openapi: 3.0.3
info:
title: Stytch B2B Authentication Application B2B Impersonation API
version: 2.0.0
description: Stytch's B2B API for multi-tenant authentication. Supports Organizations, Members, SSO (SAML/OIDC), Magic Links, OTP, OAuth, Discovery, Sessions, B2B RBAC, SCIM, TOTP, Recovery Codes, Passwords, Impersonation, and the B2B IDP.
contact:
name: Stytch
url: https://stytch.com/docs
license:
name: Proprietary
servers:
- url: https://api.stytch.com
description: Production
- url: https://test.stytch.com
description: Test
tags:
- name: B2B Impersonation
paths:
/v1/b2b/impersonation/authenticate:
post:
summary: Authenticate
operationId: api_b2b_impersonation_v1_Authenticate
tags:
- B2B Impersonation
description: "Authenticate an impersonation token to impersonate a Member. This endpoint requires an impersonation token that is not expired or previously used. \nA Stytch session will be created for the impersonated member with a 60 minute duration. Impersonated sessions cannot be extended.\n\nPrior to this step, you can generate an impersonation token by visiting the Stytch Dashboard, viewing a member, and clicking the `Impersonate Member` button."
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_impersonation_v1_AuthenticateRequest'
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_impersonation_v1_AuthenticateResponse'
'400':
description: Bad request
'401':
description: Unauthorized
content:
application/json:
example:
status_code: 401
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: unauthorized_credentials
error_message: Unauthorized credentials.
error_url: https://stytch.com/docs/api/errors/401
'429':
description: Too Many Requests
content:
application/json:
example:
status_code: 429
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: too_many_requests
error_message: Too many requests have been made.
error_url: https://stytch.com/docs/api/errors/429
'500':
description: Internal server error
content:
application/json:
example:
status_code: 500
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: internal_server_error
error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
error_url: https://stytch.com/docs/api/errors/500
x-code-samples:
- lang: csharp
label: C#
source: "// POST /v1/b2b/impersonation/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n impersonation_token: \"${token}\",\n};\n\nclient.Impersonation.Authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: go
label: Go
source: "// POST /v1/b2b/impersonation/authenticate\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/impersonation\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &impersonation.AuthenticateParams{\n\t\tImpersonationToken: \"${token}\",\n\t}\n\n\tresp, err := client.Impersonation.Authenticate(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
- lang: java
label: Java
source: "// POST /v1/b2b/impersonation/authenticate\npackage com.example;\n\nimport com.stytch.java.b2b.models.impersonation.AuthenticateRequest;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n public static void main(String[] args) {\n StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n AuthenticateRequest params = new AuthenticateRequest();\n params.setImpersonationToken(\"${token}\");\n\n Object result = StytchB2BClient.getImpersonation().authenticate(params);\n if (result instanceof StytchResult.Success) {\n System.out.println(((StytchResult.Success) result).getValue());\n } else {\n System.out.println(((StytchResult.Error) result).getException());\n }\n }\n}"
- lang: kotlin
label: Kotlin
source: "// POST /v1/b2b/impersonation/authenticate\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.impersonation.AuthenticateRequest\n\nfun main() {\n StytchB2BClient.configure(\n projectId = \"${projectId}\",\n secret = \"${secret}\",\n )\n\n when (\n val result =\n StytchB2BClient.impersonation.authenticate(\n AuthenticateRequest(\n impersonationToken = \"${token}\",\n ),\n )\n ) {\n is StytchResult.Success -> println(result.value)\n is StytchResult.Error -> println(result.exception)\n }\n}\n"
- lang: javascript
label: Node.js
source: "// POST /v1/b2b/impersonation/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n impersonation_token: \"${token}\",\n};\n\nclient.impersonation.authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: php
label: PHP
source: "$response = $client->impersonation->authenticate([\n 'impersonation_token' => '${token}',\n]);"
- lang: python
label: Python
source: "# POST /v1/b2b/impersonation/authenticate\nfrom stytch import B2BClient\n\nclient = B2BClient(\n project_id=\"${projectId}\",\n secret=\"${secret}\",\n)\n\nresp = client.impersonation.authenticate(\n impersonation_token=\"${token}\",\n)\n\nprint(resp)\n"
- lang: ruby
label: Ruby
source: "# POST /v1/b2b/impersonation/authenticate\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n project_id: \"${projectId}\",\n secret: \"${secret}\"\n)\n\nresp = client.impersonation.authenticate(\n impersonation_token: \"${token}\"\n \n)\n\nputs resp"
- lang: rust
label: Rust
source: "// POST /v1/b2b/impersonation/authenticate\nuse stytch::b2b::client::Client;\nuse stytch::b2b::impersonation::AuthenticateRequest;\n\nfn main() {\n let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n let resp = client.impersonation.authenticate(\n AuthenticateRequest{\n impersonation_token: \"${token}\",\n ..Default::default()\n }\n ).await;\n println!(\"The response is {:?}\", resp);\n}"
- lang: bash
label: cURL
source: "# POST /v1/b2b/impersonation/authenticate\ncurl --request POST \\\n --url https://test.stytch.com/v1/b2b/impersonation/authenticate \\\n -u '${projectId}:${secret}' \\\n -H 'Content-Type: application/json' \\\n -d '{\n \"impersonation_token\": \"${token}\"\n }'"
components:
schemas:
api_session_v1_SlackOAuthFactor:
type: object
properties:
id:
type: string
description: The unique ID of an OAuth registration.
