---
title: "List SSO connections"
method: GET
path: "/sso-connection"
tags: ["SSO connections"]
---

# List SSO connections

`GET /sso-connection`

## Request

- Base URL: `https://api.elaichi.ai`
- URL: `https://api.elaichi.ai/sso-connection`
- Auth: HTTP bearer

Lists the organization's SSO connections (SAML and OIDC), cursor-paginated. Requires `sso:view` and the `sso` plan feature.

## Query parameters

- `limit` integer
- `cursor` string

## Headers

- `X-Organization-Id` string

## Response `200`

OK

- object
  - `result` object[], required
    - `id` string: SSO connection id (`sso_…`).
    - `organization_id` string: Owning organization (`org_…`).
    - `protocol` 'oidc' | 'saml'
    - `name` string
    - `is_active` boolean: A draft may be saved incomplete, but cannot be activated until the protocol's required fields are present.
    - `enforced` boolean: When enforced, users on the connection's verified domains can ONLY sign in through this IdP — social login and email codes are refused for them.
    - `is_default` boolean: The connection domain resolution picks when a domain has several.
    - `config` object: Protocol-specific IdP settings. Never contains secrets — the OIDC client secret is write-only.
      - `idp_entity_id` string: SAML: IdP entity id.
      - `idp_sso_url` string: SAML: IdP single sign-on URL.
      - `idp_x509_cert` string: SAML: IdP signing certificate (PEM).
      - `idp_metadata_xml` string: SAML: paste IdP metadata to populate the fields above. Accepted on write; never returned.
      - `issuer` string: OIDC: issuer URL.
      - `client_id` string: OIDC: relying-party client id.
      - `discovery_url` string: OIDC: discovery document URL.
      - `sign_authn_requests` boolean: SAML: sign SP-initiated AuthnRequests.
      - `allow_idp_initiated` boolean: SAML: accept unsolicited IdP-initiated responses. Rejected by default.
    - `default_role_id` string, nullable: Role (`role_…`) explicitly configured for users provisioned through this connection, or null to track the default. Org Owner is refused here. Read `effective_default_role_id` to learn what a JIT login actually grants.
    - `effective_default_role_id` string, nullable: Server-computed: the role SSO just-in-time provisioning through this connection really grants. Equals `default_role_id` when that is set and the role still exists; otherwise the **Member** system role, which is what the join falls back to both when nothing is configured and when the configured role has since been deleted. `null` means even that fallback is missing, so auto-provisioning through this connection is broken and the first login seats nobody.
    - `has_client_secret` boolean: Whether an OIDC client secret is stored. The secret itself is never returned.
    - `urls` object: The protocol URLs to hand to the IdP administrator (ACS / metadata / callback, by protocol).
    - `created_at` string, date-time
    - `updated_at` string, date-time
  - `next_cursor` string, nullable, required
  - `prev_cursor` string, nullable, required

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `429`: Rate limited

---

[API](https://skmtc.dev/elaichi/apis/elaichi-api.md) · [All operations](https://skmtc.dev/elaichi/apis/elaichi-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaichi/apis/elaichi-api/revisions/b22cfb7b6d15?raw)