openapi: 3.1.1
info:
  title: WorkOS admin-portal connections API
  description: WorkOS REST API
  version: '1.0'
  contact:
    name: WorkOS
    url: https://workos.com
    email: support@workos.com
  license:
    name: MIT
    url: https://opensource.org/license/MIT
servers:
- url: https://api.workos.com
  description: Production
- url: https://api.workos-test.com
  description: Staging
security:
- bearer: []
tags:
- name: connections
  description: Manage SSO connections.
  x-displayName: Connections
paths:
  /connections:
    get:
      description: Get a list of all of your existing connections matching the criteria specified.
      operationId: ConnectionsController_list
      parameters:
      - name: before
        required: false
        in: query
        description: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.
        schema:
          example: obj_1234567890
          type: string
      - name: after
        required: false
        in: query
        description: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.
        schema:
          example: obj_1234567890
          type: string
      - name: limit
        required: false
        in: query
        description: Upper limit on the number of objects to return, between `1` and `100`.
        schema:
          minimum: 1
          maximum: 100
          default: 10
          example: 10
          type: integer
      - name: order
        required: false
        in: query
        description: Order the results by the creation time.
        schema:
          $ref: '#/components/schemas/PaginationOrder'
      - name: connection_type
        required: false
        in: query
        description: Filter Connections by their type.
        schema:
          example: GithubOAuth
          enum:
          - ADFSSAML
          - AdpOidc
          - AppleOAuth
          - Auth0SAML
          - AzureSAML
          - BitbucketOAuth
          - CasSAML
          - CloudflareSAML
          - ClassLinkSAML
          - CleverOIDC
          - CyberArkSAML
          - DiscordOAuth
          - DuoSAML
          - EntraIdOIDC
          - GenericOIDC
          - GenericSAML
          - GithubOAuth
          - GitLabOAuth
          - GoogleOAuth
          - GoogleOIDC
          - GoogleSAML
          - IntuitOAuth
          - JumpCloudSAML
          - KeycloakSAML
          - LastPassSAML
          - LinkedInOAuth
          - LoginGovOidc
          - MagicLink
          - MicrosoftOAuth
          - MiniOrangeSAML
          - NetIqSAML
          - OktaOIDC
          - OktaSAML
          - OneLoginSAML
          - OracleSAML
          - PingFederateSAML
          - PingOneSAML
          - RipplingSAML
          - SalesforceSAML
          - ShibbolethGenericSAML
          - ShibbolethSAML
          - SimpleSamlPhpSAML
          - SalesforceOAuth
          - SlackOAuth
          - VercelMarketplaceOAuth
          - VercelOAuth
          - VMwareSAML
          - XeroOAuth
          type: string
      - name: domain
        required: false
        in: query
        description: Filter Connections by their associated domain.
        schema:
          example: foo-corp.com
          type: string
      - name: organization_id
        required: false
        in: query
        description: Filter Connections by their associated organization.
        schema:
          example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
          type: string
      - name: search
        required: false
        in: query
        description: Searchable text to match against Connection names.
        schema:
          example: Foo Corp
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConnectionList'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: List Connections
      tags:
      - connections
  /connections/{id}:
    get:
      description: Get the details of an existing connection.
      operationId: ConnectionsController_find
      parameters:
      - name: id
        required: true
        in: path
        description: Unique identifier for the Connection.
        schema:
          example: conn_01E4ZCR3C56J083X43JQXF3JK5
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Connection'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: Get a Connection
      tags:
      - connections
    delete:
      description: Permanently deletes an existing connection. It cannot be undone.
      operationId: ConnectionsController_delete
      parameters:
      - name: id
        required: true
        in: path
        description: Unique identifier for the Connection.
        schema:
          example: conn_01E4ZCR3C56J083X43JQXF3JK5
          type: string
      responses:
        '200':
          description: OK
        '204':
          description: No Content
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
      summary: Delete a Connection
      tags:
      - connections
components:
  schemas:
    ConnectionList:
      type: object
      properties:
        object:
          type: string
          description: Indicates this is a list response.
          const: list
        data:
          type: array
          items:
            $ref: '#/components/schemas/Connection'
          description: The list of records for the current page.
