← All breaking-change reports

Setting ssoProtection to null on a Vercel project: what the API actually accepts

vercel · guide · 2026-08-04 · upstream source

What changed

Nothing changed — this is a reference answer to a question people actually search for: how do you disable Vercel Authentication (SSO Protection) on a project through the REST API, and why does PATCH /v10/projects/{projectId} not behave the way you expect?

The short answer, verified against Vercel's OpenAPI description as shipped in @vercel/sdk v1.28.15 (and stable across every version we track back to v1.27.0):

  • The project update endpoint is PATCH /v9/projects/{idOrName}. There is no PATCH /v10/projects/{idOrName} in the spec. Under /v10/projects the only operations are the list GET, plus the domains, env, and promote sub-resources.
  • In the PATCH request body, ssoProtection is declared nullable: true. Sending "ssoProtection": null is the documented way to turn Vercel Authentication off.
  • When you send an object instead, deploymentType is required, with four accepted values: all, preview (the default), prod_deployment_urls_and_all_previews, and all_except_custom_domains.

Who is affected

Anyone scripting project settings — IaC pipelines, provisioning scripts, or an agent that manages Vercel projects. Two traps show up in practice:

  • *Wrong version prefix.* Version prefixes on the Vercel API are per-endpoint, not global. Seeing /v10/projects in the list call does not mean the update call is v10. If you PATCH a v10 path you get a 404 and a misleading search trail.
  • *Echoing the GET response back into PATCH.* The ssoProtection object you read from GET /v9/projects/{idOrName} carries extra read-only fields — cve55182MigrationAppliedFrom and april2026SecurityIncidentMigrationAppliedFrom, both nullable enums that record security-migration history. The PATCH request schema sets additionalProperties: false for ssoProtection, so a read-modify-write cycle that includes those fields is rejected. Strip everything except deploymentType before writing.

How to fix it

To disable SSO protection:

curl -X PATCH "https://api.vercel.com/v9/projects/$PROJECT_ID" \
  -H "Authorization: Bearer $VERCEL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ssoProtection": null}'

To enable it for every deployment target:

curl -X PATCH "https://api.vercel.com/v9/projects/$PROJECT_ID" \
  -H "Authorization: Bearer $VERCEL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ssoProtection": {"deploymentType": "all"}}'

We track the Vercel OpenAPI description version to version — the ssoProtection request shape has been stable across the v1.27.0 to v1.28.15 corridor, while the surrounding project endpoints have dropped response properties repeatedly. If your code reads project responses, mendapi scan will tell you which removals hit your files, offline:

npx mendapi scan --repo .

Related

Change data is recorded from upstream provider releases, changelogs and OpenAPI spec diffs; every article names its source.