openapi: 3.0.3
info:
title: Stytch B2B Authentication Application B2B OAuth API
version: 2.0.0
description: Stytch's B2B API for multi-tenant authentication. Supports Organizations, Members, SSO (SAML/OIDC), Magic Links, OTP, OAuth, Discovery, Sessions, B2B RBAC, SCIM, TOTP, Recovery Codes, Passwords, Impersonation, and the B2B IDP.
contact:
name: Stytch
url: https://stytch.com/docs
license:
name: Proprietary
servers:
- url: https://api.stytch.com
description: Production
- url: https://test.stytch.com
description: Test
tags:
- name: B2B OAuth
paths:
/v1/b2b/oauth/authenticate:
post:
summary: Authenticate
operationId: api_b2b_oauth_v1_Authenticate
tags:
- B2B OAuth
description: 'Authenticate a Member given a `token`. This endpoint verifies that the member completed the OAuth flow by verifying that the token is valid and hasn''t expired. Provide the `session_duration_minutes` parameter to set the lifetime of the session. If the `session_duration_minutes` parameter is not specified, a Stytch session will be created with a 60 minute duration.
If the Member is required to complete MFA to log in to the Organization, the returned value of `member_authenticated` will be `false`, and an `intermediate_session_token` will be returned.
The `intermediate_session_token` can be passed into the [OTP SMS Authenticate endpoint](https://stytch.com/docs/b2b/api/authenticate-otp-sms) to complete the MFA step and acquire a full member session.
The `intermediate_session_token` can also be used with the [Exchange Intermediate Session endpoint](https://stytch.com/docs/b2b/api/exchange-intermediate-session) or the [Create Organization via Discovery endpoint](https://stytch.com/docs/b2b/api/create-organization-via-discovery) to join a different Organization or create a new one.
The `session_duration_minutes` and `session_custom_claims` parameters will be ignored.
If a valid `session_token` or `session_jwt` is passed in, the Member will not be required to complete an MFA step.
If the Member is logging in via an OAuth provider that does not fully verify the email, the returned value of `member_authenticated` will be `false`, and an `intermediate_session_token` will be returned.
The `primary_required` field details the authentication flow the Member must perform in order to [complete a step-up authentication](https://stytch.com/docs/b2b/guides/oauth/auth-flows) into the organization. The `intermediate_session_token` must be passed into that authentication flow.
We''re actively accepting requests for new OAuth providers! Please [email us](mailto:support@stytch.com) or [post in our community](https://stytch.com/docs/b2b/resources) if you are looking for an OAuth provider that is not currently supported.'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_oauth_v1_AuthenticateRequest'
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_oauth_v1_AuthenticateResponse'
'400':
description: Bad request
'401':
description: Unauthorized
content:
application/json:
example:
status_code: 401
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: unauthorized_credentials
error_message: Unauthorized credentials.
error_url: https://stytch.com/docs/api/errors/401
'429':
description: Too Many Requests
content:
application/json:
example:
status_code: 429
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: too_many_requests
error_message: Too many requests have been made.
error_url: https://stytch.com/docs/api/errors/429
'500':
description: Internal server error
content:
application/json:
example:
status_code: 500
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: internal_server_error
error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
error_url: https://stytch.com/docs/api/errors/500
x-code-samples:
- lang: csharp
label: C#
source: "// POST /v1/b2b/oauth/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n oauth_token: \"${exampleOAuthAuthenticateToken}\",\n};\n\nclient.OAuth.Authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: go
label: Go
