `subject` string, nullable: Claim holding the stable member ID. Defaults to `sub`.
        - `email` string, nullable: Claim holding the email. Defaults to `email`.
        - `emailVerified` string, nullable: Claim saying whether the email is verified. Defaults to `email_verified`.
        - `displayName` string, nullable: Claim holding the display name. Defaults to `name`.
    - `callbackUrl` string, required: The redirect URL to register at the provider.
    - `lastTestPassedAt` string, nullable, required
    - `createdAt` string, required
    - `updatedAt` string, required

## Other responses

- `default`: An error. Every non-2xx response uses the same envelope; see the Errors section of the introduction.

## Changes

- **2026-10-19** `c34152c38176`: 1 info
  - added the optional property `error/upgrade` to the response with the `default` status

[Operation history](https://skmtc.dev/cavuno/apis/cavuno-v1-rest-api/changes/sso-connections/get.md)

---

[API](https://skmtc.dev/cavuno/apis/cavuno-v1-rest-api.md) · [All operations](https://skmtc.dev/cavuno/apis/cavuno-v1-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cavuno/apis/cavuno-v1-rest-api/revisions/d5974dabff14?raw)