Create an SSO connection
const url = 'https://api.deploybase.eu/api/v1/api/v1/team/sso/connections';const options = { method: 'POST', headers: {Authorization: '<Authorization>', 'Content-Type': 'application/json'}, body: '{"client_id":"example","client_secret":"example","is_id_token_mapping":true,"issuer":"example","jit_enabled":true,"jit_role":"example","name":"example","scopes":["example"],"trust_unverified_email":true}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.deploybase.eu/api/v1/api/v1/team/sso/connections \ --header 'Authorization: <Authorization>' \ --header 'Content-Type: application/json' \ --data '{ "client_id": "example", "client_secret": "example", "is_id_token_mapping": true, "issuer": "example", "jit_enabled": true, "jit_role": "example", "name": "example", "scopes": [ "example" ], "trust_unverified_email": true }'Validates the issuer against OpenID Connect Discovery 1.0, registers the provider inside the team’s Zitadel organization, and puts it on the sign-in screen. The issuer stored is the one the provider reports for itself, which can differ from the submitted value by a trailing slash; data.warnings carries anything the admin should know about the provider’s metadata. Nothing is created anywhere when discovery fails. The client secret is encrypted at rest and never returned. Team admin or owner.
Authorizations
Section titled “ Authorizations ”Request Body
Section titled “ Request Body ”Connection to create
object
IsIDTokenMapping is a pointer so an omitted field can mean “you decide”: the service turns it on for Keycloak, whose signed-userinfo setting is undetectable and breaks the broker, and always turns it on for a provider with no userinfo endpoint. Sending false explicitly keeps userinfo unless that second rule applies.
JitEnabled is a pointer where TrustUnverifiedEmail is a plain bool, because the two defaults point opposite ways: this one is ON when omitted, so an absent field and an explicit false have to stay distinguishable. The service resolves the default.
JitRole is the role a member provisioned by this connection lands on: “member” (the default when omitted) or “viewer”. The service refuses anything else.
TrustUnverifiedEmail lets this provider’s addresses match a user even when it does not report them as verified. Off unless the admin asks for it.
Example generated
{ "client_id": "example", "client_secret": "example", "is_id_token_mapping": true, "issuer": "example", "jit_enabled": true, "jit_role": "example", "name": "example", "scopes": [ "example" ], "trust_unverified_email": true}Responses
Section titled “ Responses ”Created
object
object
object
JitEnabled is the admin’s decision that a sign-in through this provider may create the membership it does not find. On by default; an invite-only team turns it off.
JitRole is the role such a created member lands on: member or viewer, never more.
LastLoginAt is the last successful sign-in through this connection, or nil when there has never been one. The settings page turns nil into “No one has signed in yet” — the proof an admin wants before handing the link to their team — so it is a pointer rather than a zero time nothing can distinguish from 1 January year 1.
MemberCount is how many of the team’s members sign in through this connection. It is what the delete confirmation counts: those members lose their SSO link and fall back to email until they are linked again.
RedirectURI is the callback the admin must register in their own IdP. It is Zitadel’s, not ours, and it is the same for every connection — which is exactly why it rides on every view instead of living in the frontend: the value depends on which Zitadel this deployment talks to, and a hard-coded copy would be wrong on every other environment.
TrustUnverifiedEmail is the admin’s statement that this provider’s addresses may be used to match a user even when it does not report them as verified. Stored and returned in phase 1; read by phase 2 matching.
Warnings are the discovery advisories for the issuer, present only on the responses to Create and Update — the two moments the admin is looking at the form and can still act on them. A list or a get does not re-fetch the issuer.
object
Example generated
{ "data": { "client_id": "example", "created_at": "example", "has_client_secret": true, "id": "example", "is_active": true, "is_id_token_mapping": true, "issuer": "example", "jit_enabled": true, "jit_role": "example", "last_login_at": "example", "member_count": 1, "name": "example", "provider": "example", "redirect_uri": "example", "scopes": [ "example" ], "trust_unverified_email": true, "updated_at": "example", "warnings": [ { "code": "example", "docs_url": "example", "message": "example" } ] }, "meta": { "request_id": "example", "timestamp": "example", "trace_id": "example" }}Bad Request
object
object
Example generated
{ "code": "example", "details": "example", "error": "example", "meta": { "request_id": "example", "timestamp": "example", "trace_id": "example" }}Unauthorized
object
object
Example generated
{ "code": "example", "details": "example", "error": "example", "meta": { "request_id": "example", "timestamp": "example", "trace_id": "example" }}Forbidden
object
object
Example generated
{ "code": "example", "details": "example", "error": "example", "meta": { "request_id": "example", "timestamp": "example", "trace_id": "example" }}INVALID_INPUT, SSO_ISSUER_INVALID, SSO_ISSUER_UNREACHABLE, SSO_ISSUER_MISMATCH or SSO_DISCOVERY_INCOMPLETE
object
object
Example generated
{ "code": "example", "details": "example", "error": "example", "meta": { "request_id": "example", "timestamp": "example", "trace_id": "example" }}SSO_PROVIDER_ERROR
object
object
Example generated
{ "code": "example", "details": "example", "error": "example", "meta": { "request_id": "example", "timestamp": "example", "trace_id": "example" }}SSO_NOT_CONFIGURED
object
object
Example generated
{ "code": "example", "details": "example", "error": "example", "meta": { "request_id": "example", "timestamp": "example", "trace_id": "example" }}Live 022265e7 built