---
title: "POST /organizations/{organization_id}/sso-connection"
method: POST
path: "/organizations/{organization_id}/sso-connection"
tags: ["SSO Connection"]
---

# POST /organizations/{organization_id}/sso-connection

`POST /organizations/{organization_id}/sso-connection`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/organizations/{organization_id}/sso-connection`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

Enable SSO for organization

## Path parameters

- `organization_id` string, required: Organization ID or label identifier

## Headers

- `X-Client-Request-ID` string, uuid

## Request body

- OrgManagementSSOConnectionCreate: Schema for creating an SSO connection
  - `identifier` string, required: SSO provider identifier (e.g., issuer URL)
  - `client_id` string, required: OAuth 2.0 client ID
  - `client_secret` string: OAuth 2.0 client secret (optional, will be encrypted if provided)
  - `protocols` OrgManagementSSOConnectionProtocol, nullable: Protocol configuration for SSO connection
    - `oauth2` OrgManagementSSOConnectionProtocolOAuth2, nullable: OAuth 2.0 protocol configuration for SSO connection
      - `authorization_endpoint` string, uri, nullable: OAuth 2.0 authorization endpoint
      - `token_endpoint` string, uri, nullable: OAuth 2.0 token endpoint
      - `registration_endpoint` string, uri, nullable: OAuth 2.0 registration endpoint
      - `jwks_uri` string, uri, nullable: JSON Web Key Set endpoint
      - `code_challenge_methods_supported` string[], nullable: Supported PKCE code challenge methods
      - `scopes_supported` string[], nullable: Supported OAuth 2.0 scopes
      - `authorization_parameters` object, nullable: Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).
    - `openid` OrgManagementSSOConnectionProtocolOpenID, nullable: OpenID Connect protocol configuration for SSO connection
      - `userinfo_endpoint` string, uri, nullable: OpenID Connect UserInfo endpoint
      - `user_identifier_claim` string, nullable: Name of a top-level string claim in the provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.
      - `scopes` string[], nullable: Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).

## Response `201`

SSO connection created successfully

- OrgManagementSSOConnection: SSO connection configuration for an organization
  - `id` string, required: Unique identifier for the SSO connection
  - `identifier` string, required: SSO provider identifier (e.g., issuer URL)
  - `client_id` string, nullable, required: OAuth 2.0 client ID
  - `client_secret_set` boolean, required: Whether a client secret is configured
  - `protocols` OrgManagementSSOConnectionProtocol, nullable: Protocol configuration for SSO connection
    - `oauth2` OrgManagementSSOConnectionProtocolOAuth2, nullable: OAuth 2.0 protocol configuration for SSO connection
      - `authorization_endpoint` string, uri, nullable: OAuth 2.0 authorization endpoint
      - `token_endpoint` string, uri, nullable: OAuth 2.0 token endpoint
      - `registration_endpoint` string, uri, nullable: OAuth 2.0 registration endpoint
      - `jwks_uri` string, uri, nullable: JSON Web Key Set endpoint
      - `code_challenge_methods_supported` string[], nullable: Supported PKCE code challenge methods
      - `scopes_supported` string[], nullable: Supported OAuth 2.0 scopes
      - `authorization_parameters` object, nullable: Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).
    - `openid` OrgManagementSSOConnectionProtocolOpenID, nullable: OpenID Connect protocol configuration for SSO connection
      - `userinfo_endpoint` string, uri, nullable: OpenID Connect UserInfo endpoint
      - `user_identifier_claim` string, nullable: Name of a top-level string claim in the provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.
      - `scopes` string[], nullable: Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).
  - `created_at` string, date-time, required: The time the entity was created in utc
  - `updated_at` string, date-time, required: The time the entity was mostly recently updated in utc
  - `permissions` OrgManagementPermissions: Permissions granted to the authenticated principal for this resource. Only populated when the 'expand[]=permissions' query parameter is provided. Keys are resource types (e.g., "organizations"), values are objects mapping permission names to boolean values indicating if the permission is granted.

## Other responses

- `400`: bad request error response when caller supplied invalid input data
- `401`: unauthorized error response when caller session is not authenticated
- `403`: forbidden error response when caller does not have permissions to a resource
- `404`: not found error response when caller does not have permission to see a resource or the resource does not exist
- `409`: SSO is already enabled for this organization
- `429`: rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500`: internal server error response when server encountered error of its own creation
- `503`: service unavailable error when server you're attempting to reach is not available
- `default`: internal server error response when server encountered error of its own creation

## Changes

- **2026-10-16** `0cfaff865771`: 18 breaking, 9 warning, 92 info
  - the response property `details/items/field` became optional for the status `400`
  - the response property `details/items/field` became optional for the status `401`
  - the response property `details/items/field` became optional for the status `403`
  - the response property `details/items/field` became optional for the status `404`
  - …115 more
- **2026-08-26** `d65d51379d93`: 6 info
  - added the new optional request property `protocols/oauth2/authorization_parameters`
  - added the new optional request property `protocols/openid/scopes`
  - added the new optional request property `protocols/openid/user_identifier_claim`
  - added the optional property `protocols/oauth2/authorization_parameters` to the response with the `201` status
  - …2 more
- **2026-03-16** `d3d69f45bfed`: 3 info
  - the endpoint scheme security `OAuth2` was added to the API
  - the endpoint scheme security `bearerAuth` was added to the API
  - the endpoint scheme security `org-management_bearerAuth` was removed from the API
- **2026-02-06** `edd1b760a989`: 1 warning, 2 info
  - deleted the `header` request parameter `X-Request-ID`
  - the endpoint scheme security `org-management_bearerAuth` was added to the API
  - the endpoint scheme security `svc-org-management_bearerAuth` was removed from the API

[Operation history](https://skmtc.dev/keycardai/apis/untitled-api/changes/organizations/:organization_id/sso-connection/post.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) - [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/untitled-api/revisions/0dee67e0a73a?raw)