---
title: "PATCH /organizations/{organization_id}/sso-connection"
method: PATCH
path: "/organizations/{organization_id}/sso-connection"
tags: ["svc-org-management_other"]
---

# PATCH /organizations/{organization_id}/sso-connection

`PATCH /organizations/{organization_id}/sso-connection`

Update SSO connection configuration

## Path parameters

- `organization_id` string, required — Organization ID or label identifier

## Headers

- `X-Client-Request-ID` string, uuid

## Request body

- OrgManagementSSOConnectionUpdate — Schema for updating an SSO connection
  - `identifier` string — SSO provider identifier (e.g., issuer URL)
  - `client_id` string — OAuth 2.0 client ID (set to null to remove)
  - `client_secret` string — OAuth 2.0 client secret (set to null to remove)
  - `protocols` OrgManagementSSOConnectionProtocolUpdate, nullable — Protocol configuration for an SSO connection update. Omit a protocol to leave it unchanged.
    - `oauth2` OrgManagementSSOConnectionProtocolOAuth2Update, nullable — OAuth 2.0 protocol configuration for an SSO connection update. Each field is tri-state, omit to leave unchanged, send null to clear, send a value to set.
      - `authorization_endpoint` string, uri, nullable — OAuth 2.0 authorization endpoint. Set to null to clear.
      - `token_endpoint` string, uri, nullable — OAuth 2.0 token endpoint. Set to null to clear.
      - `registration_endpoint` string, uri, nullable — OAuth 2.0 registration endpoint. Set to null to clear.
      - `jwks_uri` string, uri, nullable — JSON Web Key Set endpoint. Set to null to clear.
      - `code_challenge_methods_supported` string[], nullable — Supported PKCE code challenge methods. Set to null to clear.
      - `scopes_supported` string[], nullable — Supported OAuth 2.0 scopes. Set to null to clear.
      - `authorization_parameters` object, nullable — Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline). Set to null to clear.
    - `openid` OrgManagementSSOConnectionProtocolOpenIDUpdate, nullable — OpenID Connect protocol configuration for an SSO connection update. Each field is tri-state, omit to leave unchanged, send null to clear, send a value to set.
      - `userinfo_endpoint` string, uri, nullable — OpenID Connect UserInfo endpoint. Set to null to clear.
      - `user_identifier_claim` string, nullable — Name of a top-level string claim in the provider's ID Token to use as the user identifier on user creation. Set to null to clear.
      - `scopes` string[], nullable — Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email). Set to null to clear.

## Response `200`

SSO connection updated successfully

- OrgManagementSSOConnection — SSO connection configuration for an organization
  - `id` string, required — Unique identifier for the SSO connection
  - `identifier` string, required — SSO provider identifier (e.g., issuer URL)
  - `client_id` string, nullable, required — OAuth 2.0 client ID
  - `client_secret_set` boolean, required — Whether a client secret is configured
  - `protocols` OrgManagementSSOConnectionProtocol, nullable — Protocol configuration for SSO connection
    - `oauth2` OrgManagementSSOConnectionProtocolOAuth2, nullable — OAuth 2.0 protocol configuration for SSO connection
      - `authorization_endpoint` string, uri, nullable — OAuth 2.0 authorization endpoint
      - `token_endpoint` string, uri, nullable — OAuth 2.0 token endpoint
      - `registration_endpoint` string, uri, nullable — OAuth 2.0 registration endpoint
      - `jwks_uri` string, uri, nullable — JSON Web Key Set endpoint
      - `code_challenge_methods_supported` string[], nullable — Supported PKCE code challenge methods
      - `scopes_supported` string[], nullable — Supported OAuth 2.0 scopes
      - `authorization_parameters` object, nullable — Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).
    - `openid` OrgManagementSSOConnectionProtocolOpenID, nullable — OpenID Connect protocol configuration for SSO connection
      - `userinfo_endpoint` string, uri, nullable — OpenID Connect UserInfo endpoint
      - `user_identifier_claim` string, nullable — Name of a top-level string claim in the provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.
      - `scopes` string[], nullable — Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).
  - `created_at` string, date-time, required — The time the entity was created in utc
  - `updated_at` string, date-time, required — The time the entity was mostly recently updated in utc
  - `permissions` OrgManagementPermissions — Permissions granted to the authenticated principal for this resource. Only populated when the 'expand[]=permissions' query parameter is provided. Keys are resource types (e.g., "organizations"), values are objects mapping permission names to boolean values indicating if the permission is granted.

## Other responses

- `400` — bad request error response when caller supplied invalid input data
- `401` — unauthorized error response when caller session is not authenticated
- `403` — forbidden error response when caller does not have permissions to a resource
- `404` — Organization not found or SSO not enabled
- `429` — rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500` — internal server error response when server encountered error of its own creation
- `503` — service unavailable error when server you're attempting to reach is not available
- `default` — internal server error response when server encountered error of its own creation

## Changes

- **2026-08-26** `d65d51379d93` — 6 info
  - added the new optional request property `protocols/oauth2/authorization_parameters`
  - added the new optional request property `protocols/openid/scopes`
  - added the new optional request property `protocols/openid/user_identifier_claim`
  - added the optional property `protocols/oauth2/authorization_parameters` to the response with the `200` status
  - …2 more
- **2026-03-16** `d3d69f45bfed` — 3 info
  - the endpoint scheme security `OAuth2` was added to the API
  - the endpoint scheme security `bearerAuth` was added to the API
  - the endpoint scheme security `org-management_bearerAuth` was removed from the API
- **2026-02-06** `edd1b760a989` — 1 warning, 2 info
  - deleted the `header` request parameter `X-Request-ID`
  - the endpoint scheme security `org-management_bearerAuth` was added to the API
  - the endpoint scheme security `svc-org-management_bearerAuth` was removed from the API

[Change history](https://skmtc.dev/keycardai/apis/untitled-api/changes/organizations/:organization_id/sso-connection/patch.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/d65d51379d93/schema)