Stytch OAuth API

openapi: 3.2.0
info:
  title: Stytch Consumer Authentication O Auth API
  version: 2.0.0
  description: Stytch's Consumer API for passwordless and password-based authentication. Supports Magic Links, SMS/email/WhatsApp OTP, OAuth social login, TOTP, WebAuthn/Passkeys, Crypto Wallets, Sessions, Users, M2M tokens, Fraud / Device Fingerprinting, Connected Apps (OAuth provider / MCP), Impersonation, IDP, and Consumer RBAC.
  contact:
    name: Stytch
    url: https://stytch.com/docs
  license:
    name: Proprietary
servers:
- url: https://api.stytch.com
  description: Production
- url: https://test.stytch.com
  description: Test
tags:
- name: OAuth
paths:
  /v1/oauth/attach:
    post:
      summary: Attach
      operationId: api_oauth_v1_Attach
      tags:
      - OAuth
      description: 'Generate an OAuth Attach Token to pre-associate an OAuth flow with an existing Stytch User. Pass the returned `oauth_attach_token` to the same provider''s OAuth Start endpoint to treat this OAuth flow as a login for that user instead of a signup for a new user.


        Exactly one of `user_id`, `session_token`, or `session_jwt` must be provided to identify the target Stytch User.


        **Note**: This is an optional step in the OAuth flow. Stytch can often determine whether to associate a new OAuth login with an existing User based on verified information (such as an email address) from the identity provider. This endpoint is useful for cases where we can''t, such as missing or unverified provider information.


        See our [OAuth email address behavior](https://stytch.com/docs/guides/oauth/email-behavior) resource for additional information.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api_oauth_v1_AttachRequest'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api_oauth_v1_AttachResponse'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
          content:
            application/json:
              example:
                status_code: 401
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: unauthorized_credentials
                error_message: Unauthorized credentials.
                error_url: https://stytch.com/docs/api/errors/401
        '429':
          description: Too Many Requests
          content:
            application/json:
              example:
                status_code: 429
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: too_many_requests
                error_message: Too many requests have been made.
                error_url: https://stytch.com/docs/api/errors/429
        '500':
          description: Internal server error
          content:
            application/json:
              example:
                status_code: 500
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: internal_server_error
                error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
                error_url: https://stytch.com/docs/api/errors/500
      x-code-samples:
      - lang: csharp
        label: C#
        source: "// POST /v1/oauth/attach\nconst stytch = require('stytch');\n\nconst client = new stytch.Client({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  provider: \"microsoft\",\n  user_id: \"${userId}\",\n};\n\nclient.OAuth.Attach(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: go
        label: Go
        source: "// POST /v1/oauth/attach\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/oauth\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/stytchapi\"\n)\n\nfunc main() {\n\tclient, err := stytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &oauth.AttachParams{\n\t\tProvider: \"microsoft\",\n\t\tUserID:   \"${userId}\",\n\t}\n\n\tresp, err := client.OAuth.Attach(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
      - lang: java
        label: Java
        source: "// POST /v1/oauth/attach\npackage com.example;\n\nimport com.stytch.java.common.StytchResult;\nimport com.stytch.java.consumer.models.oauth.AttachRequest;\nimport com.stytch.java.consumer.StytchClient;\n\npublic class Main {\n    public static void main(String[] args) {\n        StytchClient.configure(\"${projectId}\", \"${secret}\");\n\n        AttachRequest params = new AttachRequest();\n        params.setProvider(\"microsoft\");\n        params.setUserId(\"${userId}\");\n\n        Object result = StytchClient.getOAuth().attach(params);\n        if (result instanceof StytchResult.Success) {\n          System.out.println(((StytchResult.Success) result).getValue());\n        } else {\n          System.out.println(((StytchResult.Error) result).getException());\n        }\n    }\n}"
