openapi: 3.0.3
info:
title: Stytch B2B Authentication Application Session API
version: 2.0.0
description: Stytch's B2B API for multi-tenant authentication. Supports Organizations, Members, SSO (SAML/OIDC), Magic Links, OTP, OAuth, Discovery, Sessions, B2B RBAC, SCIM, TOTP, Recovery Codes, Passwords, Impersonation, and the B2B IDP.
contact:
name: Stytch
url: https://stytch.com/docs
license:
name: Proprietary
servers:
- url: https://api.stytch.com
description: Production
- url: https://test.stytch.com
description: Test
tags:
- name: Session
paths:
/v1/b2b/sessions:
get:
summary: Get
operationId: api_b2b_session_v1_Get
tags:
- Session
description: Retrieves all active Sessions for a Member.
parameters:
- name: organization_id
in: query
required: true
schema:
type: string
description: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the organization_slug or organization_external_id here as a convenience.
- name: member_id
in: query
required: true
schema:
type: string
description: Globally unique UUID that identifies a specific Member. The `member_id` is critical to perform operations on a Member, so be sure to preserve this value. You may use an external_id here if one is set for the member.
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_session_v1_GetResponse'
'400':
description: Bad request
'401':
description: Unauthorized
content:
application/json:
example:
status_code: 401
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: unauthorized_credentials
error_message: Unauthorized credentials.
error_url: https://stytch.com/docs/api/errors/401
'429':
description: Too Many Requests
content:
application/json:
example:
status_code: 429
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: too_many_requests
error_message: Too many requests have been made.
error_url: https://stytch.com/docs/api/errors/429
'500':
description: Internal server error
content:
application/json:
example:
status_code: 500
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: internal_server_error
error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
error_url: https://stytch.com/docs/api/errors/500
x-code-samples:
- lang: csharp
label: C#
source: "// GET /v1/b2b/sessions\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n organization_id: \"${organizationId}\",\n member_id: \"${memberId}\",\n};\n\nclient.Sessions.Get(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: go
label: Go
source: "// GET /v1/b2b/sessions\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/sessions\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &sessions.GetParams{\n\t\tOrganizationID: \"${organizationId}\",\n\t\tMemberID: \"${memberId}\",\n\t}\n\n\tresp, err := client.Sessions.Get(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
- lang: java
label: Java
source: "// GET /v1/b2b/sessions\npackage com.example;\n\nimport com.stytch.java.b2b.models.sessions.GetRequest;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n public static void main(String[] args) {\n StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n GetRequest params = new GetRequest();\n params.setOrganizationId(\"${organizationId}\");\n params.setMemberId(\"${memberId}\");\n\n Object result = StytchB2BClient.getSessions().get(params);\n if (result instanceof StytchResult.Success) {\n System.out.println(((StytchResult.Success) result).getValue());\n } else {\n System.out.println(((StytchResult.Error) result).getException());\n }\n }\n}"
- lang: kotlin
label: Kotlin
source: "// GET /v1/b2b/sessions\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.sessions.GetRequest\n\nfun main() {\n StytchB2BClient.configure(\n projectId = \"${projectId}\",\n secret = \"${secret}\",\n )\n\n when (\n val result =\n StytchB2BClient.sessions.get(\n GetRequest(\n organizationId = \"${organizationId}\",\n memberId = \"${memberId}\",\n ),\n )\n ) {\n is StytchResult.Success -> println(result.value)\n is StytchResult.Error -> println(result.exception)\n }\n}\n"
- lang: javascript
label: Node.js
source: "// GET /v1/b2b/sessions\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n organization_id: \"${organizationId}\",\n member_id: \"${memberId}\",\n};\n\nclient.sessions.get(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: php
label: PHP
source: "$response = $client->sessions->get([\n 'organization_id' => '${organizationId}',\n 'member_id' => '${memberId}',\n]);"
- lang: python
label: Python
source: "# GET /v1/b2b/sessions\nfrom stytch import B2BClient\n\nclient = B2BClient(\n project_id=\"${projectId}\",\n secret=\"${secret}\",\n)\n\nresp = client.sessions.get(\n organization_id=\"${organizationId}\",\n member_id=\"${memberId}\",\n)\n\nprint(resp)\n"
- lang: ruby
label: Ruby
source: "# GET /v1/b2b/sessions\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n project_id: \"${projectId}\",\n secret: \"${secret}\"\n)\n\nresp = client.sessions.get(\n organization_id: \"${organizationId}\",\n member_id: \"${memberId}\"\n \n)\n\nputs resp"
- lang: rust
label: Rust
source: "// GET /v1/b2b/sessions\nuse stytch::b2b::client::Client;\nuse stytch::b2b::sessions::GetRequest;\n\nfn main() {\n let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n let resp = client.sessions.get(\n GetRequest{\n organization_id: \"${organizationId}\",\n member_id: \"${memberId}\",\n ..Default::default()\n }\n ).await;\n println!(\"The response is {:?}\", resp);\n}"
- lang: bash
label: cURL
source: "# GET /v1/b2b/sessions\ncurl --request GET \\\n --url https://test.stytch.com/v1/b2b/sessions \\\n -u '${projectId}:${secret}' \\\n -H 'Content-Type: application/json' \\\n --get \\\n --data-urlencode 'organization_id=${organizationId}' \\\n --data-urlencode 'member_id=${memberId}'"
/v1/b2b/sessions/authenticate:
post:
summary: Authenticate
operationId: api_b2b_session_v1_Authenticate
tags:
- Session
description: 'Authenticates a Session and updates its lifetime by the specified `session_duration_minutes`. If the `session_duration_minutes` is not specified, a Session will not be extended. This endpoint requires either a `session_jwt` or `session_token` be included in the request. It will return an error if both are present.
