---
title: "Remove the SSO connection (owner, session signed in within 5 minutes). Members keep their accounts"
method: DELETE
path: "/orgs/{orgId}/sso"
tags: ["Teams"]
---

# Remove the SSO connection (owner, session signed in within 5 minutes). Members keep their accounts

`DELETE /orgs/{orgId}/sso`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/orgs/{orgId}/sso`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `orgId` string, uuid, required

## Response `200`

SSO

- object
  - `role` 'owner' | 'admin' | 'developer' | 'viewer' | 'billing' | 'editor', required: `editor` is a legacy role: existing members keep it, it can no longer be assigned
  - `connection` object, nullable, required
    - `id` string, uuid, required
    - `protocol` 'oidc' | 'saml', required
    - `provider` 'google' | 'microsoft' | 'okta' | 'oidc' | 'saml', required
    - `name` string, required
    - `enabled` boolean, required
    - `enforce` boolean, required
    - `jitProvisioning` boolean, required
    - `defaultRole` 'developer' | 'viewer' | 'billing', required
    - `oidc` object, nullable, required
      - `issuer` string, required
      - `clientId` string, required
      - `hasClientSecret` boolean, required
      - `tenantId` string, nullable, required
    - `saml` object, nullable, required
      - `entityId` string, required
      - `ssoUrl` string, required
      - `certificates` object[], required
        - `fingerprint` string, required: SHA-256, colon separated
        - `subject` string, required
        - `notBefore` string, required: ISO-8601 timestamp
        - `notAfter` string, required: ISO-8601 timestamp
        - `expired` boolean, required
      - `idpInitiated` boolean, required: sign-ins started at the identity provider (unsolicited responses) are accepted (default false)
    - `tested` boolean, required: someone signed in through it at least once (required before enforcement)
    - `identities` integer, required
    - `lastLoginAt` string, nullable, required: ISO-8601 timestamp
    - `createdAt` string, required: ISO-8601 timestamp
    - `updatedAt` string, required: ISO-8601 timestamp
  - `domains` object[], required
    - `id` string, uuid, required
    - `domain` string, required
    - `status` 'verified' | 'pending', required
    - `verifiedAt` string, nullable, required: ISO-8601 timestamp
    - `lastCheckedAt` string, nullable, required: ISO-8601 timestamp
    - `createdAt` string, required: ISO-8601 timestamp
    - `verification` object, nullable, required: the DNS record that proves the domain; null when its key left the keyring (remove and add the domain again)
      - `type` 'TXT', required
      - `name` string, required
      - `value` string, required
  - `serviceProvider` object, required
    - `oidcRedirectUri` string, required: register this redirect URI in the OIDC app
    - `samlAcsUrl` string, nullable, required: Assertion Consumer Service URL (HTTP-POST), once a SAML connection exists
    - `samlEntityId` string, nullable, required: SP entity ID / audience
    - `samlMetadataUrl` string, nullable, required
    - `signInUrl` string, required: where members start an SSO sign-in

## Other responses

- `400`: Invalid request (code invalid_request; details.reason names a policy rule)
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Not permitted (code forbidden). details.sessionRequired: changes need a dashboard session; details.reauthenticate: sign in again (changes need a session younger than 5 minutes); details.policy: the team requires mfa/sso. Code ip_not_allowed: the team's IP allow-list does not include your address (details.clientIp)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicts with the team state, e.g. the last owner (code conflict)
- `429`: Too many requests (code rate_limited); see Retry-After

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)