---
title: "PATCH /organizations/{organization_id}/sso-connection"
method: PATCH
path: "/organizations/{organization_id}/sso-connection"
tags: ["svc-org-management_other"]
---

# PATCH /organizations/{organization_id}/sso-connection

`PATCH /organizations/{organization_id}/sso-connection`

Update SSO connection configuration

## Path parameters

- `organization_id` string, required — Organization ID or label identifier

## Headers

- `X-Client-Request-ID` string, uuid

## Request body

- OrgManagementSSOConnectionUpdate — Schema for updating an SSO connection
  - `identifier` string — SSO provider identifier (e.g., issuer URL)
  - `client_id` string — OAuth 2.0 client ID (set to null to remove)
  - `client_secret` string — OAuth 2.0 client secret (set to null to remove)
  - `protocols` OrgManagementSSOConnectionProtocol, nullable — Protocol configuration for SSO connection
    - `oauth2` OrgManagementSSOConnectionProtocolOAuth2, nullable — OAuth 2.0 protocol configuration for SSO connection
      - `authorization_endpoint` string, uri, nullable — OAuth 2.0 authorization endpoint
      - `token_endpoint` string, uri, nullable — OAuth 2.0 token endpoint
      - `registration_endpoint` string, uri, nullable — OAuth 2.0 registration endpoint
      - `jwks_uri` string, uri, nullable — JSON Web Key Set endpoint
      - `code_challenge_methods_supported` string[], nullable — Supported PKCE code challenge methods
      - `scopes_supported` string[], nullable — Supported OAuth 2.0 scopes
    - `openid` OrgManagementSSOConnectionProtocolOpenID, nullable — OpenID Connect protocol configuration for SSO connection
      - `userinfo_endpoint` string, uri, nullable — OpenID Connect UserInfo endpoint

## Response `200`

SSO connection updated successfully

- OrgManagementSSOConnection — SSO connection configuration for an organization
  - `id` string, required — Unique identifier for the SSO connection
  - `identifier` string, required — SSO provider identifier (e.g., issuer URL)
  - `client_id` string, nullable, required — OAuth 2.0 client ID
  - `client_secret_set` boolean, required — Whether a client secret is configured
  - `protocols` OrgManagementSSOConnectionProtocol, nullable — Protocol configuration for SSO connection
    - `oauth2` OrgManagementSSOConnectionProtocolOAuth2, nullable — OAuth 2.0 protocol configuration for SSO connection
      - `authorization_endpoint` string, uri, nullable — OAuth 2.0 authorization endpoint
      - `token_endpoint` string, uri, nullable — OAuth 2.0 token endpoint
      - `registration_endpoint` string, uri, nullable — OAuth 2.0 registration endpoint
      - `jwks_uri` string, uri, nullable — JSON Web Key Set endpoint
      - `code_challenge_methods_supported` string[], nullable — Supported PKCE code challenge methods
      - `scopes_supported` string[], nullable — Supported OAuth 2.0 scopes
    - `openid` OrgManagementSSOConnectionProtocolOpenID, nullable — OpenID Connect protocol configuration for SSO connection
      - `userinfo_endpoint` string, uri, nullable — OpenID Connect UserInfo endpoint
  - `created_at` string, date-time, required — The time the entity was created in utc
  - `updated_at` string, date-time, required — The time the entity was mostly recently updated in utc
  - `permissions` OrgManagementPermissions — Permissions granted to the authenticated principal for this resource. Only populated when the 'expand[]=permissions' query parameter is provided. Keys are resource types (e.g., "organizations"), values are objects mapping permission names to boolean values indicating if the permission is granted.

## Other responses

- `400` — bad request error response when caller supplied invalid input data
- `401` — unauthorized error response when caller session is not authenticated
- `403` — forbidden error response when caller does not have permissions to a resource
- `404` — Organization not found or SSO not enabled
- `429` — rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500` — internal server error response when server encountered error of its own creation
- `503` — service unavailable error when server you're attempting to reach is not available
- `default` — internal server error response when server encountered error of its own creation

---

[API](https://skmtc.net/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.net/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keycardai/untitled-api/versions/2f5033ed4491/schema)