Every API here is available over the APIs.io API and to AI agents over MCP.
openapi: 3.2.0
info:
title: Stytch B2B Authentication B2B OAuth API
version: 2.0.0
description: Stytch's B2B API for multi-tenant authentication. Supports Organizations, Members, SSO (SAML/OIDC), Magic Links, OTP, OAuth, Discovery, Sessions, B2B RBAC, SCIM, TOTP, Recovery Codes, Passwords, Impersonation, and the B2B IDP.
contact:
name: Stytch
url: https://stytch.com/docs
license:
name: Proprietary
servers:
- url: https://api.stytch.com
description: Production
- url: https://test.stytch.com
description: Test
tags:
- name: B2B OAuth
paths:
/v1/b2b/oauth/authenticate:
post:
summary: Authenticate
operationId: api_b2b_oauth_v1_Authenticate
tags:
- B2B OAuth
description: 'Authenticate a Member given a `token`. This endpoint verifies that the member completed the OAuth flow by verifying that the token is valid and hasn''t expired. Provide the `session_duration_minutes` parameter to set the lifetime of the session. If the `session_duration_minutes` parameter is not specified, a Stytch session will be created with a 60 minute duration.
If the Member is required to complete MFA to log in to the Organization, the returned value of `member_authenticated` will be `false`, and an `intermediate_session_token` will be returned.
The `intermediate_session_token` can be passed into the [OTP SMS Authenticate endpoint](https://stytch.com/docs/b2b/api/authenticate-otp-sms) to complete the MFA step and acquire a full member session.
The `intermediate_session_token` can also be used with the [Exchange Intermediate Session endpoint](https://stytch.com/docs/b2b/api/exchange-intermediate-session) or the [Create Organization via Discovery endpoint](https://stytch.com/docs/b2b/api/create-organization-via-discovery) to join a different Organization or create a new one.
The `session_duration_minutes` and `session_custom_claims` parameters will be ignored.
If a valid `session_token` or `session_jwt` is passed in, the Member will not be required to complete an MFA step.
If the Member is logging in via an OAuth provider that does not fully verify the email, the returned value of `member_authenticated` will be `false`, and an `intermediate_session_token` will be returned.
The `primary_required` field details the authentication flow the Member must perform in order to [complete a step-up authentication](https://stytch.com/docs/b2b/guides/oauth/auth-flows) into the organization. The `intermediate_session_token` must be passed into that authentication flow.
We''re actively accepting requests for new OAuth providers! Please [email us](mailto:support@stytch.com) or [post in our community](https://stytch.com/docs/b2b/resources) if you are looking for an OAuth provider that is not currently supported.'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_oauth_v1_AuthenticateRequest'
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_oauth_v1_AuthenticateResponse'
'400':
description: Bad request
'401':
description: Unauthorized
content:
application/json:
example:
status_code: 401
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: unauthorized_credentials
error_message: Unauthorized credentials.
error_url: https://stytch.com/docs/api/errors/401
'429':
description: Too Many Requests
content:
application/json:
example:
status_code: 429
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: too_many_requests
error_message: Too many requests have been made.
error_url: https://stytch.com/docs/api/errors/429
'500':
description: Internal server error
content:
application/json:
example:
status_code: 500
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: internal_server_error
error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
error_url: https://stytch.com/docs/api/errors/500
x-code-samples:
- lang: csharp
label: C#
source: "// POST /v1/b2b/oauth/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n oauth_token: \"${exampleOAuthAuthenticateToken}\",\n};\n\nclient.OAuth.Authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: go
label: Go
