Investors

Set an investor's single sign-on id

POST/investors/{id}/actions/set-sso-id
investors:writeset_sso_id_investorIdempotent

Sets the investor's single sign-on id to sso_id, or clears it with null, and returns the investor. An id that another user holds, live or deleted, returns 422 unique. The same value again returns 200 with no event. Clearing it lets the investor sign in with a password where only single sign-on was allowed. Emits investor.updated with sso_id in changed_fields and sends no email. Setting the previous value undoes it. Replaces PUT /investors/{userId}/sso-id.

Path parameters

  • idstring (uuid)Required#

    The investor's id, a uuid. An unknown investor, or one outside the token's organisation and its client organisations, returns 404.

Query parameters

  • dry_runboolean#

    Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Headers

  • Idempotency-Keystring#

    Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.

Request body

application/json, required · InvestorSetSsoId

  • sso_idstring | nullRequired#

    The single sign-on id, or null to clear it.

{
  "sso_id": "okta|00u1a2b3c4d5e6f7g8h9"
}

Responses

200

The investor, with its new sso_id.

Investor
{
  "data": {
    "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "first_name": "string",
    "last_name": "string",
    "title": "string",
    "email": "string",
    "status": "active",
    "external_id": "string",
    "sso_id": "string",
    "key_contact_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "invite": {
      "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
      "status": "invited",
      "expires_at": "2026-06-12T10:00:00+00:00"
    },
    "two_factor_enabled": true,
    "last_login": "2026-06-12T10:00:00+00:00",
    "created_at": "2026-06-12T10:00:00+00:00",
    "updated_at": "2026-06-12T10:00:00+00:00",
    "data_capture": {},
    "onboarding": {
      "flow_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
      "flow_name": "string",
      "status": "pending",
      "completed_at": "2026-06-12T10:00:00+00:00"
    },
    "invites": [
      {
        "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
        "type": "string",
        "status": "string",
        "email": "string",
        "expires_at": "2026-06-12T10:00:00+00:00",
        "invited_at": "2026-06-12T10:00:00+00:00",
        "created_at": "2026-06-12T10:00:00+00:00"
      }
    ],
    "roles": [
      {
        "id": 1,
        "name": "string",
        "label": "string"
      }
    ]
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error
404

Resource not found (error.code = not_found).

Error
409

The request conflicts with existing state (error.code = conflict), e.g. a compliance flow with the requested name already exists.

Error
422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error
429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/investors/{id}/actions/set-sso-id\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "sso_id": "okta|00u1a2b3c4d5e6f7g8h9"
}'