source: "// POST /v1/b2b/oauth/authenticate\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/oauth\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &oauth.AuthenticateParams{\n\t\tOAuthToken: \"${exampleOAuthAuthenticateToken}\",\n\t}\n\n\tresp, err := client.OAuth.Authenticate(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
- lang: java
label: Java
source: "// POST /v1/b2b/oauth/authenticate\npackage com.example;\n\nimport com.stytch.java.b2b.models.oauth.AuthenticateRequest;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n public static void main(String[] args) {\n StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n AuthenticateRequest params = new AuthenticateRequest();\n params.setOAuthToken(\"${exampleOAuthAuthenticateToken}\");\n\n Object result = StytchB2BClient.getOAuth().authenticate(params);\n if (result instanceof StytchResult.Success) {\n System.out.println(((StytchResult.Success) result).getValue());\n } else {\n System.out.println(((StytchResult.Error) result).getException());\n }\n }\n}"
- lang: kotlin
label: Kotlin
source: "// POST /v1/b2b/oauth/authenticate\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.oauth.AuthenticateRequest\n\nfun main() {\n StytchB2BClient.configure(\n projectId = \"${projectId}\",\n secret = \"${secret}\",\n )\n\n when (\n val result =\n StytchB2BClient.oauth.authenticate(\n AuthenticateRequest(\n oauthToken = \"${exampleOAuthAuthenticateToken}\",\n ),\n )\n ) {\n is StytchResult.Success -> println(result.value)\n is StytchResult.Error -> println(result.exception)\n }\n}\n"
- lang: javascript
label: Node.js
source: "// POST /v1/b2b/oauth/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n oauth_token: \"${exampleOAuthAuthenticateToken}\",\n};\n\nclient.oauth.authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: php
label: PHP
source: "$response = $client->oauth->authenticate([\n 'oauth_token' => '${exampleOAuthAuthenticateToken}',\n]);"
- lang: python
label: Python
source: "# POST /v1/b2b/oauth/authenticate\nfrom stytch import B2BClient\n\nclient = B2BClient(\n project_id=\"${projectId}\",\n secret=\"${secret}\",\n)\n\nresp = client.oauth.authenticate(\n oauth_token=\"${exampleOAuthAuthenticateToken}\",\n)\n\nprint(resp)\n"
- lang: ruby
label: Ruby
source: "# POST /v1/b2b/oauth/authenticate\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n project_id: \"${projectId}\",\n secret: \"${secret}\"\n)\n\nresp = client.oauth.authenticate(\n oauth_token: \"${exampleOAuthAuthenticateToken}\"\n \n)\n\nputs resp"
- lang: rust
label: Rust
source: "// POST /v1/b2b/oauth/authenticate\nuse stytch::b2b::client::Client;\nuse stytch::b2b::oauth::AuthenticateRequest;\n\nfn main() {\n let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n let resp = client.oauth.authenticate(\n AuthenticateRequest{\n oauth_token: \"${exampleOAuthAuthenticateToken}\",\n ..Default::default()\n }\n ).await;\n println!(\"The response is {:?}\", resp);\n}"
- lang: bash
label: cURL
source: "# POST /v1/b2b/oauth/authenticate\ncurl --request POST \\\n --url https://test.stytch.com/v1/b2b/oauth/authenticate \\\n -u '${projectId}:${secret}' \\\n -H 'Content-Type: application/json' \\\n -d '{\n \"oauth_token\": \"${exampleOAuthAuthenticateToken}\"\n }'"
/v1/b2b/oauth/discovery/authenticate:
post:
summary: Authenticate
operationId: api_b2b_oauth_v1_b2b_oauth_discovery_Authenticate
tags:
- B2B OAuth
description: 'Authenticates the Discovery OAuth token and exchanges it for an Intermediate
Session Token. Intermediate Session Tokens can be used for various Discovery login flows and are valid for 10 minutes.'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_oauth_v1_b2b_oauth_discovery_AuthenticateRequest'
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_oauth_v1_b2b_oauth_discovery_AuthenticateResponse'
'400':
description: Bad request
'401':
description: Unauthorized
content:
application/json:
example:
status_code: 401
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: unauthorized_credentials
error_message: Unauthorized credentials.
error_url: https://stytch.com/docs/api/errors/401
'429':
description: Too Many Requests
content:
application/json:
example:
status_code: 429
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: too_many_requests
error_message: Too many requests have been made.