source: "// POST /v1/b2b/oauth/authenticate\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/oauth\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &oauth.AuthenticateParams{\n\t\tOAuthToken: \"${exampleOAuthAuthenticateToken}\",\n\t}\n\n\tresp, err := client.OAuth.Authenticate(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
- lang: java
label: Java
source: "// POST /v1/b2b/oauth/authenticate\npackage com.example;\n\nimport com.stytch.java.b2b.models.oauth.AuthenticateRequest;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n public static void main(String[] args) {\n StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n AuthenticateRequest params = new AuthenticateRequest();\n params.setOAuthToken(\"${exampleOAuthAuthenticateToken}\");\n\n Object result = StytchB2BClient.getOAuth().authenticate(params);\n if (result instanceof StytchResult.Success) {\n System.out.println(((StytchResult.Success) result).getValue());\n } else {\n System.out.println(((StytchResult.Error) result).getException());\n }\n }\n}"
- lang: kotlin
label: Kotlin
source: "// POST /v1/b2b/oauth/authenticate\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.oauth.AuthenticateRequest\n\nfun main() {\n StytchB2BClient.configure(\n projectId = \"${projectId}\",\n secret = \"${secret}\",\n )\n\n when (\n val result =\n StytchB2BClient.oauth.authenticate(\n AuthenticateRequest(\n oauthToken = \"${exampleOAuthAuthenticateToken}\",\n ),\n )\n ) {\n is StytchResult.Success -> println(result.value)\n is StytchResult.Error -> println(result.exception)\n }\n}\n"
- lang: javascript
label: Node.js
source: "// POST /v1/b2b/oauth/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n oauth_token: \"${exampleOAuthAuthenticateToken}\",\n};\n\nclient.oauth.authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: php
label: PHP
source: "$response = $client->oauth->authenticate([\n 'oauth_token' => '${exampleOAuthAuthenticateToken}',\n]);"
- lang: python
label: Python
source: "# POST /v1/b2b/oauth/authenticate\nfrom stytch import B2BClient\n\nclient = B2BClient(\n project_id=\"${projectId}\",\n secret=\"${secret}\",\n)\n\nresp = client.oauth.authenticate(\n oauth_token=\"${exampleOAuthAuthenticateToken}\",\n)\n\nprint(resp)\n"
- lang: ruby
label: Ruby
source: "# POST /v1/b2b/oauth/authenticate\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n project_id: \"${projectId}\",\n secret: \"${secret}\"\n)\n\nresp = client.oauth.authenticate(\n oauth_token: \"${exampleOAuthAuthenticateToken}\"\n \n)\n\nputs resp"
- lang: rust
label: Rust
source: "// POST /v1/b2b/oauth/authenticate\nuse stytch::b2b::client::Client;\nuse stytch::b2b::oauth::AuthenticateRequest;\n\nfn main() {\n let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n let resp = client.oauth.authenticate(\n AuthenticateRequest{\n oauth_token: \"${exampleOAuthAuthenticateToken}\",\n ..Default::default()\n }\n ).await;\n println!(\"The response is {:?}\", resp);\n}"
- lang: bash
label: cURL
source: "# POST /v1/b2b/oauth/authenticate\ncurl --request POST \\\n --url https://test.stytch.com/v1/b2b/oauth/authenticate \\\n -u '${projectId}:${secret}' \\\n -H 'Content-Type: application/json' \\\n -d '{\n \"oauth_token\": \"${exampleOAuthAuthenticateToken}\"\n }'"
/v1/b2b/oauth/discovery/authenticate:
post:
summary: Authenticate
operationId: api_b2b_oauth_v1_b2b_oauth_discovery_Authenticate
tags:
- B2B OAuth
description: 'Authenticates the Discovery OAuth token and exchanges it for an Intermediate
Session Token. Intermediate Session Tokens can be used for various Discovery login flows and are valid for 10 minutes.'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_oauth_v1_b2b_oauth_discovery_AuthenticateRequest'
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_oauth_v1_b2b_oauth_discovery_AuthenticateResponse'
'400':
description: Bad request
'401':
description: Unauthorized
content:
application/json:
example:
status_code: 401
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: unauthorized_credentials
error_message: Unauthorized credentials.
error_url: https://stytch.com/docs/api/errors/401
'429':
description: Too Many Requests
content:
application/json:
example:
status_code: 429
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: too_many_requests
error_message: Too many requests have been made.