provider_subject:
type: string
description: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
email_id:
type: string
description: The globally unique UUID of the Member's email.
required:
- id
- provider_subject
api_session_v1_HubspotOAuthFactor:
type: object
properties:
id:
type: string
description: The unique ID of an OAuth registration.
provider_subject:
type: string
description: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
email_id:
type: string
description: The globally unique UUID of the Member's email.
required:
- id
- provider_subject
api_session_v1_TwitchOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_b2b_scim_v1_IMs:
type: object
properties:
value:
type: string
type:
type: string
primary:
type: boolean
required:
- value
- type
- primary
api_session_v1_EmbeddableMagicLinkFactor:
type: object
properties:
embedded_id:
type: string
required:
- embedded_id
api_b2b_scim_v1_SCIMAttributes:
type: object
properties:
user_name:
type: string
id:
type: string
external_id:
type: string
active:
type: boolean
groups:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Group'
display_name:
type: string
nick_name:
type: string
profile_url:
type: string
user_type:
type: string
title:
type: string
preferred_language:
type: string
locale:
type: string
timezone:
type: string
emails:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Email'
phone_numbers:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_PhoneNumber'
addresses:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Address'
ims:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_IMs'
photos:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Photo'
entitlements:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Entitlement'
roles:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Role'
x509certificates:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_X509Certificate'
name:
$ref: '#/components/schemas/api_b2b_scim_v1_Name'
enterprise_extension:
$ref: '#/components/schemas/api_b2b_scim_v1_EnterpriseExtension'
required:
- user_name
- id
- external_id
- active
- groups
- display_name
- nick_name
- profile_url
- user_type
- title
- preferred_language
- locale
- timezone
- emails
- phone_numbers
- addresses
- ims
- photos
- entitlements
- roles
- x509certificates
api_b2b_session_v1_MemberSession:
type: object
properties:
member_session_id:
type: string
description: Globally unique UUID that identifies a specific Session.
member_id:
type: string
description: Globally unique UUID that identifies a specific Member.
started_at:
type: string
description: The timestamp when the Session was created. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
last_accessed_at:
type: string
description: The timestamp when the Session was last accessed. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
expires_at:
type: string
description: The timestamp when the Session expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
authentication_factors:
type: array
items:
$ref: '#/components/schemas/api_session_v1_AuthenticationFactor'
description: An array of different authentication factors that comprise a Session.
organization_id:
type: string
description: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value.
roles:
type: array
items:
type: string
organization_slug:
type: string
description: 'The unique URL slug of the Organization. The slug only accepts alphanumeric characters and the following reserved characters: `-` `.` `_` `~`. Must be between 2 and 128 characters in length. Wherever an organization_id is expected in a path or request parameter, you may also use the organization_slug as a convenience.'
custom_claims:
type: object
additionalProperties: true
description: The custom claims map for a Session. Claims can be added to a session during a Sessions authenticate call.
required:
- member_session_id
- member_id
- started_at
- last_accessed_at
- expires_at
- authentication_factors
- organization_id
- roles
- organization_slug
api_session_v1_EmailFactor:
type: object
properties:
email_id:
type: string
description: The globally unique UUID of the Member's email.
