create_sso_connection

Add a single sign-on connection

act entity tenant-private since 2026-10-01

Adds a single sign-on connection (SAML or OIDC) for one email domain this org has verified. The connection is created in Clerk shortly after, inactive; list_sso_connections then shows the ACS URL and entity id to give the IdP admin. Save the IdP's metadata and activate it with update_sso_connection, then require it with set_sso_policy.

Contract

shape: entity
authority: act
evidence: none
subscription: false
permission: any one of: org.admin (carried by the caller's role template in the org `org_id`); account.owner (account role owner or higher in the account of the org `org_id`); a deactivated caller is refused first
idempotency: keyed
emits: sso_connection.created
MCP tool: create_sso_connection
decision_set: approve, reject
REST: POST https://api.containertradehq.com/v1/cap/create_sso_connection

Through MCP this call returns an approval request first; see Approvals.

Idempotency: keyed by the caller's Idempotency-Key, which is required: the same key and inputs replay the first result, the same key with other inputs is 409 idempotency_key_reused

Inputs

name	type	required	validation
org_id	org_id	required	tradehq-org-id; 1 to 20 characters The org.
name	text	required	1 to 120 characters What the org's admins call it, such as the IdP's name.
protocol	one_of	required	one of saml, oidc saml or oidc.
domain	text	required	3 to 253 characters The email domain it serves: one this org has verified.

Response

connection_id · string · Trade HQ's id for the connection.
org_id · string · The org it belongs to.
name · string · What the org's admins call it.
protocol · string · saml or oidc.
domain · string · The verified email domain it serves.
status · string · creating (Clerk has not answered yet), awaiting_metadata, ready_to_test, active, deleting or deleted.
active · boolean · Whether people sign in through it.
acs_url · stringnull · The service provider's ACS URL, for the IdP admin; null until Clerk has answered.
sp_entity_id · stringnull · The service provider's entity id, for the IdP admin; null until Clerk has answered.
sp_metadata_url · stringnull · The service provider's metadata URL; null until Clerk has answered.
idp_metadata_url · stringnull · The IdP metadata URL saved, if a URL was.
has_idp_metadata · boolean · Whether IdP metadata is saved, as a URL or as uploaded XML.
required · boolean · Whether members at its domain must sign in through it.
bypass_until · stringnull · While the outage lever holds, when it ends; null otherwise.
jit · boolean · Whether a first sign-in through it makes the person a member.
default_role_template · stringnull · The role template a just-in-time member gets.
idp_mfa_trusted · boolean · Whether the IdP's MFA counts toward the org's MFA settings.
allow_manual_additions · boolean · Whether invites stay allowed for its domain while a directory manages it (TRA-486).
last_sign_in_at · stringnull · The last sign-in through it.
idp_certificate_expires_at · stringnull · When the IdP's signing certificate expires, once known.
created_at · string · When it was added.
caller_may_bypass · boolean · Whether the caller may pull the outage lever: the account owner, or the Owner role template in the org.