      - lang: kotlin
        label: Kotlin
        source: "// POST /v1/oauth/attach\npackage com.example\n\nimport com.stytch.java.consumer.StytchClient\nimport com.stytch.java.consumer.models.oauth.AttachRequest\n\nfun main() {\n    StytchClient.configure(\n        projectId = \"${projectId}\",\n        secret = \"${secret}\",\n    )\n\n    when (\n        val result =\n            StytchClient.oauth.attach(\n                AttachRequest(\n                    provider = \"microsoft\",\n                    userId = \"${userId}\",\n                ),\n            )\n    ) {\n        is StytchResult.Success -> println(result.value)\n        is StytchResult.Error -> println(result.exception)\n    }\n}\n"
      - lang: javascript
        label: Node.js
        source: "// POST /v1/oauth/attach\nconst stytch = require('stytch');\n\nconst client = new stytch.Client({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  provider: \"microsoft\",\n  user_id: \"${userId}\",\n};\n\nclient.oauth.attach(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: php
        label: PHP
        source: "$response = $client->oauth->attach([\n    'provider' => 'microsoft',\n    'user_id' => '${userId}',\n]);"
      - lang: python
        label: Python
        source: "# POST /v1/oauth/attach\nfrom stytch import Client\n\nclient = Client(\n    project_id=\"${projectId}\",\n    secret=\"${secret}\",\n)\n\nresp = client.oauth.attach(\n    provider=\"microsoft\",\n    user_id=\"${userId}\",\n)\n\nprint(resp)\n"
      - lang: ruby
        label: Ruby
        source: "# POST /v1/oauth/attach\nrequire 'stytch'\n\nclient = Stytch::Client.new(\n  project_id: \"${projectId}\",\n  secret: \"${secret}\"\n)\n\nresp = client.oauth.attach(\n  provider: \"microsoft\",\n  user_id: \"${userId}\"\n  \n)\n\nputs resp"
      - lang: rust
        label: Rust
        source: "// POST /v1/oauth/attach\nuse stytch::consumer::client::Client;\nuse stytch::consumer::oauth::AttachRequest;\n\nfn main() {\n    let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n    let resp = client.oauth.attach(\n        AttachRequest{\n            provider: \"microsoft\",\n            user_id: Some(String::from(\"${userId}\")),\n            ..Default::default()\n        }\n    ).await;\n    println!(\"The response is {:?}\", resp);\n}"
      - lang: bash
        label: cURL
        source: "# POST /v1/oauth/attach\ncurl --request POST \\\n  --url https://test.stytch.com/v1/oauth/attach \\\n  -u '${projectId}:${secret}' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"provider\": \"microsoft\",\n    \"user_id\": \"${userId}\"\n  }'"
  /v1/oauth/authenticate:
    post:
      summary: Authenticate
      operationId: api_oauth_v1_Authenticate
      tags:
      - OAuth
      description: Authenticate a User given a `token`. This endpoint verifies that the user completed the OAuth flow by verifying that the token is valid and hasn't expired. To initiate a Stytch session for the user while authenticating their OAuth token, include `session_duration_minutes`; a session with the identity provider, e.g. Google or Facebook, will always be initiated upon successful authentication.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api_oauth_v1_AuthenticateRequest'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api_oauth_v1_AuthenticateResponse'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
          content:
            application/json:
              example:
                status_code: 401
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: unauthorized_credentials
                error_message: Unauthorized credentials.
                error_url: https://stytch.com/docs/api/errors/401
        '429':
          description: Too Many Requests
          content:
            application/json:
              example:
                status_code: 429
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: too_many_requests
                error_message: Too many requests have been made.