error_url: https://stytch.com/docs/api/errors/429
'500':
description: Internal server error
content:
application/json:
example:
status_code: 500
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: internal_server_error
error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
error_url: https://stytch.com/docs/api/errors/500
x-code-samples:
- lang: csharp
label: C#
source: "// POST /v1/b2b/oauth/discovery/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n discovery_oauth_token: \"${exampleOAuthAuthenticateToken}\",\n};\n\nclient.OAuth.Discovery.Authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: go
label: Go
source: "// POST /v1/b2b/oauth/discovery/authenticate\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/oauth/discovery\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &discovery.AuthenticateParams{\n\t\tDiscoveryOAuthToken: \"${exampleOAuthAuthenticateToken}\",\n\t}\n\n\tresp, err := client.OAuth.Discovery.Authenticate(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
- lang: java
label: Java
source: "// POST /v1/b2b/oauth/discovery/authenticate\npackage com.example;\n\nimport com.stytch.java.b2b.models.oauthdiscovery.AuthenticateRequest;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n public static void main(String[] args) {\n StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n AuthenticateRequest params = new AuthenticateRequest();\n params.setDiscoveryOAuthToken(\"${exampleOAuthAuthenticateToken}\");\n\n Object result = StytchB2BClient.getOAuth().getDiscovery().authenticate(params);\n if (result instanceof StytchResult.Success) {\n System.out.println(((StytchResult.Success) result).getValue());\n } else {\n System.out.println(((StytchResult.Error) result).getException());\n }\n }\n}"
- lang: kotlin
label: Kotlin
source: "// POST /v1/b2b/oauth/discovery/authenticate\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.oauthdiscovery.AuthenticateRequest\n\nfun main() {\n StytchB2BClient.configure(\n projectId = \"${projectId}\",\n secret = \"${secret}\",\n )\n\n when (\n val result =\n StytchB2BClient.oauth.discovery.authenticate(\n AuthenticateRequest(\n discoveryOAuthToken = \"${exampleOAuthAuthenticateToken}\",\n ),\n )\n ) {\n is StytchResult.Success -> println(result.value)\n is StytchResult.Error -> println(result.exception)\n }\n}\n"
- lang: javascript
label: Node.js
source: "// POST /v1/b2b/oauth/discovery/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n discovery_oauth_token: \"${exampleOAuthAuthenticateToken}\",\n};\n\nclient.oauth.discovery.authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: php
label: PHP
source: "$response = $client->oauth->discovery->authenticate([\n 'discovery_oauth_token' => '${exampleOAuthAuthenticateToken}',\n]);"
- lang: python
label: Python
source: "# POST /v1/b2b/oauth/discovery/authenticate\nfrom stytch import B2BClient\n\nclient = B2BClient(\n project_id=\"${projectId}\",\n secret=\"${secret}\",\n)\n\nresp = client.oauth.discovery.authenticate(\n discovery_oauth_token=\"${exampleOAuthAuthenticateToken}\",\n)\n\nprint(resp)\n"
- lang: ruby
label: Ruby
source: "# POST /v1/b2b/oauth/discovery/authenticate\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n project_id: \"${projectId}\",\n secret: \"${secret}\"\n)\n\nresp = client.oauth.discovery.authenticate(\n discovery_oauth_token: \"${exampleOAuthAuthenticateToken}\"\n \n)\n\nputs resp"
- lang: rust
label: Rust
source: "// POST /v1/b2b/oauth/discovery/authenticate\nuse stytch::b2b::client::Client;\nuse stytch::b2b::oauth_discovery::AuthenticateRequest;\n\nfn main() {\n let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n let resp = client.oauth.discovery.authenticate(\n AuthenticateRequest{\n discovery_oauth_token: \"${exampleOAuthAuthenticateToken}\",\n ..Default::default()\n }\n ).await;\n println!(\"The response is {:?}\", resp);\n}"
- lang: bash
label: cURL
source: "# POST /v1/b2b/oauth/discovery/authenticate\ncurl --request POST \\\n --url https://test.stytch.com/v1/b2b/oauth/discovery/authenticate \\\n -u '${projectId}:${secret}' \\\n -H 'Content-Type: application/json' \\\n -d '{\n \"discovery_oauth_token\": \"${exampleOAuthAuthenticateToken}\"\n }'"
components:
schemas:
api_session_v1_SlackOAuthFactor:
type: object
properties:
id:
type: string
description: The unique ID of an OAuth registration.
provider_subject:
type: string
description: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
email_id:
type: string
description: The globally unique UUID of the Member's email.
required:
- id
- provider_subject
api_session_v1_HubspotOAuthFactor:
type: object
properties:
id:
type: string
description: The unique ID of an OAuth registration.
provider_subject:
type: string
description: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
email_id:
type: string
description: The globally unique UUID of the Member's email.
required:
- id
- provider_subject
api_session_v1_DiscordOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_session_v1_SalesforceOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_b2b_session_v1_PrimaryRequired:
type: object
properties:
allowed_auth_methods:
type: array
items:
type: string
description: Details the auth method that the member must also complete to fulfill the primary authentication requirements of the Organization. For example, a value of `[magic_link]` indicates that the Member must also complete a magic link authentication step. If you have an intermediate session token, you must pass it into that primary authentication step.
required:
- allowed_auth_methods
api_b2b_mfa_v1_MemberOptions:
type: object
properties:
mfa_phone_number:
type: string
description: The Member's MFA phone number.
totp_registration_id:
type: string
description: The Member's MFA TOTP registration ID.