You may provide a JWT that needs to be refreshed and is expired according to its `exp` claim. A new JWT will be returned if both the signature and the underlying Session are still valid. See our [How to use Stytch Session JWTs](https://stytch.com/docs/b2b/guides/sessions/resources/using-jwts) guide for more information.
If an `authorization_check` object is passed in, this method will also check if the Member is authorized to perform the given action on the given Resource in the specified Organization. A Member is authorized if their Member Session contains a Role, assigned [explicitly or implicitly](https://stytch.com/docs/b2b/guides/rbac/role-assignment), with adequate permissions.
In addition, the `organization_id` passed in the authorization check must match the Member''s Organization.
If the Member is not authorized to perform the specified action on the specified Resource, or if the
`organization_id` does not match the Member''s Organization, a 403 error will be thrown.
Otherwise, the response will contain a list of Roles that satisfied the authorization check.'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_session_v1_AuthenticateRequest'
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_session_v1_AuthenticateResponse'
'400':
description: Bad request
'401':
description: Unauthorized
content:
application/json:
example:
status_code: 401
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: unauthorized_credentials
error_message: Unauthorized credentials.
error_url: https://stytch.com/docs/api/errors/401
'429':
description: Too Many Requests
content:
application/json:
example:
status_code: 429
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: too_many_requests
error_message: Too many requests have been made.
error_url: https://stytch.com/docs/api/errors/429
'500':
description: Internal server error
content:
application/json:
example:
status_code: 500
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: internal_server_error
error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
error_url: https://stytch.com/docs/api/errors/500
x-code-samples:
- lang: csharp
label: C#
source: "// POST /v1/b2b/sessions/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n session_token: \"${sessionToken}\",\n};\n\nclient.Sessions.Authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: go
label: Go
source: "// POST /v1/b2b/sessions/authenticate\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/sessions\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &sessions.AuthenticateParams{\n\t\tSessionToken: \"${sessionToken}\",\n\t}\n\n\tresp, err := client.Sessions.Authenticate(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
- lang: java
label: Java
source: "// POST /v1/b2b/sessions/authenticate\npackage com.example;\n\nimport com.stytch.java.b2b.models.sessions.AuthenticateRequest;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n public static void main(String[] args) {\n StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n AuthenticateRequest params = new AuthenticateRequest();\n params.setSessionToken(\"${sessionToken}\");\n\n Object result = StytchB2BClient.getSessions().authenticate(params);\n if (result instanceof StytchResult.Success) {\n System.out.println(((StytchResult.Success) result).getValue());\n } else {\n System.out.println(((StytchResult.Error) result).getException());\n }\n }\n}"
- lang: kotlin
label: Kotlin
source: "// POST /v1/b2b/sessions/authenticate\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.sessions.AuthenticateRequest\n\nfun main() {\n StytchB2BClient.configure(\n projectId = \"${projectId}\",\n secret = \"${secret}\",\n )\n\n when (\n val result =\n StytchB2BClient.sessions.authenticate(\n AuthenticateRequest(\n sessionToken = \"${sessionToken}\",\n ),\n )\n ) {\n is StytchResult.Success -> println(result.value)\n is StytchResult.Error -> println(result.exception)\n }\n}\n"
- lang: javascript
label: Node.js
source: "// POST /v1/b2b/sessions/authenticate\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n session_token: \"${sessionToken}\",\n};\n\nclient.sessions.authenticate(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: php
label: PHP
source: "$response = $client->sessions->authenticate([\n 'session_token' => '${sessionToken}',\n]);"
- lang: python
label: Python