                error_url: https://stytch.com/docs/api/errors/429
        '500':
          description: Internal server error
          content:
            application/json:
              example:
                status_code: 500
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: internal_server_error
                error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
                error_url: https://stytch.com/docs/api/errors/500
      x-code-samples:
      - lang: csharp
        label: C#
        source: "// POST /v1/oauth/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.Client({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  token: \"${token}\",\n  session_duration_minutes: 60,\n};\n\nclient.OAuth.Authenticate(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: go
        label: Go
        source: "// POST /v1/oauth/authenticate\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/oauth\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/stytchapi\"\n)\n\nfunc main() {\n\tclient, err := stytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &oauth.AuthenticateParams{\n\t\tToken:                  \"${token}\",\n\t\tSessionDurationMinutes: 60,\n\t}\n\n\tresp, err := client.OAuth.Authenticate(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
      - lang: java
        label: Java
        source: "// POST /v1/oauth/authenticate\npackage com.example;\n\nimport com.stytch.java.common.StytchResult;\nimport com.stytch.java.consumer.models.oauth.AuthenticateRequest;\nimport com.stytch.java.consumer.StytchClient;\n\npublic class Main {\n    public static void main(String[] args) {\n        StytchClient.configure(\"${projectId}\", \"${secret}\");\n\n        AuthenticateRequest params = new AuthenticateRequest();\n        params.setToken(\"${token}\");\n        params.setSessionDurationMinutes(60);\n\n        Object result = StytchClient.getOAuth().authenticate(params);\n        if (result instanceof StytchResult.Success) {\n          System.out.println(((StytchResult.Success) result).getValue());\n        } else {\n          System.out.println(((StytchResult.Error) result).getException());\n        }\n    }\n}"
      - lang: kotlin
        label: Kotlin
        source: "// POST /v1/oauth/authenticate\npackage com.example\n\nimport com.stytch.java.consumer.StytchClient\nimport com.stytch.java.consumer.models.oauth.AuthenticateRequest\n\nfun main() {\n    StytchClient.configure(\n        projectId = \"${projectId}\",\n        secret = \"${secret}\",\n    )\n\n    when (\n        val result =\n            StytchClient.oauth.authenticate(\n                AuthenticateRequest(\n                    token = \"${token}\",\n                    sessionDurationMinutes = 60,\n                ),\n            )\n    ) {\n        is StytchResult.Success -> println(result.value)\n        is StytchResult.Error -> println(result.exception)\n    }\n}\n"
      - lang: javascript
        label: Node.js
        source: "// POST /v1/oauth/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.Client({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  token: \"${token}\",\n  session_duration_minutes: 60,\n};\n\nclient.oauth.authenticate(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: php
        label: PHP
        source: "$response = $client->oauth->authenticate([\n    'token' => '${token}',\n    'session_duration_minutes' => 60,\n]);"
      - lang: python
        label: Python
        source: "# POST /v1/oauth/authenticate\nfrom stytch import Client\n\nclient = Client(\n    project_id=\"${projectId}\",\n    secret=\"${secret}\",\n)\n\nresp = client.oauth.authenticate(\n    token=\"${token}\",\n    session_duration_minutes=60,\n)\n\nprint(resp)\n"
      - lang: ruby
        label: Ruby
        source: "# POST /v1/oauth/authenticate\nrequire 'stytch'\n\nclient = Stytch::Client.new(\n  project_id: \"${projectId}\",\n  secret: \"${secret}\"\n)\n\nresp = client.oauth.authenticate(\n  token: \"${token}\",\n  session_duration_minutes: 60\n  \n)\n\nputs resp"
      - lang: rust
        label: Rust
        source: "// POST /v1/oauth/authenticate\nuse stytch::consumer::client::Client;\nuse stytch::consumer::oauth::AuthenticateRequest;\n\nfn main() {\n    let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n    let resp = client.oauth.authenticate(\n        AuthenticateRequest{\n            token: \"${token}\",\n            session_duration_minutes: 60,\n            ..Default::default()\n        }\n    ).await;\n    println!(\"The response is {:?}\", resp);\n}"
      - lang: bash
        label: cURL
        source: "# POST /v1/oauth/authenticate\ncurl --request POST \\\n  --url https://test.stytch.com/v1/oauth/authenticate \\\n  -u '${projectId}:${secret}' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"token\": \"${token}\",\n    \"session_duration_minutes\": 60\n  }'"
components:
  schemas:
    api_session_v1_AuthenticationFactorDeliveryMethod:
      type: string
      enum:
      - email
      - sms
      - whatsapp
      - embedded
      - oauth_google
      - oauth_microsoft
      - oauth_apple
      - webauthn_registration
      - authenticator_app
      - oauth_github
      - recovery_code
      - oauth_facebook
      - crypto_wallet
      - oauth_amazon
      - oauth_bitbucket
      - oauth_coinbase
      - oauth_discord
      - oauth_figma
      - oauth_gitlab
      - oauth_instagram
      - oauth_linkedin
      - oauth_shopify
      - oauth_slack
      - oauth_snapchat
      - oauth_spotify
      - oauth_steam
      - oauth_tiktok
      - oauth_twitch
      - oauth_twitter
      - knowledge
      - biometric
      - sso_saml
      - sso_oidc
      - oauth_salesforce
      - oauth_yahoo
      - oauth_hubspot
      - imported_auth0
      - oauth_exchange_slack
      - oauth_exchange_hubspot
      - oauth_exchange_github
      - oauth_exchange_google
      - impersonation
      - oauth_access_token_exchange
      - trusted_token_exchange
    api_session_v1_OAuthAccessTokenExchangeFactor:
      type: object
      properties:
        client_id:
          type: string
          description: The ID of the Connected App client.
