SSO Connection · StartupBuilder

Properties

Property	Type	Required	Description
`protocol`	`string`	required	How sign-in is asserted: `saml` or `oidc`.
`state`	`string`	required	Where it stands; only `active` signs anyone in.
`certificateExpiresAt`	`datetime`		When the signing certificate expires; the Customer’s admin hears 30 days before.
`testedAt`	`datetime`		When the Customer’s admin last completed a test sign-in.

Object

JSON

{
  "$id": "https://api.sb/tutorloop.com/sso-connections/sso_connection_1",
  "$type": "SSOConnection",
  "protocol": "saml",
  "state": "draft",
  "certificateExpiresAt": "2026-10-22T12:00:00Z",
  "testedAt": "2026-10-22T12:00:00Z"
}

Relationships

A SSO Connection serves one Tenant: a Tenant’s people sign in through its SSO Connections; the Customer’s admin owns each one. serves, inverse signsInVia.

Lifecycle

State	Meaning	Moves to
`draft` (first)	Its configuration is entered, and no test sign-in has passed.	`active` by SSOConnection.activate
`active`	Everyone in the Tenant signs in through it.	`failing` on `SSOConnection.failed`; `inactive` by SSOConnection.deactivate
`failing`	Sign-ins through it fail, and the Customer’s admin has been told why.	`active` by SSOConnection.activate; `inactive` by SSOConnection.deactivate
`inactive`	Turned off: nobody signs in through it, and its configuration is kept.	`active` by SSOConnection.activate

Verbs

createCreates a SSO Connection.
POST /{namespace}/sso-connectionsdoSSOConnection.created
getReturns one SSO Connection by id.
GET /{namespace}/sso-connections/{id}readNo Event
listReturns SSO Connections, newest first, one page at a time.
GET /{namespace}/sso-connectionsreadNo Event
updateChanges the given properties of a SSO Connection.
PATCH /{namespace}/sso-connections/{id}doSSOConnection.updated
activateActivate turns an SSO Connection on after a test sign-in passes, so the Tenant’s people sign in through it.
POST /{namespace}/sso-connections/{connection}/activatedoSSOConnection.activated
deactivateDeactivate turns an SSO Connection off, so nobody signs in through it; its configuration is kept.
POST /{namespace}/sso-connections/{connection}/deactivatedoSSOConnection.deactivated

Events

Events no Verb emits. Each Verb’s Event is in the Verbs table above; every Event is delivered in the same shape.

SSOConnection.failed

Sign-ins through an SSO Connection started failing, from an expired certificate or a change on the Customer’s side. Raised by the rail.

Field	Type	Required	Description
`name`	`string`	required	`SSOConnection.failed`.
`at`	`datetime`	required	When it happened.
`seq`	`integer`		Its position in the namespace, one more than the Event before; any seq is a cursor into the history.
`data`	`json`	required	The Thing as the Action left it.
`data.ssoConnection`	SSO Connection	required	The SSO Connection as the change left it.
`data.ssoConnection.protocol`	`string`	required	How sign-in is asserted: `saml` or `oidc`.
`data.ssoConnection.state`	`string`	required	Where it stands; only `active` signs anyone in.
`data.ssoConnection.certificateExpiresAt`	`datetime`		When the signing certificate expires; the Customer’s admin hears 30 days before.
`data.ssoConnection.testedAt`	`datetime`		When the Customer’s admin last completed a test sign-in.
`data.cause`	`string`	required	What failed: `certificateExpired`, `signatureInvalid`, or `providerUnreachable`.
`data.previous.state`	`string`	required	The `state` before this Event: `active`.

JSON

{
  "$id": "https://api.sb/tutorloop.com/events/event_1",
  "$type": "Event",
  "name": "SSOConnection.failed",
  "at": "2026-10-22T12:00:00Z",
  "data": {
    "ssoConnection": {
      "$id": "https://api.sb/tutorloop.com/sso-connections/sso_connection_1",
      "$type": "SSOConnection",
      "protocol": "saml",
      "state": "failing",
      "certificateExpiresAt": "2026-10-22T12:00:00Z",
      "testedAt": "2026-10-22T12:00:00Z"
    },
    "cause": "certificateExpired",
    "previous": {
      "state": "active"
    }
  },
  "seq": 1
}

Permissions

Which Access level may call each Verb. One-way Verbs wait their delay window.

Operation	`owner`	`admin`	`member`	`viewer`
`SSOConnection.create`	Yes	Yes	No	No
`SSOConnection.get`	Yes	Yes	Yes	Yes
`SSOConnection.list`	Yes	Yes	Yes	Yes
`SSOConnection.update`	Yes	Yes	No	No
`SSOConnection.activate`	Yes	Yes	No	No
`SSOConnection.deactivate`	Yes	Yes	No	No

Call it

Text

Activate the latest SSO connection.

Example

A 2,000-person Customer connects its identity system to its Tenant over saml. Its admin completes a test sign-in, the connection goes active, and passwords stop working for that domain.

PropertiesCopy Anchor Link

ObjectCopy Anchor Link

RelationshipsCopy Anchor Link

LifecycleCopy Anchor Link

VerbsCopy Anchor Link

EventsCopy Anchor Link

SSOConnection.failedCopy Anchor Link

PermissionsCopy Anchor Link

Call itCopy Anchor Link

ExampleCopy Anchor Link