source: "# POST /v1/b2b/sessions/authenticate\nfrom stytch import B2BClient\n\nclient = B2BClient(\n project_id=\"${projectId}\",\n secret=\"${secret}\",\n)\n\nresp = client.sessions.authenticate(\n session_token=\"${sessionToken}\",\n)\n\nprint(resp)\n"
- lang: ruby
label: Ruby
source: "# POST /v1/b2b/sessions/authenticate\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n project_id: \"${projectId}\",\n secret: \"${secret}\"\n)\n\nresp = client.sessions.authenticate(\n session_token: \"${sessionToken}\"\n \n)\n\nputs resp"
- lang: rust
label: Rust
source: "// POST /v1/b2b/sessions/authenticate\nuse stytch::b2b::client::Client;\nuse stytch::b2b::sessions::AuthenticateRequest;\n\nfn main() {\n let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n let resp = client.sessions.authenticate(\n AuthenticateRequest{\n session_token: Some(String::from(\"${sessionToken}\")),\n ..Default::default()\n }\n ).await;\n println!(\"The response is {:?}\", resp);\n}"
- lang: bash
label: cURL
source: "# POST /v1/b2b/sessions/authenticate\ncurl --request POST \\\n --url https://test.stytch.com/v1/b2b/sessions/authenticate \\\n -u '${projectId}:${secret}' \\\n -H 'Content-Type: application/json' \\\n -d '{\n \"session_token\": \"${sessionToken}\"\n }'"
/v1/b2b/sessions/revoke:
post:
summary: Revoke
operationId: api_b2b_session_v1_Revoke
tags:
- Session
description: Revoke a Session and immediately invalidate all its tokens. To revoke a specific Session, pass either the `member_session_id`, `session_token`, or `session_jwt`. To revoke all Sessions for a Member, pass the `member_id`.
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_session_v1_RevokeRequest'
parameters:
- name: X-Stytch-Member-Session
in: header
required: false
description: A Stytch session that can be used to run the request with the given member's permissions.
schema:
type: string
- name: X-Stytch-Member-SessionJWT
in: header
required: false
description: A Stytch Session JSON Web Token (JWT) that can be used to run the request with the given member's permissions.
schema:
type: string
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_session_v1_RevokeResponse'
'400':
description: Bad request
'401':
description: Unauthorized
content:
application/json:
example:
status_code: 401
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: unauthorized_credentials
error_message: Unauthorized credentials.
error_url: https://stytch.com/docs/api/errors/401
'429':
description: Too Many Requests
content:
application/json:
example:
status_code: 429
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: too_many_requests
error_message: Too many requests have been made.
error_url: https://stytch.com/docs/api/errors/429
'500':
description: Internal server error
content:
application/json:
example:
status_code: 500
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: internal_server_error
error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
error_url: https://stytch.com/docs/api/errors/500
x-code-samples:
- lang: csharp
label: C#
source: "// POST /v1/b2b/sessions/revoke\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n member_id: \"${memberId}\",\n};\n\nconst options = {\n authorization: {\n session_token: '${sessionToken}',\n },\n};\n\nclient.Sessions.Revoke(params, options)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: go
label: Go
source: "// POST /v1/b2b/sessions/revoke\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/sessions\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/methodoptions\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &sessions.RevokeParams{\n\t\tMemberID: \"${memberId}\",\n\t}\n\n\toptions := &sessions.RevokeParamsOptions{\n\t\tAuthorization: methodoptions.Authorization{\n\t\t\tSessionToken: \"${sessionToken}\",\n\t\t},\n\t}\n\n\tresp, err := client.Sessions.Revoke(context.Background(), params, options)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
- lang: java
label: Java
source: "// POST /v1/b2b/sessions/revoke\npackage com.example;\n\nimport com.stytch.java.b2b.models.sessions.RevokeRequest;\nimport com.stytch.java.b2b.models.sessions.RevokeRequestOptions;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.methodoptions.Authorization;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n public static void main(String[] args) {\n StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n RevokeRequest params = new RevokeRequest();\n params.setMemberId(\"${memberId}\");\n\n RevokeRequestOptions options = new RevokeRequestOptions();\n Authorization authorization = new Authorization();\n authorization.setSessionToken(\"${sessionToken}\");\n options.setAuthorization(authorization);\n\n Object result = StytchB2BClient.getSessions().revoke(params, options);\n if (result instanceof StytchResult.Success) {\n System.out.println(((StytchResult.Success) result).getValue());\n } else {\n System.out.println(((StytchResult.Error) result).getException());\n }\n }\n}"