      required:
      - client_id
    api_user_v1_BiometricRegistration:
      type: object
      properties:
        biometric_registration_id:
          type: string
          description: The unique ID for a biometric registration.
        verified:
          type: boolean
          description: The verified boolean denotes whether or not this send method, e.g. phone number, email address, etc., has been successfully authenticated by the User.
      required:
      - biometric_registration_id
      - verified
    api_session_v1_InstagramOAuthFactor:
      type: object
      properties:
        id:
          type: string
        provider_subject:
          type: string
        email_id:
          type: string
      required:
      - id
      - provider_subject
    api_session_v1_SteamOAuthFactor:
      type: object
      properties:
        id:
          type: string
        provider_subject:
          type: string
        email_id:
          type: string
      required:
      - id
      - provider_subject
    api_session_v1_GitLabOAuthFactor:
      type: object
      properties:
        id:
          type: string
        provider_subject:
          type: string
        email_id:
          type: string
      required:
      - id
      - provider_subject
    api_session_v1_SAMLSSOFactor:
      type: object
      properties:
        id:
          type: string
          description: The unique ID of an SSO Registration.
        provider_id:
          type: string
          description: Globally unique UUID that identifies a specific SAML Connection.
        external_id:
          type: string
          description: The ID of the member given by the identity provider.
      required:
      - id
      - provider_id
      - external_id
    api_session_v1_LinkedInOAuthFactor:
      type: object
      properties:
        id:
          type: string
        provider_subject:
          type: string
        email_id:
          type: string
      required:
      - id
      - provider_subject
    api_session_v1_BitbucketOAuthFactor:
      type: object
      properties:
        id:
          type: string
        provider_subject:
          type: string
        email_id:
          type: string
      required:
      - id
      - provider_subject
    api_session_v1_ImpersonatedFactor:
      type: object
      properties:
        impersonator_id:
          type: string
          description: For impersonated sessions initiated via the Stytch Dashboard, the `impersonator_id` will be the impersonator's Stytch Dashboard `member_id`.
        impersonator_email_address:
          type: string
          description: The email address of the impersonator.
      required:
      - impersonator_id
      - impersonator_email_address
    api_oauth_v1_ProviderValues:
      type: object
      properties:
        access_token:
          type: string
          description: The `access_token` that you may use to access the User's data in the provider's API.
        refresh_token:
          type: string
          description: The `refresh_token` that you may use to obtain a new `access_token` for the User within the provider's API.
        id_token:
          type: string
          description: The `id_token` returned by the OAuth provider. ID Tokens are JWTs that contain structured information about a user. The exact content of each ID Token varies from provider to provider. ID Tokens are returned from OAuth providers that conform to the [OpenID Connect](https://openid.net/foundation/) specification, which is based on OAuth.
        scopes:
          type: array
          items:
            type: string
          description: The OAuth scopes included for a given provider. See each provider's section above to see which scopes are included by default and how to add custom scopes.
        expires_at:
          type: string
          description: The timestamp when the Session expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
      required:
      - access_token
      - refresh_token
      - id_token
      - scopes
    api_session_v1_AppleOAuthFactor:
      type: object
      properties:
        id:
          type: string
        provider_subject:
          type: string
        email_id:
          type: string
      required:
      - id
      - provider_subject
    api_session_v1_GoogleOAuthExchangeFactor:
      type: object
      properties:
        email_id:
          type: string
          description: The globally unique UUID of the Member's email.
