---
title: "Createconnection"
method: POST
path: "/v1/b2b/sso/external/{organization_id}"
tags: ["Sso"]
---

# Createconnection

`POST /v1/b2b/sso/external/{organization_id}`

## Request

- Base URL: `https://api.stytch.com`
- URL: `https://api.stytch.com/v1/b2b/sso/external/{organization_id}`
- Auth: HTTP basic

Create a new External SSO Connection.

## Path parameters

- `organization_id` string, required: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the organization_slug or organization_external_id here as a convenience.

## Headers

- `X-Stytch-Member-Session` string
- `X-Stytch-Member-SessionJWT` string

## Request body

- ApiSsoV1SsoExternalCreateConnectionRequest: Request type
  - `external_organization_id` string, required: Globally unique UUID that identifies a different Organization within your Project.
  - `external_connection_id` string, required: Globally unique UUID that identifies a specific SSO connection configured for a different Organization in your Project.
  - `display_name` string: A human-readable display name for the connection.
  - `connection_implicit_role_assignments` ApiSsoV1SAMLConnectionImplicitRoleAssignment[]
    - `role_id` string, required: The unique identifier of the RBAC Role, provided by the developer and intended to be human-readable. Reserved `role_id`s that are predefined by Stytch include: * `stytch_member` * `stytch_admin` Check out the [guide on Stytch default Roles](https://stytch.com/docs/b2b/guides/rbac/stytch-default) for a more detailed explanation.
  - `group_implicit_role_assignments` ApiSsoV1SAMLGroupImplicitRoleAssignment[]
    - `role_id` string, required
    - `group` string, required

## Response `200`

Successful response

- ApiSsoV1SsoExternalCreateConnectionResponse
  - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
  - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
  - `connection` ApiSsoV1Connection
    - `organization_id` string, required: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the organization_slug or organization_external_id here as a convenience.
    - `connection_id` string, required: Globally unique UUID that identifies a specific External SSO Connection.
    - `external_organization_id` string, required: Globally unique UUID that identifies a different Organization within your Project.
    - `external_connection_id` string, required: Globally unique UUID that identifies a specific SSO connection configured for a different Organization in your Project.
    - `display_name` string, required: A human-readable display name for the connection.
    - `status` string, required: The status of the connection. External connections are always active.
    - `external_connection_implicit_role_assignments` ApiSsoV1ConnectionImplicitRoleAssignment[], required: All Members who log in with this External connection will implicitly receive the specified Roles. See the [RBAC guide](https://stytch.com/docs/b2b/guides/rbac/role-assignment) for more information about role assignment. Implicit role assignments are not supported for External connections if the underlying SSO connection is an OIDC connection.
      - `role_id` string, required: The unique identifier of the RBAC Role, provided by the developer and intended to be human-readable. Reserved `role_id`s that are predefined by Stytch include: * `stytch_member` * `stytch_admin` Check out the [guide on Stytch default Roles](https://stytch.com/docs/b2b/guides/rbac/stytch-default) for a more detailed explanation.
    - `external_group_implicit_role_assignments` ApiSsoV1GroupImplicitRoleAssignment[], required: Defines the names of the groups that grant specific role assignments. For each group-Role pair, if a Member logs in with this external connection and belongs to the specified group, they will be granted the associated Role. See the [RBAC guide](https://stytch.com/docs/b2b/guides/rbac/role-assignment) for more information about role assignment.
      - `role_id` string, required
      - `group` string, required

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `429`: Too Many Requests
- `500`: Internal server error

## Changes

- **2026-03-07** `110f26a94e5b`: 1 info
  - endpoint added
- **2026-03-06** `9cab20b8eca7`: 1 breaking
  - api path removed without deprecation
- **2026-01-09** `7dfcc14e566c`: 1 warning
  - removed the request property `organization_id`
- **2025-11-03** `b2acbf387799`: 1 breaking
  - added the new required request property `organization_id`
- **2025-10-24** `69e827881158`: 1 warning
  - removed the request property `organization_id`

[Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/b2b/sso/external/:organization_id/post.md)

---

[API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)