delete_sso_connection

Delete a single sign-on connection

act entity tenant-private since 2026-10-01

Deletes a single sign-on connection. Nobody signs in through it from this call, its domain no longer requires SSO (members there use magic link or passkey again), its just-in-time settings go with it, and the Clerk connection is deleted shortly after.

Contract

shape: entity
authority: act
evidence: none
subscription: false
permission: any one of: org.admin (carried by the caller's role template in the org `org_id`); account.owner (account role owner or higher in the account of the org `org_id`); a deactivated caller is refused first
idempotency: natural
emits: sso_connection.deleted
MCP tool: delete_sso_connection
decision_set: approve, reject, escalate
REST: POST https://api.containertradehq.com/v1/cap/delete_sso_connection

Through MCP this call returns an approval request first; see Approvals.

Idempotency: keyed by the contract's own inputs: the same inputs replay the first call's result

Inputs

name	type	required	validation
org_id	org_id	required	tradehq-org-id; 1 to 20 characters The org.
connection_id	uuid	required	UUID The connection, as list_sso_connections names it.

Response

connection_id · string · The connection.
org_id · string · The org.
status · string · deleting until Clerk has deleted it, then deleted.

Full JSON Schema

{
  "type": "object",
  "properties": {
    "connection_id": {
      "type": "string",
      "pattern": "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$",
      "format": "uuid",
      "description": "The connection.",
      "x-data-class": "operational"
    },
    "org_id": {
      "type": "string",
      "minLength": 1,
      "maxLength": 20,
      "pattern": "^[A-Za-z0-9_-]{1,20}$",
      "format": "tradehq-org-id",
      "description": "The org.",
      "x-data-class": "operational"
    },
    "status": {
      "type": "string",
      "enum": [
        "deleting",
        "deleted"
      ],
      "description": "deleting until Clerk has deleted it, then deleted.",
      "x-data-class": "operational"
    }
  },
  "required": [
    "connection_id",
    "org_id",
    "status"
  ],
  "additionalProperties": false
}

Refusals

connection_not_found · 422 · the org has no such connection
security_policy_unenforced · 422 · the stored sso section does not parse

The platform refusals apply to every call: version, authentication, authority, validation and rate limits, each in the same envelope.

Surfaces

DesktopF

MobileF

APIF

MCPF*

VoiceD2

PushF

OneBoxN

OutboundN

MCP: approval required
Voice: degraded: confirmation
OneBox: no document originates a sign-in connection
Outbound: crosses to no counterparty

Events

sso_connection.deleted audit_only

set_sso_policy, update_sso_connection

get a test key

curl https://api.containertradehq.com/v1/cap/delete_sso_connection \
  -H "Authorization: Bearer $TRADEHQ_API_KEY" \
  -H "Trade-HQ-Version: 2026-10-01" \
  -H "Content-Type: application/json" \
  -d '{"org_id":"<org_id>","connection_id":"00000000-0000-4000-8000-000000000000"}'

import { TradeHQ } from '@containertradehq/sdk';

const tradehq = new TradeHQ({ apiKey: process.env.TRADEHQ_API_KEY! });
const result = await tradehq.deleteSsoConnection({
  "org_id": "<org_id>",
  "connection_id": "00000000-0000-4000-8000-000000000000"
});

import os
from containertradehq import TradeHQ

tradehq = TradeHQ(os.environ["TRADEHQ_API_KEY"])
result = tradehq.delete_sso_connection({
    "org_id": "<org_id>",
    "connection_id": "00000000-0000-4000-8000-000000000000",
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "delete_sso_connection",
    "arguments": {
      "org_id": "<org_id>",
      "connection_id": "00000000-0000-4000-8000-000000000000"
    }
  }
}

MCP

delete_sso_connection · readOnlyHint false · approval required

“Call delete_sso_connection”