      required:
      - email_id
    api_session_v1_FigmaOAuthFactor:
      type: object
      properties:
        id:
          type: string
        provider_subject:
          type: string
        email_id:
          type: string
      required:
      - id
      - provider_subject
    api_session_v1_MicrosoftOAuthFactor:
      type: object
      properties:
        id:
          type: string
          description: The unique ID of an OAuth registration.
        provider_subject:
          type: string
          description: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
        email_id:
          type: string
          description: The globally unique UUID of the Member's email.
      required:
      - id
      - provider_subject
    api_user_v1_OAuthProvider:
      type: object
      properties:
        provider_type:
          type: string
          description: Denotes the OAuth identity provider that the user has authenticated with, e.g. Google, Facebook, GitHub etc.
        provider_subject:
          type: string
          description: The unique identifier for the User within a given OAuth provider. Also commonly called the "sub" or "Subject field" in OAuth protocols.
        profile_picture_url:
          type: string
          description: If available, the `profile_picture_url` is a url of the User's profile picture set in OAuth identity the provider that the User has authenticated with, e.g. Facebook profile picture.
        locale:
          type: string
          description: If available, the `locale` is the User's locale set in the OAuth identity provider that the user has authenticated with.
        oauth_user_registration_id:
          type: string
          description: The unique ID for an OAuth registration.
      required:
      - provider_type
      - provider_subject
      - profile_picture_url
      - locale
      - oauth_user_registration_id
    api_session_v1_TwitchOAuthFactor:
      type: object
      properties:
        id:
          type: string
        provider_subject:
          type: string
        email_id:
          type: string
      required:
      - id
      - provider_subject
    api_session_v1_Session:
      type: object
      properties:
        session_id:
          type: string
          description: A unique identifier for a specific Session.
        user_id:
          type: string
          description: The unique ID of the affected User.
        authentication_factors:
          type: array
          items:
            $ref: '#/components/schemas/api_session_v1_AuthenticationFactor'
          description: An array of different authentication factors that comprise a Session.
        roles:
          type: array
          items:
            type: string
        started_at:
          type: string
          description: The timestamp when the Session was created. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
        last_accessed_at:
          type: string
          description: The timestamp when the Session was last accessed. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
        expires_at:
          type: string
          description: The timestamp when the Session expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
        attributes:
          $ref: '#/components/schemas/api_attribute_v1_Attributes'
          description: Provided attributes help with fraud detection.
        custom_claims:
          type: object
          additionalProperties: true
          description: The custom claims map for a Session. Claims can be added to a session during a Sessions authenticate call.
      required:
      - session_id
      - user_id
      - authentication_factors
      - roles
    api_oauth_v1_AttachRequest:
      type: object
      properties:
        provider:
          type: string
          description: The OAuth provider's name.
        user_id:
          type: string
          description: The unique ID of a specific User. You may use an `external_id` here if one is set for the user.
        session_token:
          type: string
          description: The `session_token` associated with a User's existing Session.
        session_jwt:
          type: string
          description: The `session_jwt` associated with a User's existing Session.
      description: Request type
      required:
      - provider
    api_user_v1_User:
      type: object
      properties:
        user_id:
          type: string
          description: The unique ID of the affected User.
        emails:
          type: array
          items:
            $ref: '#/components/schemas/api_user_v1_Email'
          description: An array of email objects for the User.
        status:
          type: string
          description: The status of the User. The possible values are `pending` and `active`.
        phone_numbers:
          type: array
          items:
            $ref: '#/components/schemas/api_user_v1_PhoneNumber'
          description: An array of phone number objects linked to the User.
        webauthn_registrations:
          type: array
          items:
            $ref: '#/components/schemas/api_user_v1_WebAuthnRegistration'
          description: An array that contains a list of all Passkey or WebAuthn registrations for a given User in the Stytch API.
        providers:
          type: array
          items:
            $ref: '#/components/schemas/api_user_v1_OAuthProvider'
          description: An array of OAuth `provider` objects linked to the User.
        totps:
          type: array
          items:
            $ref: '#/components/schemas/api_user_v1_TOTP'
          description: An array containing a list of all TOTP instances for a given User in the Stytch API.