- lang: kotlin
label: Kotlin
source: "// POST /v1/b2b/sessions/revoke\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.sessions.RevokeRequest\nimport com.stytch.java.b2b.models.sessions.RevokeRequestOptions\nimport com.stytch.java.common.methodoptions.Authorization\n\nfun main() {\n StytchB2BClient.configure(\n projectId = \"${projectId}\",\n secret = \"${secret}\",\n )\n\n when (\n val result =\n StytchB2BClient.sessions.revoke(\n RevokeRequest(\n memberId = \"${memberId}\",\n ),\n RevokeRequestOptions(\n Authorization(\n sessionToken = \"${sessionToken}\",\n ),\n ),\n )\n ) {\n is StytchResult.Success -> println(result.value)\n is StytchResult.Error -> println(result.exception)\n }\n}\n"
- lang: javascript
label: Node.js
source: "// POST /v1/b2b/sessions/revoke\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n member_id: \"${memberId}\",\n};\n\nconst options = {\n authorization: {\n session_token: '${sessionToken}',\n },\n};\n\nclient.sessions.revoke(params, options)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: php
label: PHP
source: "$response = $client->sessions->revoke([\n 'member_id' => '${memberId}',\n], [\n 'authorization' => ['session_token' => '${sessionToken}'],\n\n]);"
- lang: python
label: Python
source: "# POST /v1/b2b/sessions/revoke\nfrom stytch import B2BClient\nfrom stytch.b2b.models.sessions import RevokeRequestOptions\nfrom stytch.shared.method_options import Authorization\n\nclient = B2BClient(\n project_id=\"${projectId}\",\n secret=\"${secret}\",\n)\n\nresp = client.sessions.revoke(\n member_id=\"${memberId}\",\n method_options=RevokeRequestOptions(\n authorization=Authorization(\n session_token=\"${sessionToken}\",\n ),\n ),\n)\n\nprint(resp)\n"
- lang: ruby
label: Ruby
source: "# POST /v1/b2b/sessions/revoke\nrequire 'stytch'\n\nclient = StytchB2B::Client.new(\n project_id: \"${projectId}\",\n secret: \"${secret}\"\n)\n\nresp = client.sessions.revoke(\n member_id: \"${memberId}\",\n method_options: StytchB2B::Sessions::RevokeRequestOptions.new(\n authorization: Stytch::MethodOptions::Authorization.new(session_token: '${sessionToken}')\n )\n)\n\nputs resp"
- lang: rust
label: Rust
source: "// POST /v1/b2b/sessions/revoke\nuse stytch::b2b::client::Client;\nuse stytch::b2b::sessions::RevokeRequest;\n\nfn main() {\n let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n let resp = client.sessions.revoke(\n RevokeRequest{\n member_id: Some(String::from(\"${memberId}\")),\n ..Default::default()\n }\n ).await;\n println!(\"The response is {:?}\", resp);\n}"
- lang: bash
label: cURL
source: "# POST /v1/b2b/sessions/revoke\ncurl --request POST \\\n --url https://test.stytch.com/v1/b2b/sessions/revoke \\\n -u '${projectId}:${secret}' \\\n -H 'Content-Type: application/json' \\\n -H \"X-Stytch-Member-Session: ${sessionToken}\" \\\n -d '{\n \"member_id\": \"${memberId}\"\n }'"
/v1/b2b/sessions/exchange:
post:
summary: Exchange
operationId: api_b2b_session_v1_Exchange
tags:
- Session
description: 'Use this endpoint to exchange a Member''s existing session for another session in a different Organization. This can be used to accept an invite, but not to create a new member via domain matching.
To create a new member via email domain JIT Provisioning, use the [Exchange Intermediate Session](https://stytch.com/docs/b2b/api/exchange-intermediate-session) flow instead.
If the user **has** already satisfied the authentication requirements of the Organization they are trying to switch into, this API will return `member_authenticated: true` and a `session_token` and `session_jwt`.
If the user **has not** satisfied the primary or secondary authentication requirements of the Organization they are attempting to switch into, this API will return `member_authenticated: false` and an `intermediate_session_token`.
If `primary_required` is set, prompt the user to fulfill the Organization''s auth requirements using the options returned in `primary_required.allowed_auth_methods`.
