--- title: "Getconnections" method: GET path: "/v1/b2b/sso/{organization_id}" tags: ["Sso"] --- # Getconnections `GET /v1/b2b/sso/{organization_id}` ## Request - Base URL: `https://api.stytch.com` - URL: `https://api.stytch.com/v1/b2b/sso/{organization_id}` - Auth: HTTP basic Get all SSO Connections owned by the organization. ## Path parameters - `organization_id` string, required: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the organization_slug or organization_external_id here as a convenience. ## Headers - `X-Stytch-Member-Session` string - `X-Stytch-Member-SessionJWT` string ## Response `200` Successful response - ApiSsoV1GetConnectionsResponse - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue. - `saml_connections` ApiSsoV1SAMLConnection[], required: The list of [SAML Connections](https://stytch.com/docs/b2b/api/saml-connection-object) owned by this organization. - `organization_id` string, required: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the organization_slug or organization_external_id here as a convenience. - `connection_id` string, required: Globally unique UUID that identifies a specific SAML Connection. - `status` string, required: The status of the connection. The possible values are pending or active. See the [Update SAML Connection endpoint](https://stytch.com/docs/b2b/api/update-saml-connection) for more details. - `idp_entity_id` string, required: A globally unique name for the IdP. This will be provided by the IdP. - `display_name` string, required: A human-readable display name for the connection. - `idp_sso_url` string, required: The URL for which assertions for login requests will be sent. This will be provided by the IdP. - `acs_url` string, required: The URL of the Assertion Consumer Service. This value will be passed to the IdP to redirect the Member back to Stytch after a sign-in attempt. Read our [SAML Overview](https://stytch.com/docs/b2b/api/saml-overview) for more info. - `audience_uri` string, required: The URL of the Audience Restriction. This value will indicate that Stytch is the intended audience of an assertion. Read our [SAML Overview](https://stytch.com/docs/b2b/api/saml-overview) for more info. - `signing_certificates` ApiSsoV1X509Certificate[], required: A list of X.509 certificates Stytch will use to sign its assertion requests. Certificates should be uploaded to the IdP. - `certificate_id` string, required: The ID of the certificate. - `certificate` string, required: The certificate, in [PEM](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail) format. - `issuer` string, required: The issuer of the certificate. For signing certificates, this value will be "Stytch". - `created_at` string: A timestamp that indicates when the certificate was created. - `expires_at` string: A timestamp that indicates when the certificate will expire. - `updated_at` string: A timestamp that indicates when the certificate was updated. - `verification_certificates` ApiSsoV1X509Certificate[], required: A list of X.509 certificates Stytch will use to validate an assertion callback. Certificates should be populated from the IdP. - `certificate_id` string, required: The ID of the certificate. - `certificate` string, required: The certificate, in [PEM](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail) format. - `issuer` string, required: The issuer of the certificate. For signing certificates, this value will be "Stytch". - `created_at` string: A timestamp that indicates when the certificate was created. - `expires_at` string: A timestamp that indicates when the certificate will expire. - `updated_at` string: A timestamp that indicates when the certificate was updated. - `encryption_private_keys` ApiSsoV1EncryptionPrivateKey[], required - `private_key_id` string, required - `private_key` string, required - `created_at` string - `saml_connection_implicit_role_assignments` ApiSsoV1SAMLConnectionImplicitRoleAssignment[], required: All Members who log in with this SAML connection will implicitly receive the specified Roles. See the [RBAC guide](https://stytch.com/docs/b2b/guides/rbac/role-assignment) for more information about role assignment. - `role_id` string, required: The unique identifier of the RBAC Role, provided by the developer and intended to be human-readable. Reserved `role_id`s that are predefined by Stytch include: * `stytch_member` * `stytch_admin` Check out the [guide on Stytch default Roles](https://stytch.com/docs/b2b/guides/rbac/stytch-default) for a more detailed explanation. - `saml_group_implicit_role_assignments` ApiSsoV1SAMLGroupImplicitRoleAssignment[], required: Defines the names of the SAML groups that grant specific role assignments. For each group-Role pair, if a Member logs in with this SAML connection and belongs to the specified SAML group, they will be granted the associated Role. See the [RBAC guide](https://stytch.com/docs/b2b/guides/rbac/role-assignment) for more information about role assignment. - `role_id` string, required - `group` string, required - `alternative_audience_uri` string, required: An alternative URL to use for the Audience Restriction. This value can be used when you wish to migrate an existing SAML integration to Stytch with zero downtime. Read our [SSO migration guide](https://stytch.com/docs/b2b/guides/migrations/additional-migration-considerations) for more info. - `identity_provider` string, required: Name of the IdP. Enum with possible values: `classlink`, `cyberark`, `duo`, `google-workspace`, `jumpcloud`, `keycloak`, `miniorange`, `microsoft-entra`, `okta`, `onelogin`, `pingfederate`, `rippling`, `salesforce`, `shibboleth`, or `generic`. Specifying a known provider allows Stytch to handle any provider-specific logic. - `nameid_format` string, required: The NameID format the SAML Connection expects to use. Defaults to `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`. - `alternative_acs_url` string, required: An alternative URL to use for the `AssertionConsumerServiceURL` in SP initiated SAML AuthNRequests. This value can be used when you wish to migrate an existing SAML integration to Stytch with zero downtime. Note that you will be responsible for proxying requests sent to the Alternative ACS URL to Stytch. Read our [SSO migration guide](https://stytch.com/docs/b2b/guides/migrations/additional-migration-considerations) for more info. - `idp_initiated_auth_disabled` boolean, required: Determines whether IDP initiated auth is allowed for a given SAML connection. Defaults to false (IDP Initiated Auth is