Contract
- shape
- collection
- authority
- read
- evidence
- none
- subscription
- false
- permission
- any one of: staff.read (the staff role staff_read held in the Internal org, tradehq_role.staff_role); org.admin (carried by the caller's role template in the org `org_id`); account.owner (account role owner or higher in the account of the org `org_id`); a deactivated caller is refused first
- idempotency
- safe
- emits
- none
- MCP tool
- list_sso_connections
- REST
- POST https://api.containertradehq.com/v1/cap/list_sso_connections
Idempotency: a read: calling again changes nothing
Inputs
| name | type | required | validation |
|---|---|---|---|
| org_id | org_id | required | tradehq-org-id; 1 to 20 characters The org whose connections to list. |
Paginated: next next_after · page_max 100 · walk_max 100 · ceiling declared
Response
items· object[]next_after· stringnull · Pass as `after` for the next page; null on the last one.
Full JSON Schema
{
"type": "object",
"properties": {
"items": {
"type": "array",
"items": {
"type": "object",
"properties": {
"connection_id": {
"type": "string",
"pattern": "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$",
"format": "uuid",
"description": "Trade HQ's id for the connection.",
"x-data-class": "operational"
},
"org_id": {
"type": "string",
"minLength": 1,
"maxLength": 20,
"pattern": "^[A-Za-z0-9_-]{1,20}$",
"format": "tradehq-org-id",
"description": "The org it belongs to.",
"x-data-class": "operational"
},
"name": {
"type": "string",
"description": "What the org's admins call it.",
"x-data-class": "operational"
},
"protocol": {
"type": "string",
"enum": [
"saml",
"oidc"
],
"description": "saml or oidc.",
"x-data-class": "operational"
},
"domain": {
"type": "string",
"description": "The verified email domain it serves.",
"x-data-class": "operational"
},
"status": {
"type": "string",
"enum": [
"creating",
"awaiting_metadata",
"ready_to_test",
"active",
"deleting",
"deleted"
],
"description": "creating (Clerk has not answered yet), awaiting_metadata, ready_to_test, active, deleting or deleted.",
"x-data-class": "operational"
},
"active": {
"type": "boolean",
"description": "Whether people sign in through it.",
"x-data-class": "operational"
},
"acs_url": {
"type": [
"string",
"null"
],
"description": "The service provider's ACS URL, for the IdP admin; null until Clerk has answered.",
"x-data-class": "operational"
},
"sp_entity_id": {
"type": [
"string",
"null"
],
"description": "The service provider's entity id, for the IdP admin; null until Clerk has answered.",
"x-data-class": "operational"
},
"sp_metadata_url": {
"type": [
"string",
"null"
],
"description": "The service provider's metadata URL; null until Clerk has answered.",
"x-data-class": "operational"
},
"idp_metadata_url": {
"type": [
"string",
"null"
],
"description": "The IdP metadata URL saved, if a URL was.",
"x-data-class": "operational"
},
"has_idp_metadata": {
"type": "boolean",
"description": "Whether IdP metadata is saved, as a URL or as uploaded XML.",
"x-data-class": "operational"
},
"required": {
"type": "boolean",
"description": "Whether members at its domain must sign in through it.",
"x-data-class": "operational"
},
"bypass_until": {
"type": [
"string",
"null"
],
"format": "date-time",
"description": "While the outage lever holds, when it ends; null otherwise.",
"x-data-class": "operational"
},
"jit": {
"type": "boolean",
"description": "Whether a first sign-in through it makes the person a member.",
"x-data-class": "operational"
},
"default_role_template": {
"type": [
"string",
"null"
],
"description": "The role template a just-in-time member gets.",
"x-data-class": "operational"
},
"idp_mfa_trusted": {
"type": "boolean",
"description": "Whether the IdP's MFA counts toward the org's MFA settings.",
"x-data-class": "operational"
},
"allow_manual_additions": {
"type": "boolean",
"description": "Whether invites stay allowed for its domain while a directory manages it (TRA-486).",
"x-data-class": "operational"
},
"last_sign_in_at": {
"type": [
"string",
"null"
],
"format": "date-time",
"description": "The last sign-in through it.",
"x-data-class": "operational"
},
"idp_certificate_expires_at": {
"type": [
"string",
"null"
],
"format": "date-time",
"description": "When the IdP's signing certificate expires, once known.",
"x-data-class": "operational"
},
"created_at": {
"type": "string",
"format": "date-time",
"description": "When it was added.",
"x-data-class": "operational"
},
"caller_may_bypass": {
"type": "boolean",
"description": "Whether the caller may pull the outage lever: the account owner, or the Owner role template in the org.",
"x-data-class": "operational"
}
},
"required": [
"connection_id",
"org_id",
"name",
"protocol",
"domain",
"status",
"active",
"acs_url",
"sp_entity_id",
"sp_metadata_url",
"idp_metadata_url",
"has_idp_metadata",
"required",
"bypass_until",
"jit",
"default_role_template",
"idp_mfa_trusted",
"allow_manual_additions",
"last_sign_in_at",
"idp_certificate_expires_at",
"created_at",
"caller_may_bypass"
],
"additionalProperties": false
},
"maxItems": 100
},
"next_after": {
"type": [
"string",
"null"
],
"description": "Pass as `after` for the next page; null on the last one."
}
},
"required": [
"items",
"next_after"
],
"additionalProperties": false
} Refusals
The platform refusals apply to every call: version, authentication, authority, validation and rate limits, each in the same envelope.
Surfaces
DesktopF
MobileF
APIF
MCPF
VoiceD4
PushN
OneBoxN
OutboundN
- Voice: degraded: visualization
- Push: emits nothing
- OneBox: no document originates a sign-in connection
- Outbound: crosses to no counterparty
Events
None emitted.
Related
None.