required:
- mfa_phone_number
- totp_registration_id
api_b2b_oauth_v1_ProviderValues:
type: object
properties:
scopes:
type: array
items:
type: string
description: The OAuth scopes included for a given provider. See each provider's section above to see which scopes are included by default and how to add custom scopes.
access_token:
type: string
description: The `access_token` that you may use to access the User's data in the provider's API.
refresh_token:
type: string
description: The `refresh_token` that you may use to obtain a new `access_token` for the User within the provider's API.
expires_at:
type: string
id_token:
type: string
description: The `id_token` returned by the OAuth provider. ID Tokens are JWTs that contain structured information about a user. The exact content of each ID Token varies from provider to provider. ID Tokens are returned from OAuth providers that conform to the [OpenID Connect](https://openid.net/foundation/) specification, which is based on OAuth.
required:
- scopes
api_session_v1_SAMLSSOFactor:
type: object
properties:
id:
type: string
description: The unique ID of an SSO Registration.
provider_id:
type: string
description: Globally unique UUID that identifies a specific SAML Connection.
external_id:
type: string
description: The ID of the member given by the identity provider.
required:
- id
- provider_id
- external_id
api_organization_v1_CustomRole:
type: object
properties:
role_id:
type: string
description:
type: string
permissions:
type: array
items:
$ref: '#/components/schemas/api_organization_v1_CustomRolePermission'
required:
- role_id
- description
- permissions
api_session_v1_ImpersonatedFactor:
type: object
properties:
impersonator_id:
type: string
description: For impersonated sessions initiated via the Stytch Dashboard, the `impersonator_id` will be the impersonator's Stytch Dashboard `member_id`.
impersonator_email_address:
type: string
description: The email address of the impersonator.
required:
- impersonator_id
- impersonator_email_address
api_session_v1_TikTokOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_session_v1_CoinbaseOAuthFactor:
type: object
properties:
id:
type: string
provider_subject:
type: string
email_id:
type: string
required:
- id
- provider_subject
api_b2b_mfa_v1_MfaRequired:
type: object
properties:
member_options:
$ref: '#/components/schemas/api_b2b_mfa_v1_MemberOptions'
description: Information about the Member's options for completing MFA.
secondary_auth_initiated:
type: string
description: If null, indicates that no secondary authentication has been initiated. If equal to "sms_otp", indicates that the Member has a phone number, and a one time passcode has been sent to the Member's phone number. No secondary authentication will be initiated during calls to the discovery authenticate or list organizations endpoints, even if the Member has a phone number.
api_organization_v1_SSORegistration:
type: object
properties:
connection_id:
type: string
description: Globally unique UUID that identifies a specific SSO `connection_id` for a Member.
external_id:
type: string
description: The ID of the member given by the identity provider.
registration_id:
type: string
description: The unique ID of an SSO Registration.
sso_attributes:
type: object
additionalProperties: true
description: An object for storing SSO attributes brought over from the identity provider.
required:
- connection_id
- external_id
- registration_id
api_organization_v1_RetiredEmail:
type: object
properties:
email_id:
type: string
description: The globally unique UUID of a Member's email.
email_address:
type: string
description: The email address of the Member.
required:
- email_id
- email_address
api_organization_v1_MemberRole:
type: object
properties:
role_id:
type: string
description: "The unique identifier of the RBAC Role, provided by the developer and intended to be human-readable.\n\n Reserved `role_id`s that are predefined by Stytch include:\n\n * `stytch_member`\n * `stytch_admin`\n\n Check out the [guide on Stytch default Roles](https://stytch.com/docs/b2b/guides/rbac/stytch-default) for a more detailed explanation.\n\n "
sources:
type: array
items:
$ref: '#/components/schemas/api_organization_v1_MemberRoleSource'
description: A list of sources for this role assignment. A role assignment can come from multiple sources - for example, the Role could be both explicitly assigned and implicitly granted from the Member's email domain.
required:
- role_id
- sources
api_b2b_oauth_v1_AuthenticateRequestLocale:
type: string
enum:
- en
- es
- pt-br
- fr
- it
- de-DE
- zh-Hans
- ca-ES
api_b2b_oauth_v1_b2b_oauth_discovery_AuthenticateResponse:
type: object
properties:
request_id:
type: string
description: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
intermediate_session_token:
type: string
description: The Intermediate Session Token. This token does not necessarily belong to a specific instance of a Member, but represents a bag of factors that may be converted to a member session. The token can be used with the [OTP SMS Authenticate endpoint](https://stytch.com/docs/b2b/api/authenticate-otp-sms), [TOTP Authenticate endpoint](https://stytch.com/docs/b2b/api/authenticate-totp), or [Recovery Codes Recover endpoint](https://stytch.com/docs/b2b/api/recovery-codes-recover) to complete an MFA flow and log in to the Organization. The token has a default expiry of 10 minutes. It can also be used with the [Exchange Intermediate Session endpoint](https://stytch.com/docs/b2b/api/exchange-intermediate-session) to join a specific Organization that allows the factors represented by the intermediate session token; or the [Create Organization via Discovery endpoint](https://stytch.com/docs/b2b/api/create-organization-via-discovery) to create a new Organization and Member. Intermediate Session Tokens have a default expiry of 10 minutes.
