Reference

connections

OIDC connections: signing people in to Troupe with an external OpenID Provider. Index · shared schemas · errors.

Procedure	Summary	REST	MCP tool	Stability
`connections.create`	Create an org-owned OIDC connection in linked mode; discovery is fetched and must name the issuer exactly. Trust class.	`POST`	—	experimental
`connections.list`	List the OIDC connections that sign people in to the org (its own and staff-created ones)	`GET`	—	experimental
`connections.remove`	Remove an org-owned connection: its links end, and so do the memberships derived from them (accounts stay)	`POST`	—	experimental

`connections.create`

Create an org-owned OIDC connection in linked mode; discovery is fetched and must name the issuer exactly. Trust class.


REST	`POST /v1/connections/create` (input as a JSON body)
RPC	`/rpc/v2/connections/create`
MCP	not a tool (a cloud platform procedure; the cloud MCP surface is the curated device tools); hints: none
Auth	`org:manage`; trust-class: locally only the runtime owner token; in the cloud only an interactive user session re-authenticated within 15 minutes; never an API key or an MCP token
Tenancy	`org`
Troupe Cloud	answered by the control plane
Stability	experimental, since 1.0

Input:

TypeScript

{
  orgId: OrgId
  name: DisplayName
  issuer: string  // ≤ 2048 chars; url
  clientId: string  // /^[\x21-\x7e]{1,256}$/
  clientSecret: string  // 1–1024 chars
  scopes?: string[]  // ≤ 16 items; each /^[\x21\x23-\x5b\x5d-\x7e]{1,64}$/
  allowedAlgs?: ('EdDSA' | 'ES256' | 'RS256')[]  // 1–3 items
}

Output:

TypeScript

{ connection: OidcConnection }

Errors: U, NOT_FOUND, ORG_SUSPENDED, CONFLICT.

Named types: DisplayName, OidcConnection, OrgId.

`connections.list`

List the OIDC connections that sign people in to the org (its own and staff-created ones)


REST	`GET /v1/connections/list` (input as query parameters)
RPC	`/rpc/v2/connections/list`
MCP	not a tool (a cloud platform procedure; the cloud MCP surface is the curated device tools); hints: read-only, idempotent
Auth	`org:manage`
Tenancy	`org`
Troupe Cloud	answered by the control plane
Stability	experimental, since 1.0

Input:

TypeScript

{ orgId: OrgId }

Output:

TypeScript

{ connections: OidcConnection[] }

Errors: U, NOT_FOUND.

Named types: OidcConnection, OrgId.

`connections.remove`

Remove an org-owned connection: its links end, and so do the memberships derived from them (accounts stay)


REST	`POST /v1/connections/remove` (input as a JSON body)
RPC	`/rpc/v2/connections/remove`
MCP	not a tool (a cloud platform procedure; the cloud MCP surface is the curated device tools); hints: idempotent, destructive
Auth	`org:manage`
Tenancy	`org`
Troupe Cloud	answered by the control plane
Stability	experimental, since 1.0

Input:

TypeScript

{ orgId: OrgId; connectionId: ConnectionId }

Output:

TypeScript

{ removed: boolean }

Errors: U, NOT_FOUND, CONFLICT.

Named types: ConnectionId, OrgId.