error_url: https://stytch.com/docs/api/errors/429
'500':
description: Internal server error
content:
application/json:
example:
status_code: 500
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: internal_server_error
error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
error_url: https://stytch.com/docs/api/errors/500
x-code-samples:
- lang: csharp
label: C#
source: "// POST /v1/b2b/oauth/discovery/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n discovery_oauth_token: \"${exampleOAuthAuthenticateToken}\",\n};\n\nclient.OAuth.Discovery.Authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: go
label: Go
source: "// POST /v1/b2b/oauth/discovery/authenticate\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/oauth/discovery\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &discovery.AuthenticateParams{\n\t\tDiscoveryOAuthToken: \"${exampleOAuthAuthenticateToken}\",\n\t}\n\n\tresp, err := client.OAuth.Discovery.Authenticate(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
- lang: java
label: Java
source: "// POST /v1/b2b/oauth/discovery/authenticate\npackage com.example;\n\nimport com.stytch.java.b2b.models.oauthdiscovery.AuthenticateRequest;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n public static void main(String[] args) {\n StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n AuthenticateRequest params = new AuthenticateRequest();\n params.setDiscoveryOAuthToken(\"${exampleOAuthAuthenticateToken}\");\n\n Object result = StytchB2BClient.getOAuth().getDiscovery().authenticate(params);\n if (result instanceof StytchResult.Success) {\n System.out.println(((StytchResult.Success) result).getValue());\n } else {\n System.out.println(((StytchResult.Error) result).getException());\n }\n }\n}"
- lang: kotlin
label: Kotlin
source: "// POST /v1/b2b/oauth/discovery/authenticate\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.oauthdiscovery.AuthenticateRequest\n\nfun main() {\n StytchB2BClient.configure(\n projectId = \"${projectId}\",\n secret = \"${secret}\",\n )\n\n when (\n val result =\n StytchB2BClient.oauth.discovery.authenticate(\n AuthenticateRequest(\n discoveryOAuthToken = \"${exampleOAuthAuthenticateToken}\",\n ),\n )\n ) {\n is StytchResult.Success -> println(result.value)\n is StytchResult.Error -> println(result.exception)\n }\n}\n"
- lang: javascript
label: Node.js
source: "// POST /v1/b2b/oauth/discovery/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n discovery_oauth_token: \"${exampleOAuthAuthenticateToken}\",\n};\n\nclient.oauth.discovery.authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: php
label: PHP
source: "$response = $client->oauth->discovery->authenticate([\n 'discovery_oauth_token' => '${exampleOAuthAuthenticateToken}',\n]);"
- lang: python
label: Python
source: "# POST /v1/b2b/oauth/discovery/authenticate\nfrom stytch import B2BClient\n\nclient = B2BClient(\n project_id=\"${projectId}\",\n secret=\"${secret}\",\n)\n\nresp = client.oauth.discovery.authenticate(\n discovery_oauth_token=\"${exampleOAuthAuthenticateToken}\",\n)\n\nprint(resp)\n"
- lang: ruby
label: Ruby
source: "# POST /v1/b2b/oauth/discovery/authenticate\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n project_id: \"${projectId}\",\n secret: \"${secret}\"\n)\n\nresp = client.oauth.discovery.authenticate(\n discovery_oauth_token: \"${exampleOAuthAuthenticateToken}\"\n \n)\n\nputs resp"
- lang: rust
label: Rust
source: "// POST /v1/b2b/oauth/discovery/authenticate\nuse stytch::b2b::client::Client;\nuse stytch::b2b::oauth_discovery::AuthenticateRequest;\n\nfn main() {\n let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n let resp = client.oauth.discovery.authenticate(\n AuthenticateRequest{\n discovery_oauth_token: \"${exampleOAuthAuthenticateToken}\",\n ..Default::default()\n }\n ).await;\n println!(\"The response is {:?}\", resp);\n}"
- lang: bash
label: cURL
source: "# POST /v1/b2b/oauth/discovery/authenticate\ncurl --request POST \\\n --url https://test.stytch.com/v1/b2b/oauth/discovery/authenticate \\\n -u '${projectId}:${secret}' \\\n -H 'Content-Type: application/json' \\\n -d '{\n \"discovery_oauth_token\": \"${exampleOAuthAuthenticateToken}\"\n }'"
components:
schemas:
api_organization_v1_ActiveSSOConnection:
type: object
properties:
connection_id:
type: string
description: Globally unique UUID that identifies a specific SSO `connection_id` for a Member.
display_name:
type: string
description: A human-readable display name for the connection.
identity_provider:
type: string
required:
- connection_id
- display_name
- identity_provider
api_b2b_oauth_v1_AuthenticateResponse:
type: object
properties:
request_id:
type: string
description: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
member_id:
type: string
description: Globally unique UUID that identifies a specific Member.
provider_subject:
type: string
description: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
provider_type:
type: string
description: Denotes the OAuth identity provider that the user has authenticated with, e.g. Google, Microsoft, GitHub etc.
session_token:
type: string
description: A secret token for a given Stytch Session.
session_jwt:
type: string
description: The JSON Web Token (JWT) for a given Stytch Session.
member:
$ref: '#/components/schemas/api_organization_v1_Member'
description: The [Member object](https://stytch.com/docs/b2b/api/member-object)
organization_id:
type: string
description: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value.