Full JSON Schema

{
  "type": "object",
  "properties": {
    "connection_id": {
      "type": "string",
      "pattern": "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$",
      "format": "uuid",
      "description": "Trade HQ's id for the connection.",
      "x-data-class": "operational"
    },
    "org_id": {
      "type": "string",
      "minLength": 1,
      "maxLength": 20,
      "pattern": "^[A-Za-z0-9_-]{1,20}$",
      "format": "tradehq-org-id",
      "description": "The org it belongs to.",
      "x-data-class": "operational"
    },
    "name": {
      "type": "string",
      "description": "What the org's admins call it.",
      "x-data-class": "operational"
    },
    "protocol": {
      "type": "string",
      "enum": [
        "saml",
        "oidc"
      ],
      "description": "saml or oidc.",
      "x-data-class": "operational"
    },
    "domain": {
      "type": "string",
      "description": "The verified email domain it serves.",
      "x-data-class": "operational"
    },
    "status": {
      "type": "string",
      "enum": [
        "creating",
        "awaiting_metadata",
        "ready_to_test",
        "active",
        "deleting",
        "deleted"
      ],
      "description": "creating (Clerk has not answered yet), awaiting_metadata, ready_to_test, active, deleting or deleted.",
      "x-data-class": "operational"
    },
    "active": {
      "type": "boolean",
      "description": "Whether people sign in through it.",
      "x-data-class": "operational"
    },
    "acs_url": {
      "type": [
        "string",
        "null"
      ],
      "description": "The service provider's ACS URL, for the IdP admin; null until Clerk has answered.",
      "x-data-class": "operational"
    },
    "sp_entity_id": {
      "type": [
        "string",
        "null"
      ],
      "description": "The service provider's entity id, for the IdP admin; null until Clerk has answered.",
      "x-data-class": "operational"
    },
    "sp_metadata_url": {
      "type": [
        "string",
        "null"
      ],
      "description": "The service provider's metadata URL; null until Clerk has answered.",
      "x-data-class": "operational"
    },
    "idp_metadata_url": {
      "type": [
        "string",
        "null"
      ],
      "description": "The IdP metadata URL saved, if a URL was.",
      "x-data-class": "operational"
    },
    "has_idp_metadata": {
      "type": "boolean",
      "description": "Whether IdP metadata is saved, as a URL or as uploaded XML.",
      "x-data-class": "operational"
    },
    "required": {
      "type": "boolean",
      "description": "Whether members at its domain must sign in through it.",
      "x-data-class": "operational"
    },
    "bypass_until": {
      "type": [
        "string",
        "null"
      ],
      "format": "date-time",
      "description": "While the outage lever holds, when it ends; null otherwise.",
      "x-data-class": "operational"
    },
    "jit": {
      "type": "boolean",
      "description": "Whether a first sign-in through it makes the person a member.",
      "x-data-class": "operational"
    },
    "default_role_template": {
      "type": [
        "string",
        "null"
      ],
      "description": "The role template a just-in-time member gets.",
      "x-data-class": "operational"
    },
    "idp_mfa_trusted": {
      "type": "boolean",
      "description": "Whether the IdP's MFA counts toward the org's MFA settings.",
      "x-data-class": "operational"
    },
    "allow_manual_additions": {
      "type": "boolean",
      "description": "Whether invites stay allowed for its domain while a directory manages it (TRA-486).",
      "x-data-class": "operational"
    },
    "last_sign_in_at": {
      "type": [
        "string",
        "null"
      ],
      "format": "date-time",
      "description": "The last sign-in through it.",
      "x-data-class": "operational"
    },
    "idp_certificate_expires_at": {
      "type": [
        "string",
        "null"
      ],
      "format": "date-time",
      "description": "When the IdP's signing certificate expires, once known.",
      "x-data-class": "operational"
    },
    "created_at": {
      "type": "string",
      "format": "date-time",
      "description": "When it was added.",
      "x-data-class": "operational"
    },
    "caller_may_bypass": {
      "type": "boolean",
      "description": "Whether the caller may pull the outage lever: the account owner, or the Owner role template in the org.",
      "x-data-class": "operational"
    }
  },
  "required": [
    "connection_id",
    "org_id",
    "name",
    "protocol",
    "domain",
    "status",
    "active",
    "acs_url",
    "sp_entity_id",
    "sp_metadata_url",
    "idp_metadata_url",
    "has_idp_metadata",
    "required",
    "bypass_until",
    "jit",
    "default_role_template",
    "idp_mfa_trusted",
    "allow_manual_additions",
    "last_sign_in_at",
    "idp_certificate_expires_at",
    "created_at",
    "caller_may_bypass"
  ],
  "additionalProperties": false
}

Refusals

domain_not_verified · 422 · the domain is not one this org has verified
domain_has_connection · 409 · a single sign-on connection already serves the domain
org_is_a_test_twin · 422 · the org is a test twin; connections belong to its live org
retry_key_mismatch · 409 · the Idempotency-Key was already used with other inputs
retry_key_in_flight · 409 · a request with this Idempotency-Key is still running
retry_key_lost · 409 · another request took over this Idempotency-Key first; nothing was created

The platform refusals apply to every call: version, authentication, authority, validation and rate limits, each in the same envelope.

Surfaces

DesktopF

MobileD5

APIF

MCPF*

VoiceD2

PushF

OneBoxN

OutboundN

Mobile: degraded: composition
MCP: approval required
Voice: degraded: confirmation
OneBox: no document originates a sign-in connection
Outbound: crosses to no counterparty

Events

sso_connection.created audit_only

create_access_review, invite_user, remove_domain, set_domain_join_policy, update_sso_connection, verify_domain

get a test key

curl https://api.containertradehq.com/v1/cap/create_sso_connection \
  -H "Authorization: Bearer $TRADEHQ_API_KEY" \
  -H "Trade-HQ-Version: 2026-10-01" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"org_id":"<org_id>","name":"<name>","protocol":"saml","domain":"<domain>"}'

import { TradeHQ } from '@containertradehq/sdk';

const tradehq = new TradeHQ({ apiKey: process.env.TRADEHQ_API_KEY! });
const result = await tradehq.createSsoConnection({
  "org_id": "<org_id>",
  "name": "<name>",
  "protocol": "saml",
  "domain": "<domain>"
});
// Idempotency-Key is generated once per call and reused across its retries.

import os
from containertradehq import TradeHQ

tradehq = TradeHQ(os.environ["TRADEHQ_API_KEY"])
result = tradehq.create_sso_connection({
    "org_id": "<org_id>",
    "name": "<name>",
    "protocol": "saml",
    "domain": "<domain>",
})
# Idempotency-Key is generated once per call and reused across its retries.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "create_sso_connection",
    "arguments": {
      "org_id": "<org_id>",
      "name": "<name>",
      "protocol": "saml",
      "domain": "<domain>"
    }
  }
}

MCP

create_sso_connection · readOnlyHint false · approval required

“Call create_sso_connection”