---
title: "Create SSO connection"
method: POST
path: "/sso-connections"
tags: ["sso-connections"]
---

# Create SSO connection

`POST /sso-connections`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/sso-connections`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

## Request body

- EnforcerV3InternalUsecaseSsoconnectionsCreateInput
  - `config` object
  - `name` string
  - `provider_type` string: "oidc" | "saml"
  - `slug` string

## Response `201`

Created

- InternalDeliveryHttpHandlerSSOConnectionResponse
  - `data` EnforcerV3InternalDomainSsoConnection
    - `config` object: Config is the decrypted configuration — populated only on authorized single-row reads (with secret fields redacted), never on lists.
    - `created_at` string
    - `id` string
    - `is_active` boolean
    - `name` string
    - `provider_type` 'privy' | 'email_otp' | 'google' | 'siwe' | 'phone_otp' | 'passkey' | 'oidc' | 'saml'
    - `slug` string: Slug is the human-friendly handle for the unauthenticated flow routes (/auth/sso/:connection/...). Globally unique among live rows — the flow resolves a connection with no tenant in hand. IdP-registered URLs (redirect_uri / ACS / entity id) always use the UUID so renames never break federation.
    - `tenant_id` string
    - `updated_at` string
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `409`: Conflict
- `500`: Internal Server Error

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)