organization:
$ref: '#/components/schemas/api_organization_v1_Organization'
description: The [Organization object](https://stytch.com/docs/b2b/api/organization-object).
reset_sessions:
type: boolean
description: This field is deprecated.
member_authenticated:
type: boolean
description: Indicates whether the Member is fully authenticated. If false, the Member needs to complete an MFA step to log in to the Organization.
intermediate_session_token:
type: string
description: The returned Intermediate Session Token contains an OAuth factor associated with the Member's email address. If this value is non-empty, the member must complete an MFA step to finish logging in to the Organization. The token can be used with the [OTP SMS Authenticate endpoint](https://stytch.com/docs/b2b/api/authenticate-otp-sms), [TOTP Authenticate endpoint](https://stytch.com/docs/b2b/api/authenticate-totp), or [Recovery Codes Recover endpoint](https://stytch.com/docs/b2b/api/recovery-codes-recover) to complete an MFA flow and log in to the Organization. The token has a default expiry of 10 minutes. It can also be used with the [Exchange Intermediate Session endpoint](https://stytch.com/docs/b2b/api/exchange-intermediate-session) to join a specific Organization that allows the factors represented by the intermediate session token; or the [Create Organization via Discovery endpoint](https://stytch.com/docs/b2b/api/create-organization-via-discovery) to create a new Organization and Member. Intermediate Session Tokens have a default expiry of 10 minutes.
status_code:
type: integer
format: int32
description: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
member_session:
$ref: '#/components/schemas/api_b2b_session_v1_MemberSession'
description: The [Session object](https://stytch.com/docs/b2b/api/session-object).
provider_values:
$ref: '#/components/schemas/api_b2b_oauth_v1_ProviderValues'
description: "The `provider_values` object lists relevant identifiers, values, and scopes for a given OAuth provider. For example this object will include a provider's `access_token` that you can use to access the provider's API for a given user.\n\n Note that these values will vary based on the OAuth provider in question, e.g. `id_token` is only returned by Microsoft. Google One Tap does not return access tokens or refresh tokens."
mfa_required:
$ref: '#/components/schemas/api_b2b_mfa_v1_MfaRequired'
description: Information about the MFA requirements of the Organization and the Member's options for fulfilling MFA.
primary_required:
$ref: '#/components/schemas/api_b2b_session_v1_PrimaryRequired'
description: Information about the primary authentication requirements of the Organization.
member_device:
$ref: '#/components/schemas/api_device_history_v1_DeviceInfo'
description: If a valid `telemetry_id` was passed in the request and the [Fingerprint Lookup API](https://stytch.com/docs/fraud/api/fingerprint-lookup) returned results, the `member_device` response field will contain information about the member's device attributes.
required:
- request_id
- member_id
- provider_subject
- provider_type
- session_token
- session_jwt
- member
- organization_id
- organization
- reset_sessions
- member_authenticated
- intermediate_session_token
- status_code
api_b2b_session_v1_MemberSession:
type: object
properties:
member_session_id:
type: string
description: Globally unique UUID that identifies a specific Session.
member_id:
type: string
description: Globally unique UUID that identifies a specific Member.
started_at:
type: string
description: The timestamp when the Session was created. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
last_accessed_at:
type: string
description: The timestamp when the Session was last accessed. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
expires_at:
type: string
description: The timestamp when the Session expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
authentication_factors:
type: array
items:
$ref: '#/components/schemas/api_session_v1_AuthenticationFactor'
description: An array of different authentication factors that comprise a Session.
organization_id:
type: string
description: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value.
roles:
type: array
items:
type: string
organization_slug:
type: string
description: 'The unique URL slug of the Organization. The slug only accepts alphanumeric characters and the following reserved characters: `-` `.` `_` `~`. Must be between 2 and 128 characters in length. Wherever an organization_id is expected in a path or request parameter, you may also use the organization_slug as a convenience.'
custom_claims:
type: object
additionalProperties: true
description: The custom claims map for a Session. Claims can be added to a session during a Sessions authenticate call.
required:
- member_session_id
- member_id
- started_at
- last_accessed_at
- expires_at
- authentication_factors
- organization_id
- roles
- organization_slug
api_b2b_oauth_v1_ProviderValues:
type: object
properties:
scopes:
type: array
items:
type: string
description: The OAuth scopes included for a given provider. See each provider's section above to see which scopes are included by default and how to add custom scopes.
