---
title: "List History"
method: GET
path: "/api/v1/settings/sso/history"
tags: ["SSO"]
---

# List History

`GET /api/v1/settings/sso/history`

ListHistory returns the SSO settings change history, newest first.

## Query parameters

- `page_size` integer — Maximum number of results to return per page.
- `page_token` string — Pagination token from a previous response.

## Response `200`

SSOSettingsServiceListHistoryResponse returns SSO settings history entries.

- C1ApiSsoV1SSOSettingsServiceListHistoryResponse — SSOSettingsServiceListHistoryResponse returns SSO settings history entries.
  - `list` C1ApiSsoV1SSOSettingsHistoryEntry[], nullable — The page of history entries, newest first.
    - `metadata` C1ApiHistoryV1HistoryEntryMetadata — HistoryEntryMetadata is the shared metadata envelope embedded on every per-service HistoryEntry. The strongly-typed snapshot lives on the per-service entry message alongside this envelope.
      - `actor` C1ApiHistoryV1HistoryActor — HistoryActor is a typed reference to whoever performed the change. kind mirrors the storage-model ActorKind enum; user_id is set when kind corresponds to a user principal (API / SUPPORT) so the frontend can resolve the user via its own avatar / lookup hooks. Protos reference objects by id; the frontend renders / caches itself. The raw passport fields (token_id / principal_id) intentionally do not leave the server. Non-user actors (workflow, connector, internal) are identified by `kind` alone; correlating IDs (workflow_run_id, etc.) flow through `HistoryAnnotation` instead of being plucked into the actor message.
        - `kind` 'ACTOR_KIND_UNSPECIFIED' | 'ACTOR_KIND_API' | 'ACTOR_KIND_SLACK' | 'ACTOR_KIND_MSTEAMS' | 'ACTOR_KIND_JIRA_CLOUD' | 'ACTOR_KIND_INTERNAL' | 'ACTOR_KIND_SUPPORT' | 'ACTOR_KIND_WORKFLOW' — The kind field.
        - `userId` string — Bare KSUID. Set when kind = ACTOR_KIND_API or ACTOR_KIND_SUPPORT. Empty otherwise. The frontend resolves user_id → display name via the same lookup paths it uses elsewhere (avatars, mentions, ...).
      - `annotations` C1ApiHistoryV1HistoryAnnotation[], nullable — Server-rendered annotations: known keys carry display_label and (for ticket_id, etc.) display_url resolved from tenant config. Cap mirrors the per-object annotation ceiling (16).
        - `displayLabel` string — Server-rendered label, e.g. "Ticket".
        - `displayUrl` string — Resolved from tenant config; "" if none. Frontend applies its own scheme allowlist.
        - `displayValue` string — UI-friendly rendering (truncated / reshaped from raw_value).
        - `key` string — Storage-side key. Bounds: ^[a-z][a-z0-9_.-]{0,63}$.
        - `kind` 'ANNOTATION_KIND_UNSPECIFIED' | 'ANNOTATION_KIND_GENERIC' | 'ANNOTATION_KIND_TICKET' | 'ANNOTATION_KIND_REASON' | 'ANNOTATION_KIND_WORKFLOW' | 'ANNOTATION_KIND_BATCH' | 'ANNOTATION_KIND_CORRELATION' | 'ANNOTATION_KIND_AUTOMATION' — The kind field.
        - `rawValue` string — Raw value as stored in ObjectHistory.annotations; storage-side values are capped at 512 bytes.
      - `changeKind` 'CHANGE_KIND_UNSPECIFIED' | 'CHANGE_KIND_CREATE' | 'CHANGE_KIND_PUT' | 'CHANGE_KIND_HARD_DELETE' — Storage-model enum re-exported here for wire compatibility with the storage row. UNSPECIFIED should never appear on the wire.
      - `createdAt` string, date-time, nullable
      - `id` string — KSUID. Same value as c1.models.history.v1.ObjectHistory.id.
      - `syslogEventId` string — System Log event id — KSUID of the OCSF event recorded for this write. Empty for non-RPC writes (workflows, cron). Customer-facing copy says "System Log event"; the underlying format is OCSF.
      - `traceId` string — OTel trace correlation. Empty when no valid span at write time. 32-hex-char otel trace id or empty.
    - `snapshot` C1ApiSsoV1SSOSettings — SSOSettings is the per-tenant configuration for ConductorOne acting as an SSO provider.
      - `createdAt` string, date-time, nullable
      - `defaultAssertionLifetime` string, duration, nullable
      - `defaultIdTokenSignedResponseAlg` 'OIDC_SIGNING_ALGORITHM_UNSPECIFIED' | 'OIDC_SIGNING_ALGORITHM_EDDSA' | 'OIDC_SIGNING_ALGORITHM_ES256' | 'OIDC_SIGNING_ALGORITHM_RS256' — The id_token signing algorithm applied to OIDC applications that do not choose one. When unset, the server uses EdDSA.
      - `defaultSubjectType` 'SSO_SUBJECT_TYPE_UNSPECIFIED' | 'SSO_SUBJECT_TYPE_PAIRWISE' | 'SSO_SUBJECT_TYPE_PUBLIC' | 'SSO_SUBJECT_TYPE_COMPATIBILITY' — The subject type materialized onto new SSO applications that do not choose one. Changing this default does not change existing applications. When unset, the server uses pairwise subjects.
      - `enabled` boolean — Master switch for the SSO provider. ConductorOne also gates the feature behind an operator-controlled rollout flag; this is the tenant administrator's intent. Individual SSO applications can still be disabled one at a time.
      - `updatedAt` string, date-time, nullable
  - `nextPageToken` string — Pagination token for the next page, or empty if there are no more results.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)