email_address:
type: string
description: The email address of the Member.
required:
- email_id
- email_address
api_organization_v1_MemberRoleSource:
type: object
properties:
type:
type: string
description: "The type of role assignment. The possible values are:\n \n `direct_assignment` – an explicitly assigned Role.\n\n Directly assigned roles can be updated by passing in the `roles` argument to the\n [Update Member](https://stytch.com/docs/b2b/api/update-member) endpoint.\n \n `email_assignment` – an implicit Role granted by the Member's email domain, regardless of their login method.\n\n Email implicit role assignments can be updated by passing in the `rbac_email_implicit_role_assignments` argument to\n the [Update Organization](https://stytch.com/docs/b2b/api/update-organization) endpoint.\n \n `sso_connection` – an implicit Role granted by the Member's SSO connection. This is currently only available\n for SAML connections and not for OIDC. If the Member has a SAML Member registration with the given connection, this\n role assignment will appear in the list. However, for authorization check purposes (in\n [sessions authenticate](https://stytch.com/docs/b2b/api/authenticate-session) or in any endpoint that enforces RBAC with session\n headers), the Member will only be granted the Role if their session contains an authentication factor with the\n specified SAML connection.\n\n SAML connection implicit role assignments can be updated by passing in the\n `saml_connection_implicit_role_assignments` argument to the\n [Update SAML connection](https://stytch.com/docs/b2b/api/update-saml-connection) endpoint.\n \n `sso_connection_group` – an implicit Role granted by the Member's SSO connection and group. This is currently only\n available for SAML connections and not for OIDC. If the Member has a SAML Member registration with the given\n connection, and belongs to a specific group within the IdP, this role assignment will appear in the list. However,\n for authorization check purposes (in [sessions authenticate](https://stytch.com/docs/b2b/api/authenticate-session) or in any endpoint\n that enforces RBAC with session headers), the Member will only be granted the role if their session contains an\n authentication factor with the specified SAML connection.\n\n SAML group implicit role assignments can be updated by passing in the `saml_group_implicit_role_assignments`\n argument to the [Update SAML connection](https://stytch.com/docs/b2b/api/update-saml-connection) endpoint.\n\n `scim_connection_group` – an implicit Role granted by the Member's SCIM connection and group. If the Member has\n a SCIM Member registration with the given connection, and belongs to a specific group within the IdP, this role assignment will appear in the list.\n\n SCIM group implicit role assignments can be updated by passing in the `scim_group_implicit_role_assignments`\n argument to the [Update SCIM connection](https://stytch.com/docs/b2b/api/update-scim-connection) endpoint.\n "
details:
type: object
additionalProperties: true
description: "An object containing additional metadata about the source assignment. The fields will vary depending\n on the role assignment type as follows:\n \n `direct_assignment` – no additional details.\n \n `email_assignment` – will contain the email domain that granted the assignment.\n \n `sso_connection` – will contain the `connection_id` of the SAML connection that granted the assignment.\n \n `sso_connection_group` – will contain the `connection_id` of the SAML connection and the name of the `group`\n that granted the assignment.\n \n `scim_connection_group` – will contain the `connection_id` of the SAML connection and the `group_id`\n that granted the assignment.\n "
required:
- type
api_b2b_impersonation_v1_AuthenticateRequest:
type: object
properties:
impersonation_token:
type: string
description: The Member Impersonation token to authenticate. Expires in 5 minutes by default.
description: Request type
required:
- impersonation_token
api_session_v1_SteamOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_b2b_scim_v1_Entitlement:
type: object
properties:
value:
type: string
type:
type: string
primary:
type: boolean
required:
- value
- type
- primary
api_session_v1_BitbucketOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_b2b_scim_v1_X509Certificate:
type: object
properties:
value:
type: string
type:
type: string
primary:
type: boolean
required:
- value
- type
- primary
api_session_v1_OAuthAccessTokenExchangeFactor:
type: object
properties:
client_id:
type: string
description: The ID of the Connected App client.
required:
- client_id
api_session_v1_DiscordOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_session_v1_TrustedAuthTokenFactor:
type: object
properties:
token_id:
type: string
description: The ID of the trusted auth token.
required:
- token_id
api_session_v1_AppleOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_session_v1_ShopifyOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_session_v1_SalesforceOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_session_v1_AmazonOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_organization_v1_SCIMRegistration:
type: object
properties:
connection_id:
type: string
description: The ID of the SCIM connection.