        crypto_wallets:
          type: array
          items:
            $ref: '#/components/schemas/api_user_v1_CryptoWallet'
          description: An array contains a list of all crypto wallets for a given User in the Stytch API.
        biometric_registrations:
          type: array
          items:
            $ref: '#/components/schemas/api_user_v1_BiometricRegistration'
          description: An array that contains a list of all biometric registrations for a given User in the Stytch API.
        is_locked:
          type: boolean
          description: Whether the User is temporarily locked due to too many failed authentication attempts. See the [User Locking Guide](https://stytch.com/docs/resources/platform/user-locks) for more information.
        roles:
          type: array
          items:
            type: string
          description: "Roles assigned to this User.\n   See the [RBAC guide](https://stytch.com/docs/guides/rbac/role-assignment) for more information about role assignment."
        name:
          $ref: '#/components/schemas/api_user_v1_Name'
          description: The name of the User. Each field in the `name` object is optional.
        created_at:
          type: string
          description: The timestamp of the User's creation. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
        password:
          $ref: '#/components/schemas/api_user_v1_Password'
          description: The password object is returned for users with a password.
        trusted_metadata:
          type: object
          additionalProperties: true
          description: The `trusted_metadata` field contains an arbitrary JSON object of application-specific data. See the [Metadata](https://stytch.com/docs/api/metadata) reference for complete field behavior details.
        untrusted_metadata:
          type: object
          additionalProperties: true
          description: The `untrusted_metadata` field contains an arbitrary JSON object of application-specific data. Untrusted metadata can be edited by end users directly via the SDK, and **cannot be used to store critical information.** See the [Metadata](https://stytch.com/docs/api/metadata) reference for complete field behavior details.
        external_id:
          type: string
          description: An identifier that can be used in most API calls where a `member_id` is expected. This is a string consisting of alphanumeric, `.`, `_`, `-`, or `|` characters with a maximum length of 128 characters. External IDs must be unique within the project.
        lock_created_at:
          type: string
          description: When the user lock was created, if there is one. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
        lock_expires_at:
          type: string
          description: When the user lock expires, if there is one. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
      required:
      - user_id
      - emails
      - status
      - phone_numbers
      - webauthn_registrations
      - providers
      - totps
      - crypto_wallets
      - biometric_registrations
      - is_locked
      - roles
    api_session_v1_HubspotOAuthFactor:
      type: object
      properties:
        id:
          type: string
          description: The unique ID of an OAuth registration.
        provider_subject:
          type: string
          description: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
        email_id:
          type: string
          description: The globally unique UUID of the Member's email.
      required:
      - id
      - provider_subject
    api_session_v1_ShopifyOAuthFactor:
      type: object
      properties:
        id:
          type: string
        provider_subject:
          type: string
        email_id:
          type: string
      required:
      - id
      - provider_subject
    api_session_v1_SnapchatOAuthFactor:
      type: object
      properties:
        id:
          type: string
        provider_subject:
          type: string
        email_id:
          type: string
      required:
      - id
      - provider_subject
    api_session_v1_SlackOAuthExchangeFactor:
      type: object
      properties:
        email_id:
          type: string
          description: The globally unique UUID of the Member's email.
      required:
      - email_id
    api_session_v1_SlackOAuthFactor:
      type: object
      properties:
        id:
          type: string
          description: The unique ID of an OAuth registration.
        provider_subject:
          type: string
          description: The unique identifier for the User within a given OAuth provider. Also commonly called the `sub` or "Subject field" in OAuth protocols.
        email_id:
          type: string
          description: The globally unique UUID of the Member's email.
      required:
      - id
      - provider_subject
    api_user_v1_Password:
      type: object
      properties:
        password_id:
          type: string
          description: The unique ID of a specific password
        requires_reset:
          type: boolean
          description: Indicates whether this password requires a password reset
      required:
      - password_id
      - requires_reset
    api_session_v1_CoinbaseOAuthFactor:
      type: object
      properties:
        id:
          type: string
        provider_subject:
          t

# --- truncated at 32 KB (60 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/stytch/refs/heads/main/openapi/stytch-oauth-api-openapi.yml