---
title: "GET /organizations/{organization_id}/sso-connection"
method: GET
path: "/organizations/{organization_id}/sso-connection"
tags: ["SSO Connection"]
---

# GET /organizations/{organization_id}/sso-connection

`GET /organizations/{organization_id}/sso-connection`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/organizations/{organization_id}/sso-connection`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

Get SSO connection configuration for organization

## Path parameters

- `organization_id` string, required: Organization ID or label identifier

## Query parameters

- `expand[]` union
  - 'permissions' | 'total_count'
  - string[]

## Headers

- `X-Client-Request-ID` string, uuid

## Response `200`

SSO connection details

- OrgManagementSSOConnection: SSO connection configuration for an organization
  - `id` string, required: Unique identifier for the SSO connection
  - `identifier` string, required: SSO provider identifier (e.g., issuer URL)
  - `client_id` string, nullable, required: OAuth 2.0 client ID
  - `client_secret_set` boolean, required: Whether a client secret is configured
  - `protocols` OrgManagementSSOConnectionProtocol, nullable: Protocol configuration for SSO connection
    - `oauth2` OrgManagementSSOConnectionProtocolOAuth2, nullable: OAuth 2.0 protocol configuration for SSO connection
      - `authorization_endpoint` string, uri, nullable: OAuth 2.0 authorization endpoint
      - `token_endpoint` string, uri, nullable: OAuth 2.0 token endpoint
      - `registration_endpoint` string, uri, nullable: OAuth 2.0 registration endpoint
      - `jwks_uri` string, uri, nullable: JSON Web Key Set endpoint
      - `code_challenge_methods_supported` string[], nullable: Supported PKCE code challenge methods
      - `scopes_supported` string[], nullable: Supported OAuth 2.0 scopes
      - `authorization_parameters` object, nullable: Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).
    - `openid` OrgManagementSSOConnectionProtocolOpenID, nullable: OpenID Connect protocol configuration for SSO connection
      - `userinfo_endpoint` string, uri, nullable: OpenID Connect UserInfo endpoint
      - `user_identifier_claim` string, nullable: Name of a top-level string claim in the provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.
      - `scopes` string[], nullable: Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).
  - `created_at` string, date-time, required: The time the entity was created in utc
  - `updated_at` string, date-time, required: The time the entity was mostly recently updated in utc
  - `permissions` OrgManagementPermissions: Permissions granted to the authenticated principal for this resource. Only populated when the 'expand[]=permissions' query parameter is provided. Keys are resource types (e.g., "organizations"), values are objects mapping permission names to boolean values indicating if the permission is granted.

## Other responses

- `400`: bad request error response when caller supplied invalid input data
- `401`: unauthorized error response when caller session is not authenticated
- `403`: forbidden error response when caller does not have permissions to a resource
- `404`: Organization not found or SSO not enabled
- `429`: rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500`: internal server error response when server encountered error of its own creation
- `503`: service unavailable error when server you're attempting to reach is not available
- `default`: internal server error response when server encountered error of its own creation

## Changes

- **2026-10-29** `0dee67e0a73a`: 2 info
  - `query` request parameter `expand[]` list-of-types was widened by adding types `string`
  - for the `query` request parameter `expand[]`, the type was generalized from `array` to no type
- **2026-10-16** `0cfaff865771`: 16 breaking, 8 warning, 82 info
  - the response property `details/items/field` became optional for the status `400`
  - the response property `details/items/field` became optional for the status `401`
  - the response property `details/items/field` became optional for the status `403`
  - the response property `details/items/field` became optional for the status `404`
  - …102 more
- **2026-08-26** `d65d51379d93`: 3 info
  - added the optional property `protocols/oauth2/authorization_parameters` to the response with the `200` status
  - added the optional property `protocols/openid/scopes` to the response with the `200` status
  - added the optional property `protocols/openid/user_identifier_claim` to the response with the `200` status
- **2026-04-20** `932699a5ea16`: 1 info
  - added the enum value `total_count` to the property `items/` of the `query` request parameter `expand[]`
- **2026-03-16** `d3d69f45bfed`: 3 info
  - the endpoint scheme security `OAuth2` was added to the API
  - the endpoint scheme security `bearerAuth` was added to the API
  - the endpoint scheme security `org-management_bearerAuth` was removed from the API

[Operation history](https://skmtc.dev/keycardai/apis/untitled-api/changes/organizations/:organization_id/sso-connection/get.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) - [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/untitled-api/revisions/0dee67e0a73a?raw)