registration_id:
type: string
description: The unique ID of a SCIM Registration.
external_id:
type: string
description: The ID of the member given by the identity provider.
scim_attributes:
$ref: '#/components/schemas/api_b2b_scim_v1_SCIMAttributes'
description: An object for storing SCIM attributes brought over from the identity provider.
required:
- connection_id
- registration_id
api_session_v1_YahooOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_session_v1_TwitterOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_b2b_scim_v1_Email:
type: object
properties:
value:
type: string
type:
type: string
primary:
type: boolean
required:
- value
- type
- primary
api_session_v1_AuthenticationFactorDeliveryMethod:
type: string
enum:
- email
- sms
- whatsapp
- embedded
- oauth_google
- oauth_microsoft
- oauth_apple
- webauthn_registration
- authenticator_app
- oauth_github
- recovery_code
- oauth_facebook
- crypto_wallet
- oauth_amazon
- oauth_bitbucket
- oauth_coinbase
- oauth_discord
- oauth_figma
- oauth_gitlab
- oauth_instagram
- oauth_linkedin
- oauth_shopify
- oauth_slack
- oauth_snapchat
- oauth_spotify
- oauth_steam
- oauth_tiktok
- oauth_twitch
- oauth_twitter
- knowledge
- biometric
- sso_saml
- sso_oidc
- oauth_salesforce
- oauth_yahoo
- oauth_hubspot
- imported_auth0
- oauth_exchange_slack
- oauth_exchange_hubspot
- oauth_exchange_github
- oauth_exchange_google
- impersonation
- oauth_access_token_exchange
- trusted_token_exchange
api_session_v1_AuthenticationFactorType:
type: string
enum:
- magic_link
- otp
- oauth
- webauthn
- totp
- crypto
- password
- signature_challenge
- sso
- imported
- recovery_codes
- email_otp
- impersonated
- trusted_auth_token
api_session_v1_GoogleOAuthFactor:
type: object
properties:
id:
type: string
description: The unique ID of an OAuth registration.
provider_subject:
type: string
description: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
email_id:
type: string
description: The globally unique UUID of the Member's email.
required:
- id
- provider_subject
api_b2b_mfa_v1_MemberOptions:
type: object
properties:
mfa_phone_number:
type: string
description: The Member's MFA phone number.
totp_registration_id:
type: string
description: The Member's MFA TOTP registration ID.
required:
- mfa_phone_number
- totp_registration_id
api_organization_v1_Organization:
type: object
properties:
organization_id:
type: string
description: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the organization_slug or organization_external_id here as a convenience.
organization_name:
type: string
description: The name of the Organization. Must be between 1 and 128 characters in length.
organization_logo_url:
type: string
description: The image URL of the Organization logo.
organization_slug:
type: string
description: 'The unique URL slug of the Organization. The slug only accepts alphanumeric characters and the following reserved characters: `-` `.` `_` `~`. Must be between 2 and 128 characters in length. Wherever an organization_id is expected in a path or request parameter, you may also use the organization_slug as a convenience.'
sso_jit_provisioning:
type: string
description: "The authentication setting that controls the JIT provisioning of Members when authenticating via SSO. The accepted values are:\n \n `ALL_ALLOWED` – the default setting, new Members will be automatically provisioned upon successful authentication via any of the Organization's `sso_active_connections`.\n \n `RESTRICTED` – only new Members with SSO logins that comply with `sso_jit_provisioning_allowed_connections` can be provisioned upon authentication.\n \n `NOT_ALLOWED` – disable JIT provisioning via SSO.\n "
sso_jit_provisioning_allowed_connections:
type: array
items:
type: string
description: "An array of `connection_id`s that reference [SAML Connection objects](https://stytch.com/docs/b2b/api/saml-connection-object).\n Only these connections will be allowed to JIT provision Members via SSO when `sso_jit_provisioning` is set to `RESTRICTED`."
sso_active_connections:
type: array
items:
$ref: '#/components/schemas/api_organization_v1_ActiveSSOConnection'
description: An array of active [SAML Connection references](https://stytch.com/docs/b2b/api/saml-connection-object) or [OIDC Connection references](https://stytch.com/docs/b2b/api/oidc-connection-object).