If `primary_required` is null and `mfa_required` is set, check `mfa_required.member_options` to determine if the Member has SMS OTP or TOTP set up for MFA and prompt accordingly. If the Member has SMS OTP, check `mfa_required.secondary_auth_initiated` to see if the OTP has already been sent.
Include the `intermediate_session_token` returned above when calling the `authenticate()` method that the user needed to perform. Once the user has completed the authentication requirements they were missing, they will be granted a full `session_token` and `session_jwt` to indicate they have successfully logged into the Organization.
The `intermediate_session_token` can also be used with the [Exchange Intermediate Session endpoint](https://stytch.com/docs/b2b/api/exchange-intermediate-session) or the [Create Organization via Discovery endpoint](https://stytch.com/docs/b2b/api/create-organization-via-discovery) to join a different Organization or create a new one.
The `session_duration_minutes` and `session_custom_claims` parameters will be ignored.'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_session_v1_ExchangeRequest'
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/api_b2b_session_v1_ExchangeResponse'
'400':
description: Bad request
'401':
description: Unauthorized
content:
application/json:
example:
status_code: 401
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: unauthorized_credentials
error_message: Unauthorized credentials.
error_url: https://stytch.com/docs/api/errors/401
'429':
description: Too Many Requests
content:
application/json:
example:
status_code: 429
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: too_many_requests
error_message: Too many requests have been made.
error_url: https://stytch.com/docs/api/errors/429
'500':
description: Internal server error
content:
application/json:
example:
status_code: 500
request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
error_type: internal_server_error
error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
error_url: https://stytch.com/docs/api/errors/500
x-code-samples:
- lang: csharp
label: C#
source: "// POST /v1/b2b/sessions/exchange\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n organization_id: \"${organizationId}\",\n session_token: \"${sessionToken}\",\n};\n\nclient.Sessions.Exchange(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: go
label: Go
source: "// POST /v1/b2b/sessions/exchange\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/b2bstytchapi\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/b2b/sessions\"\n)\n\nfunc main() {\n\tclient, err := b2bstytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &sessions.ExchangeParams{\n\t\tOrganizationID: \"${organizationId}\",\n\t\tSessionToken: \"${sessionToken}\",\n\t}\n\n\tresp, err := client.Sessions.Exchange(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
- lang: java
label: Java
source: "// POST /v1/b2b/sessions/exchange\npackage com.example;\n\nimport com.stytch.java.b2b.models.sessions.ExchangeRequest;\nimport com.stytch.java.b2b.StytchB2BClient;\nimport com.stytch.java.common.StytchResult;\n\npublic class Main {\n public static void main(String[] args) {\n StytchB2BClient.configure(\"${projectId}\", \"${secret}\");\n\n ExchangeRequest params = new ExchangeRequest();\n params.setOrganizationId(\"${organizationId}\");\n params.setSessionToken(\"${sessionToken}\");\n\n Object result = StytchB2BClient.getSessions().exchange(params);\n if (result instanceof StytchResult.Success) {\n System.out.println(((StytchResult.Success) result).getValue());\n } else {\n System.out.println(((StytchResult.Error) result).getException());\n }\n }\n}"
- lang: kotlin
label: Kotlin
source: "// POST /v1/b2b/sessions/exchange\npackage com.example\n\nimport com.stytch.java.b2b.StytchB2BClient\nimport com.stytch.java.b2b.models.sessions.ExchangeRequest\n\nfun main() {\n StytchB2BClient.configure(\n projectId = \"${projectId}\",\n secret = \"${secret}\",\n )\n\n when (\n val result =\n StytchB2BClient.sessions.exchange(\n ExchangeRequest(\n organizationId = \"${organizationId}\",\n sessionToken = \"${sessionToken}\",\n ),\n )\n ) {\n is StytchResult.Success -> println(result.value)\n is StytchResult.Error -> println(result.exception)\n }\n}\n"
- lang: javascript
label: Node.js
source: "// POST /v1/b2b/sessions/exchange\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n project_id: '${projectId}',\n secret: '${secret}',\n});\n\nconst params = {\n organization_id: \"${organizationId}\",\n session_token: \"${sessionToken}\",\n};\n\nclient.sessions.exchange(params)\n .then(resp => { console.log(resp) })\n .catch(err => { console.log(err) });"
- lang: php
label: PHP
source: "$response = $client->sessions->exchange([\n 'organization_id' => '${organizationId}',\n 'session_token' => '${sessionToken}',\n]);"
- lang: python
label: Python
source:
# --- truncated at 32 KB (232 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/stytch/refs/heads/main/openapi/stytch-session-api-openapi.yml