access_token:
type: string
description: The `access_token` that you may use to access the User's data in the provider's API.
refresh_token:
type: string
description: The `refresh_token` that you may use to obtain a new `access_token` for the User within the provider's API.
expires_at:
type: string
id_token:
type: string
description: The `id_token` returned by the OAuth provider. ID Tokens are JWTs that contain structured information about a user. The exact content of each ID Token varies from provider to provider. ID Tokens are returned from OAuth providers that conform to the [OpenID Connect](https://openid.net/foundation/) specification, which is based on OAuth.
required:
- scopes
api_organization_v1_SSORegistration:
type: object
properties:
connection_id:
type: string
description: Globally unique UUID that identifies a specific SSO `connection_id` for a Member.
external_id:
type: string
description: The ID of the member given by the identity provider.
registration_id:
type: string
description: The unique ID of an SSO Registration.
sso_attributes:
type: object
additionalProperties: true
description: An object for storing SSO attributes brought over from the identity provider.
required:
- connection_id
- external_id
- registration_id
api_session_v1_LinkedInOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_b2b_scim_v1_Entitlement:
type: object
properties:
value:
type: string
type:
type: string
primary:
type: boolean
required:
- value
- type
- primary
api_session_v1_AppleOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_b2b_scim_v1_SCIMAttributes:
type: object
properties:
user_name:
type: string
id:
type: string
external_id:
type: string
active:
type: boolean
groups:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Group'
display_name:
type: string
nick_name:
type: string
profile_url:
type: string
user_type:
type: string
title:
type: string
preferred_language:
type: string
locale:
type: string
timezone:
type: string
emails:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Email'
phone_numbers:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_PhoneNumber'
addresses:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Address'
ims:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_IMs'
photos:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Photo'
entitlements:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Entitlement'
roles:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Role'
x509certificates:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_X509Certificate'
name:
$ref: '#/components/schemas/api_b2b_scim_v1_Name'
enterprise_extension:
$ref: '#/components/schemas/api_b2b_scim_v1_EnterpriseExtension'
required:
- user_name
- id
- external_id
- active
- groups
- display_name
- nick_name
- profile_url
- user_type
- title
- preferred_language
- locale
- timezone
- emails
- phone_numbers
- addresses
- ims
- photos
- entitlements
- roles
- x509certificates
api_organization_v1_OAuthRegistration:
type: object
properties:
provider_type:
type: string
description: Denotes the OAuth identity provider that the user has authenticated with, e.g. Google, Microsoft, GitHub etc.
provider_subject:
type: string
description: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
member_oauth_registration_id:
type: string
description: The unique ID of an OAuth registration.
profile_picture_url:
type: string
description: If available, the `profile_picture_url` is a URL of the User's profile picture set in OAuth identity the provider that the User has authenticated with, e.g. Google profile picture.
locale:
type: string
description: If available, the `locale` is the Member's locale set in the OAuth identity provider that the user has authenticated with.
required:
- provider_type
- provider_subject
- member_oauth_registration_id
api_b2b_oauth_v1_AuthenticateRequest:
type: object
properties:
oauth_token:
type: string
description: The token to authenticate.
session_token:
type: string
description: A secret token for a given Stytch Session.
session_duration_minutes:
type: integer
format: int32
description: "Set the session lifetime to be this many minutes from now. This will start a new session if one doesn't already exist,\n returning both an opaque `session_token` and `session_jwt` for this session. Remember that the `session_jwt` will have a fixed lifetime of\n five minutes regardless of the underlying session duration, and will need to be refreshed over time.\n\n This value must be a minimum of 5 and a maximum of 527040 minutes (366 days).\n\n If a `session_token` or `session_jwt` is provided then a successful authentication will continue to extend the session this many minutes.\n\n If the `session_duration_minutes` parameter is not specified, a Stytch session will be created with a 60 minute duration. If you don't want\n to use the Stytch session product, you can ignore the session fields in the response."
session_jwt:
type: string
description: The JSON Web Token (JWT) for a given Stytch Session.
session_custom_claims:
type: object
additionalProperties: true
description: "Add a custom claims map to the Session being authenticated. Claims are only created if a Session is initialized by providing a value in\n `session_duration_minutes`. Claims will be included on the Session object and in the JWT. To update a key in an existing Session, s
# --- truncated at 32 KB (95 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/stytch/refs/heads/main/openapi/stytch-b2b-oauth-api-openapi.yml