email_allowed_domains:
type: array
items:
type: string
description: "An array of email domains that allow invites or JIT provisioning for new Members. This list is enforced when either `email_invites` or `email_jit_provisioning` is set to `RESTRICTED`.\n \n \n Common domains such as `gmail.com` are not allowed. See the [common email domains resource](https://stytch.com/docs/b2b/api/common-email-domains) for the full list."
email_jit_provisioning:
type: string
description: "The authentication setting that controls how a new Member can be provisioned by authenticating via Email Magic Link or OAuth. The accepted values are:\n \n `RESTRICTED` – only new Members with verified emails that comply with `email_allowed_domains` can be provisioned upon authentication via Email Magic Link or OAuth.\n \n `NOT_ALLOWED` – the default setting, disables JIT provisioning via Email Magic Link and OAuth.\n "
email_invites:
type: string
description: "The authentication setting that controls how a new Member can be invited to an organization by email. The accepted values are:\n \n `ALL_ALLOWED` – any new Member can be invited to join via email.\n \n `RESTRICTED` – only new Members with verified emails that comply with `email_allowed_domains` can be invited via email.\n \n `NOT_ALLOWED` – disable email invites.\n "
auth_methods:
type: string
description: "The setting that controls which authentication methods can be used by Members of an Organization. The accepted values are:\n \n `ALL_ALLOWED` – the default setting which allows all authentication methods to be used.\n \n `RESTRICTED` – only methods that comply with `allowed_auth_methods` can be used for authentication. This setting does not apply to Members with `is_breakglass` set to `true`.\n "
allowed_auth_methods:
type: array
items:
type: string
description: "An array of allowed authentication methods. This list is enforced when `auth_methods` is set to `RESTRICTED`.\n The list's accepted values are: `sso`, `magic_link`, `email_otp`, `password`, `google_oauth`, `microsoft_oauth`, `slack_oauth`, `github_oauth`, and `hubspot_oauth`.\n "
mfa_policy:
type: string
description: "The setting that controls the MFA policy for all Members in the Organization. The accepted values are:\n \n `REQUIRED_FOR_ALL` – All Members within the Organization will be required to complete MFA every time they wish to log in. However, any active Session that existed prior to this setting change will remain valid.\n \n `OPTIONAL` – The default value. The Organization does not require MFA by default for all Members. Members will be required to complete MFA only if their `mfa_enrolled` status is set to true.\n "
rbac_email_implicit_role_assignments:
type: array
items:
$ref: '#/components/schemas/api_organization_v1_EmailImplicitRoleAssignment'
description: "Implicit role assignments based off of email domains.\n For each domain-Role pair, all Members whose email addresses have the specified email domain will be granted the\n associated Role, regardless of their login method. See the [RBAC guide](https://stytch.com/docs/b2b/guides/rbac/role-assignment)\n for more information about role assignment."
mfa_methods:
type: string
description: "The setting that controls which MFA methods can be used by Members of an Organization. The accepted values are:\n \n `ALL_ALLOWED` – the default setting which allows all authentication methods to be used.\n \n `RESTRICTED` – only methods that comply with `allowed_mfa_methods` can be used for authentication. This setting does not apply to Members with `is_breakglass` set to `true`.\n "
allowed_mfa_methods:
type: array
items:
type: string
description: "An array of allowed MFA authentication methods. This list is enforced when `mfa_methods` is set to `RESTRICTED`.\n The list's accepted values are: `sms_otp` and `totp`.\n "
oauth_tenant_jit_provisioning:
type: string
description: "The authentication setting that controls how a new Member can JIT provision into an organization by tenant. The accepted values are:\n \n `RESTRICTED` – only new Members with tenants in `allowed_oauth_tenants` can JIT provision via tenant.\n \n `NOT_ALLOWED` – the default setting, disables JIT provisioning by OAuth Tenant.\n "
claimed_email_domains:
type: array
items:
type: string
description: A list of email domains that are claimed by the Organization.
first_party_connected_apps_allowed_type:
type: string
description: "The authentication setting that sets the Organization's policy towards first party Connected Apps. The accepted values are:\n \n `ALL_ALLOWED` – the default setting, any first party Connected App in the Project is permitted for use by Members.\n \n `RESTRICTED` – only first p
# --- truncated at 32 KB (69 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/stytch/refs/heads/main/openapi/stytch-b2b-impersonation-api-openapi.yml