diff --git a/openapi/SOURCE.json b/openapi/SOURCE.json
index 29f5b8c..b3c7b6d 100644
--- a/openapi/SOURCE.json
+++ b/openapi/SOURCE.json
@@ -2,12 +2,12 @@
  "verification.json": {
   "url": "https://docs.didit.me/openapi-25.json",
   "sha256": "99198089e59db66a2eb3fa2a17c9475a2dafce62ee25ed8998eaf00fb2108406",
-  "fetched_at": "2026-11-09T19:33:11Z"
+  "fetched_at": "2026-11-10T00:24:13Z"
  },
  "account.json": {
   "url": "https://docs.didit.me/openapi-auth.json",
-  "sha256": "403daf72045fdf90d14a86a8bb7eb75938454520b92441c7c294ed09acdff703",
-  "fetched_at": "2026-11-09T19:33:11Z"
+  "sha256": "8a02e3aad37615281d42926abcfc0a10a449e02cd8c70dd6ef8633abb7185704",
+  "fetched_at": "2026-11-10T00:24:13Z"
  },
  "webhook-vectors.json": {
   "generator": "product-automations scripts/server-sdks/make_vectors.py (seeded 2026-10-17)",
@@ -16,6 +16,6 @@
  "authentication.json": {
   "url": "https://docs.didit.me/openapi-authentication.json",
   "sha256": "3987984647bfcaa4b5462c8d60cd3c53894bf7585a38109e0cc813292b2416fe",
-  "fetched_at": "2026-11-09T19:33:11Z"
+  "fetched_at": "2026-11-10T00:24:13Z"
  }
 }
\ No newline at end of file
diff --git a/openapi/account.json b/openapi/account.json
index a2586bb..0847dd7 100644
--- a/openapi/account.json
+++ b/openapi/account.json
@@ -370,11 +370,18 @@
             }
           },
           "403": {
-            "description": "The account was recovered and must set up a new sign-in method first. No tokens are issued; a link to do that was emailed to the account's address.",
+            "description": "The account was recovered and must set up a new sign-in method first. No tokens are issued; a link to do that was emailed to the account's address. An account whose organization enforces SSO gets `403` with `error: sso_required`, `organization_name`, `organization_slug` and `sso_url`, with no tokens and no new organization.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RecoverySetupRequiredError"
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/RecoverySetupRequiredError"
+                    },
+                    {
+                      "$ref": "#/components/schemas/SsoRequiredError"
+                    }
+                  ]
                 },
                 "examples": {
                   "RecoverySetupRequired": {
@@ -385,6 +392,16 @@
                       "message": "You recovered your account. Open the link we emailed you to set up a new sign-in method.",
                       "code": "recovery_setup_required"
                     }
+                  },
+                  "SSORequired": {
+                    "summary": "The account belongs to an organization that requires SSO",
+                    "value": {
+                      "error": "sso_required",
+                      "message": "Your organization 'Acme Corp' requires SSO login.",
+                      "organization_name": "Acme Corp",
+                      "organization_slug": "acme-corp",
+                      "sso_url": "/sso/acme-corp"
+                    }
                   }
                 }
               }
@@ -560,18 +577,6 @@
                     "value": {
                       "detail": "Please verify your email address before logging in."
                     }
-                  },
-                  "SSORequired": {
-                    "summary": "The account belongs to an organization that requires SSO",
-                    "value": {
-                      "detail": {
-                        "error": "sso_required",
-                        "message": "Your organization 'Acme Corp' requires SSO login.",
-                        "organization_name": "Acme Corp",
-                        "organization_slug": "acme-corp",
-                        "sso_url": "/sso/acme-corp"
-                      }
-                    }
                   }
                 }
               }
@@ -582,7 +587,14 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RecoverySetupRequiredError"
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/RecoverySetupRequiredError"
+                    },
+                    {
+                      "$ref": "#/components/schemas/SsoRequiredError"
+                    }
+                  ]
                 },
                 "examples": {
                   "RecoverySetupRequired": {
@@ -593,6 +605,16 @@
                       "message": "You recovered your account. Open the link we emailed you to set up a new sign-in method.",
                       "code": "recovery_setup_required"
                     }
+                  },
+                  "SSORequired": {
+                    "summary": "The account belongs to an organization that requires SSO",
+                    "value": {
+                      "error": "sso_required",
+                      "message": "Your organization 'Acme Corp' requires SSO login.",
+                      "organization_name": "Acme Corp",
+                      "organization_slug": "acme-corp",
+                      "sso_url": "/sso/acme-corp"
+                    }
                   }
                 }
               }
@@ -2748,6 +2770,43 @@
           }
         }
       },
+      "SsoRequiredError": {
+        "type": "object",
+        "description": "The account belongs to an organization that requires SSO sign-in. No tokens, API keys or organizations are issued; sign in through the organization's SSO in a browser instead.",
+        "required": [
+          "error",
+          "message",
+          "organization_name",
+          "organization_slug",
+          "sso_url"
+        ],
+        "properties": {
+          "error": {
+            "type": "string",
+            "enum": [
+              "sso_required"
+            ],
+            "example": "sso_required"
+          },
+          "message": {
+            "type": "string",
+            "example": "Your organization 'Acme Corp' requires SSO login."
+          },
+          "organization_name": {
+            "type": "string",
+            "example": "Acme Corp"
+          },
+          "organization_slug": {
+            "type": "string",
+            "example": "acme-corp"
+          },
+          "sso_url": {
+            "type": "string",
+            "description": "Path of the organization's SSO sign-in page, relative to the console.",
+            "example": "/sso/acme-corp"
+          }
+        }
+      },
       "RecoverySetupRequiredError": {
         "type": "object",
         "description": "The account was recovered and has no sign-in method set up yet. No tokens are issued; a one-time link to set up a new method was emailed to the account's address. Open it, set up the method, then log in again.",