email_address:
type: string
description: The email address.
discovered_organizations:
type: array
items:
$ref: '#/components/schemas/api_discovery_v1_DiscoveredOrganization'
description: "An array of `discovered_organization` objects tied to the `intermediate_session_token`, `session_token`, or `session_jwt`. See the [Discovered Organization Object](https://stytch.com/docs/b2b/api/discovered-organization-object) for complete details.\n\n Note that Organizations will only appear here under any of the following conditions:\n 1. The end user is already a Member of the Organization.\n 2. The end user is invited to the Organization.\n 3. The end user can join the Organization because:\n\n a) The Organization allows JIT provisioning.\n\n b) The Organizations' allowed domains list contains the Member's email domain.\n\n c) The Organization has at least one other Member with a verified email address with the same domain as the end user (to prevent phishing attacks)."
provider_type:
type: string
description: Denotes the OAuth identity provider that the user has authenticated with, e.g. Google, Microsoft, GitHub etc.
provider_tenant_id:
type: string
description: The tenant ID returned by the OAuth provider. This is typically used to identify an organization or group within the provider's domain. For example, in HubSpot this is a Hub ID, in Slack this is the Workspace ID, and in GitHub this is an organization ID. This field will only be populated if exactly one tenant ID is returned from a successful OAuth authentication and developers should prefer `provider_tenant_ids` over this since it accounts for the possibility of an OAuth provider yielding multiple tenant IDs.
provider_tenant_ids:
type: array
items:
type: string
description: All tenant IDs returned by the OAuth provider. These is typically used to identify organizations or groups within the provider's domain. For example, in HubSpot this is a Hub ID, in Slack this is the Workspace ID, and in GitHub this is an organization ID. Some OAuth providers do not return tenant IDs, some providers are guaranteed to return one, and some may return multiple. This field will always be populated if at least one tenant ID was returned from the OAuth provider and developers should prefer this field over `provider_tenant_id`.
full_name:
type: string
description: The full name of the authenticated end user, if available.
status_code:
type: integer
format: int32
description: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
required:
- request_id
- intermediate_session_token
- email_address
- discovered_organizations
- provider_type
- provider_tenant_id
- provider_tenant_ids
- full_name
- status_code
api_session_v1_EmbeddableMagicLinkFactor:
type: object
properties:
embedded_id:
type: string
required:
- embedded_id
api_b2b_scim_v1_SCIMAttributes:
type: object
properties:
user_name:
type: string
id:
type: string
external_id:
type: string
active:
type: boolean
groups:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Group'
display_name:
type: string
nick_name:
type: string
profile_url:
type: string
user_type:
type: string
title:
type: string
preferred_language:
type: string
locale:
type: string
timezone:
type: string
emails:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Email'
phone_numbers:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_PhoneNumber'
addresses:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Address'
ims:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_IMs'
photos:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Photo'
entitlements:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Entitlement'
roles:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_Role'
x509certificates:
type: array
items:
$ref: '#/components/schemas/api_b2b_scim_v1_X509Certificate'
name:
$ref: '#/components/schemas/api_b2b_scim_v1_Name'
enterprise_extension:
$ref: '#/components/schemas/api_b2b_scim_v1_EnterpriseExtension'
required:
- user_name
- id
- external_id
- active
- groups
- display_name
- nick_name
- profile_url
- user_type
- title
- preferred_language
- locale
- timezone
- emails
- phone_numbers
- addresses
- ims
- photos
- entitlements
- roles
- x509certificates
api_b2b_session_v1_MemberSession:
type: object
properties:
member_session_id:
type: string
description: Globally unique UUID that identifies a specific Session.
member_id:
type: string
description: Globally unique UUID that identifies a specific Member.
started_at:
type: string
descripti
# --- truncated at 32 KB (95 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/stytch/refs/heads/main/openapi/stytch-b2b-oauth-api-openapi.yml