enabled). - `allow_gateway_callback` boolean, required - `attribute_mapping` object: An object that represents the attributes used to identify a Member. This object will map the IdP-defined User attributes to Stytch-specific values. Required attributes: `email` and one of `full_name` or `first_name` and `last_name`. - `oidc_connections` ApiSsoV1OIDCConnection[], required: The list of [OIDC Connections](https://stytch.com/docs/b2b/api/oidc-connection-object) owned by this organization. - `organization_id` string, required: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the organization_slug or organization_external_id here as a convenience. - `connection_id` string, required: Globally unique UUID that identifies a specific OIDC Connection. - `status` string, required: The status of the connection. The possible values are pending or active. See the [Update OIDC Connection endpoint](https://stytch.com/docs/b2b/api/update-oidc-connection) for more details. - `display_name` string, required: A human-readable display name for the connection. - `redirect_url` string, required: The callback URL for this OIDC connection. This value will be passed to the IdP to redirect the Member back to Stytch after a sign-in attempt. - `client_id` string, required: The OAuth2.0 client ID used to authenticate login attempts. This will be provided by the IdP. - `client_secret` string, required: The secret belonging to the OAuth2.0 client used to authenticate login attempts. This will be provided by the IdP. - `issuer` string, required: A case-sensitive `https://` URL that uniquely identifies the IdP. This will be provided by the IdP. - `authorization_url` string, required: The location of the URL that starts an OAuth login at the IdP. This will be provided by the IdP. - `token_url` string, required: The location of the URL that issues OAuth2.0 access tokens and OIDC ID tokens. This will be provided by the IdP. - `userinfo_url` string, required: The location of the IDP's [UserInfo Endpoint](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo). This will be provided by the IdP. - `jwks_url` string, required: The location of the IdP's JSON Web Key Set, used to verify credentials issued by the IdP. This will be provided by the IdP. - `identity_provider` string, required: Name of the IdP. Enum with possible values: `classlink`, `cyberark`, `duo`, `google-workspace`, `jumpcloud`, `keycloak`, `miniorange`, `microsoft-entra`, `okta`, `onelogin`, `pingfederate`, `rippling`, `salesforce`, `shibboleth`, or `generic`. Specifying a known provider allows Stytch to handle any provider-specific logic. - `custom_scopes` string, required: A space-separated list of custom scopes that will be requested on every SSOStart call. If set, this value will replace the default set of OIDC scopes requested: `openid email profile`. Additional scopes can be requested using the `custom_scopes` query parameter on individual SSOStart calls. - `attribute_mapping` object: An object that represents the attributes used to identify a Member. This object will map the IdP-defined User attributes to Stytch-specific values, which will appear on the member's Trusted Metadata. - `external_connections` ApiSsoV1Connection[], required: The list of [External Connections](https://stytch.com/docs/b2b/api/external-connection-object) owned by this organization. - `organization_id` string, required: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the organization_slug or organization_external_id here as a convenience. - `connection_id` string, required: Globally unique UUID that identifies a specific External SSO Connection. - `external_organization_id` string, required: Globally unique UUID that identifies a different Organization within your Project. - `external_connection_id` string, required: Globally unique UUID that identifies a specific SSO connection configured for a different Organization in your Project. - `display_name` string, required: A human-readable display name for the connection. - `status` string, required: The status of the connection. External connections are always active. - `external_connection_implicit_role_assignments` ApiSsoV1ConnectionImplicitRoleAssignment[], required: All Members who log in with this External connection will implicitly receive the specified Roles. See the [RBAC guide](https://stytch.com/docs/b2b/guides/rbac/role-assignment) for more information about role assignment. Implicit role assignments are not supported for External connections if the underlying SSO connection is an OIDC connection. - `role_id` string, required: The unique identifier of the RBAC Role, provided by the developer and intended to be human-readable. Reserved `role_id`s that are predefined by Stytch include: * `stytch_member` * `stytch_admin` Check out the [guide on Stytch default Roles](https://stytch.com/docs/b2b/guides/rbac/stytch-default) for a more detailed explanation. - `external_group_implicit_role_assignments` ApiSsoV1GroupImplicitRoleAssignment[], required: Defines the names of the groups that grant specific role assignments. For each group-Role pair, if a Member logs in with this external connection and belongs to the specified group, they will be granted the associated Role. See the [RBAC guide](https://stytch.com/docs/b2b/guides/rbac/role-assignment) for more information about role assignment. - `role_id` string, required - `group` string, required - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors. ## Other responses - `400`: Bad request - `401`: Unauthorized - `429`: Too Many Requests - `500`: Internal server error ## Changes - **2026-03-07** `110f26a94e5b`: 1 info - endpoint added - **2026-03-06** `9cab20b8eca7`: 1 breaking - api path removed without deprecation - **2026-01-09** `7dfcc14e566c`: 2 breaking - the `oidc_connections/items/attribute_mapping` response's property type changed from `string` to `object` for status `200` - the `saml_connections/items/attribute_mapping` response's property type changed from `string` to `object` for status `200` - **2025-10-20** `a4801149ed74`: 2 info - added the new optional `header` request parameter `X-Stytch-Member-Session` - added the new optional `header` request parameter `X-Stytch-Member-SessionJWT` - **2025-09-24** `d1a2040cf009`: 1 info - added the required property `saml_connections/items/allow_gateway_callback` to the response with the `200` status [Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/b2b/sso/:organization_id/get.md) --- [API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)