        list_metadata:
          type: object
          properties:
            before:
              type:
              - string
              - 'null'
              description: An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.
              example: conn_01HXYZ123456789ABCDEFGHIJ
            after:
              type:
              - string
              - 'null'
              description: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.
              example: conn_01HXYZ987654321KJIHGFEDCBA
          required:
          - before
          - after
          description: Pagination cursors for navigating between pages of results.
      required:
      - object
      - data
      - list_metadata
      - list_metadata
    PaginationOrder:
      type: string
      enum:
      - normal
      - desc
      - asc
      example: desc
      default: desc
    Connection:
      type: object
      properties:
        object:
          type: string
          description: Distinguishes the Connection object.
          const: connection
        id:
          type: string
          description: Unique identifier for the Connection.
          example: conn_01E4ZCR3C56J083X43JQXF3JK5
        organization_id:
          type: string
          description: Unique identifier for the Organization in which the Connection resides.
          example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
        connection_type:
          type: string
          enum:
          - Pending
          - ADFSSAML
          - AdpOidc
          - AppleOAuth
          - Auth0Migration
          - Auth0SAML
          - AzureSAML
          - BitbucketOAuth
          - CasSAML
          - ClassLinkSAML
          - CleverOIDC
          - CloudflareSAML
          - CyberArkSAML
          - DiscordOAuth
          - DuoSAML
          - EntraIdOIDC
          - GenericOIDC
          - GenericSAML
          - GitHubOAuth
          - GitLabOAuth
          - GoogleOAuth
          - GoogleOIDC
          - GoogleSAML
          - IntuitOAuth
          - JumpCloudSAML
          - KeycloakSAML
          - LastPassSAML
          - LinkedInOAuth
          - LoginGovOidc
          - MagicLink
          - MicrosoftOAuth
          - MiniOrangeSAML
          - NetIqSAML
          - OktaOIDC
          - OktaSAML
          - OneLoginSAML
          - OracleSAML
          - PingFederateSAML
          - PingOneSAML
          - RipplingSAML
          - SalesforceSAML
          - ShibbolethGenericSAML
          - ShibbolethSAML
          - SimpleSamlPhpSAML
          - SalesforceOAuth
          - SlackOAuth
          - TestIdp
          - VercelMarketplaceOAuth
          - VercelOAuth
          - VMwareSAML
          - XeroOAuth
          description: The type of the SSO Connection used to authenticate the user. The Connection type may be used to dynamically generate authorization URLs.
          example: OktaSAML
        name:
          type: string
          description: A human-readable name for the Connection. This will most commonly be the organization's name.
          example: Foo Corp
        state:
          type: string
          enum:
          - requires_type
          - draft
          - active
          - validating
          - inactive
          - deleting
          description: Indicates whether a Connection is able to authenticate users.
          example: active
        status:
          type: string
          enum:
          - linked
          - unlinked
          description: Deprecated. Use `state` instead.
          deprecated: true
          example: linked
        domains:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
                description: Unique identifier for the Connection Domain.
                example: org_domain_01EHZNVPK2QXHMVWCEDQEKY69A
              object:
                type: string
                description: Distinguishes the Connection Domain object.
                const: connection_domain
              domain:
                type: string
                description: The domain value.
                example: foo-corp.com
            required:
            - id
            - object
            - domain
          description: List of Organization Domains.
        options:
          type: object
          properties:
            signing_cert:
              type:
              - string
              - 'null'
              description: The signing certificate of the SAML connection.
              example: null
          required:
          - signing_cert
          description: Configuration options for SAML connections. Only present for SAML connection types.
        created_at:
          format: date-time
          type: string
          description: An ISO 8601 timestamp.
          example: '2026-01-15T12:00:00.000Z'
        updated_at:
          format: date-time
          type: string
          description: An ISO 8601 timestamp.
          example: '2026-01-15T12:00:00.000Z'
      required:
      - object
      - id
      - connection_type
      - name
      - state
      - status
      - domains
      - created_at
      - updated_at
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: 'Your WorkOS API key prefixed with `sk_`. Pass it as a Bearer token: `Authorization: Bearer sk_example_123456789`.'
    access_token:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: An SSO access token returned from the Get a Profile and Token endpoint.