# Restore a deleted connection

`POST /v1/connections/{connection_id}:restore` · permission `connections:write`

Brings back a deleted connection. A deleted connection can be restored for 30 days; during that time it is not listed, cannot be read (`404`) and cannot be used to sign in. After 30 days it is deleted permanently.

The restored connection comes back with its previous settings and `status` = `inactive`. It is never activated automatically: call `:activate` when you are ready (for an enterprise connection the test requirement and the plan quota are checked there). Application connection lists and the connection's role mappings are removed when the connection is deleted and are not brought back.

The request body is optional and has no fields. The operation is idempotent: if the connection is not deleted, nothing is written and the current connection is returned.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `connection_id` | string | yes | Connection identifier (`conn_…`). |
| `Idempotency-Key` | header | no | Optional key (16-64 characters) that makes a retried request safe. |

The body is optional; if present it must be `{}`.

## Response

`200 OK` with the connection and its `ETag`.

```json
{
  "id": "conn_0k3v8m1q2x9dz4h7s5t6w0y1ab",
  "key": "acme-saml",
  "type": "enterprise",
  "strategy": "saml",
  "name": "Acme SAML",
  "display_name": null,
  "status": "inactive",
  "org_id": "org_0k3v8m1q2x9dz4h7s5t6w0y1ac",
  "allowed_email_domains": ["acme.example"],
  "allow_external_domains": false,
  "jit_mode": "create",
  "email_trust": false,
  "default_role_ids": [],
  "trust_idp_mfa": false,
  "allow_idp_initiated": false,
  "idp_initiated_default_application_id": null,
  "idp_initiated_allowed_application_ids": [],
  "settings": {},
  "created_at": "2026-10-05T09:30:00.123456Z",
  "updated_at": "2026-10-26T17:00:00.123456Z"
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 400 | `unknown_field` | The body contains a field. |
| 404 | `not_found` | The connection does not exist, belongs to another environment, or was deleted more than 30 days ago. |
| 409 | `conflict` | Another connection now uses the same `key` or `name` (or the single passkey or social provider slot), or the owning organization was deleted. |
| 403 | `quota_exceeded` | The environment already has the maximum number of connections. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl -X POST https://api.eu.keenauth.com/v1/connections/conn_0k3v8m1q2x9dz4h7s5t6w0y1ab:restore \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

CLI: `keenauth connections restore conn_0k3v8m1q2x9dz4h7s5t6w0y1ab`