---
title: "Get an SSO connection"
method: GET
path: "/sso-connection/{id}"
tags: ["SSO connections"]
---

# Get an SSO connection

`GET /sso-connection/{id}`

## Request

- Base URL: `https://api.elaichi.ai`
- URL: `https://api.elaichi.ai/sso-connection/{id}`
- Auth: HTTP bearer

Returns one SSO connection, including the `urls` to hand to the IdP administrator. Secrets are never included. Requires `sso:view`.

## Path parameters

- `id` string, required

## Headers

- `X-Organization-Id` string

## Response `200`

OK

- object
  - `id` string: SSO connection id (`sso_…`).
  - `organization_id` string: Owning organization (`org_…`).
  - `protocol` 'oidc' | 'saml'
  - `name` string
  - `is_active` boolean: A draft may be saved incomplete, but cannot be activated until the protocol's required fields are present.
  - `enforced` boolean: When enforced, users on the connection's verified domains can ONLY sign in through this IdP — social login and email codes are refused for them.
  - `is_default` boolean: The connection domain resolution picks when a domain has several.
  - `config` object: Protocol-specific IdP settings. Never contains secrets — the OIDC client secret is write-only.
    - `idp_entity_id` string: SAML: IdP entity id.
    - `idp_sso_url` string: SAML: IdP single sign-on URL.
    - `idp_x509_cert` string: SAML: IdP signing certificate (PEM).
    - `idp_metadata_xml` string: SAML: paste IdP metadata to populate the fields above. Accepted on write; never returned.
    - `issuer` string: OIDC: issuer URL.
    - `client_id` string: OIDC: relying-party client id.
    - `discovery_url` string: OIDC: discovery document URL.
    - `sign_authn_requests` boolean: SAML: sign SP-initiated AuthnRequests.
    - `allow_idp_initiated` boolean: SAML: accept unsolicited IdP-initiated responses. Rejected by default.
  - `default_role_id` string, nullable: Role (`role_…`) explicitly configured for users provisioned through this connection, or null to track the default. Org Owner is refused here. Read `effective_default_role_id` to learn what a JIT login actually grants.
  - `effective_default_role_id` string, nullable: Server-computed: the role SSO just-in-time provisioning through this connection really grants. Equals `default_role_id` when that is set and the role still exists; otherwise the **Member** system role, which is what the join falls back to both when nothing is configured and when the configured role has since been deleted. `null` means even that fallback is missing, so auto-provisioning through this connection is broken and the first login seats nobody.
  - `has_client_secret` boolean: Whether an OIDC client secret is stored. The secret itself is never returned.
  - `urls` object: The protocol URLs to hand to the IdP administrator (ACS / metadata / callback, by protocol).
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `429`: Rate limited

---

[API](https://skmtc.dev/elaichi/apis/elaichi-api.md) · [All operations](https://skmtc.dev/elaichi/apis/elaichi-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaichi/apis/elaichi-api/revisions/b22cfb7b6d15?raw)