SSO connection events

Webhook events Scalekit sends when an organization's SSO connection is created, enabled, disabled or deleted, with sample payloads and fields.

Scalekit sends a webhook when an organization’s SSO connection is created, enabled, disabled or deleted. Use these events to keep your app’s record of which organizations can sign in with SSO in step with Scalekit, for example to show or hide an SSO button or to require SSO for an organization’s users.

To receive them, add an endpoint in Developers > Webhooks and select the events. See Implement webhooks, and verify every delivery as described in Verify webhook signatures.

Event	Sent when
`organization.sso_created`	An SSO connection is created for an organization
`organization.sso_enabled`	An SSO connection is enabled, so the organization’s users can sign in with it
`organization.sso_disabled`	An SSO connection is disabled, so its users can no longer sign in with it
`organization.sso_deleted`	An SSO connection is deleted

Scalekit doesn’t send a webhook when a connection’s configuration changes, such as its IdP metadata, certificate or attribute mapping. To read a connection’s current configuration, call Get connection details. For how IdP certificate rotation works, see Certificate expiry and rotation.

Event envelope

Every SSO connection event has the same top-level fields. The connection is in data. Keys can arrive in any order, so parse the body as JSON rather than matching it as text.

Field	Type	Description
`spec_version`	string	Webhook payload version. Currently `"1"`
`id`	string	Unique event ID, prefixed with `evt_`. Use it to ignore duplicate deliveries
`type`	string	Event type, such as `organization.sso_enabled`
`occurred_at`	string	When the event occurred, in RFC 3339 format
`environment_id`	string	Environment the event belongs to
`organization_id`	string	Organization the connection belongs to
`object`	string	Always `Connection`
`data`	object	The connection. All four events carry the same fields

Connection fields in `data`

Field	Type	Description
`id`	string	Connection ID, prefixed with `conn_`. It’s the `connection_id` you pass in an authorization URL
`organization_id`	string	Organization that owns the connection
`connection_type`	string	`SAML` or `OIDC`
`provider`	string	Identity provider, such as `OKTA` or `MICROSOFT_AD`
`enabled`	boolean or null	Whether users can sign in with the connection. `null` when the value wasn’t recorded with the event
`status`	string or null	Setup progress: `DRAFT`, `IN_PROGRESS` or `COMPLETED`. `null` when the value wasn’t recorded with the event

`organization.sso_created`

Sent when an SSO connection is created for an organization, from the dashboard, the admin portal or the API. A new connection is usually disabled and in DRAFT until your customer’s IT admin finishes setup and enables it.

1
{
2
  "spec_version": "1",
3
  "id": "evt_94567862441607493",
4
  "type": "organization.sso_created",
5
  "occurred_at": "2025-10-14T09:27:18.488720586Z",
6
  "environment_id": "env_74418471961625391",
7
  "organization_id": "org_83544995172188677",
8
  "object": "Connection",
9
  "data": {
10
    "id": "conn_94567862424830277",
11
    "organization_id": "org_83544995172188677",
12
    "connection_type": "OIDC",
13
    "provider": "OKTA",
14
    "enabled": false,
15
    "status": "DRAFT"
16
  }
17
}

`organization.sso_enabled`

Sent when an SSO connection is enabled. From now on, the organization’s users can sign in through it.

1
{
2
  "spec_version": "1",
3
  "id": "evt_94568078213382471",
4
  "type": "organization.sso_enabled",
5
  "occurred_at": "2025-10-14T09:29:27.098914861Z",
6
  "environment_id": "env_74418471961625391",
7
  "organization_id": "org_83544995172188677",
8
  "object": "Connection",
9
  "data": {
10
    "id": "conn_94567862424830277",
11
    "organization_id": "org_83544995172188677",
12
    "connection_type": "OIDC",
13
    "provider": "OKTA",
14
    "enabled": true,
15
    "status": "COMPLETED"
16
  }
17
}

`organization.sso_disabled`

Sent when an SSO connection is disabled. Sign-in requests that target this connection now fail with connection_not_active or no_active_connections (see the error reference), so route the organization’s users to another sign-in method until it’s enabled again.

1
{
2
  "spec_version": "1",
3
  "id": "evt_94557976165089560",
4
  "type": "organization.sso_disabled",
5
  "occurred_at": "2025-10-14T07:49:05.809554456Z",
6
  "environment_id": "env_74418471961625391",
7
  "organization_id": "org_83544995172188677",
8
  "object": "Connection",
9
  "data": {
10
    "id": "conn_83545002856153607",
11
    "organization_id": "org_83544995172188677",
12
    "connection_type": "OIDC",
13
    "provider": "OKTA",
14
    "enabled": false,
15
    "status": "COMPLETED"
16
  }
17
}

`organization.sso_deleted`

Sent when an SSO connection is deleted. If your customer creates a new connection, it has a new connection ID, so the sub of their users changes. See Choose a stable user identifier.

1
{
2
  "spec_version": "1",
3
  "id": "evt_94557997639926040",
4
  "type": "organization.sso_deleted",
5
  "occurred_at": "2025-10-14T07:49:18.604546332Z",
6
  "environment_id": "env_74418471961625391",
7
  "organization_id": "org_83544995172188677",
8
  "object": "Connection",
9
  "data": {
10
    "id": "conn_83545002856153607",
11
    "organization_id": "org_83544995172188677",
12
    "connection_type": "OIDC",
13
    "provider": "OKTA",
14
    "enabled": false,
15
    "status": "COMPLETED"
16
  }
17
}

SSO connection events

Event envelope

Connection fields in data

organization.sso_created

organization.sso_enabled

organization.sso_disabled

organization.sso_deleted

Connection fields in `data`

`organization.sso_created`

`organization.sso_enabled`

`organization.sso_disabled`

`organization.sso_deleted`