---
title: "Createconnection"
method: POST
path: "/v1/b2b/sso/oidc/{organization_id}"
tags: ["Sso"]
---

# Createconnection

`POST /v1/b2b/sso/oidc/{organization_id}`

## Request

- Base URL: `https://api.stytch.com`
- URL: `https://api.stytch.com/v1/b2b/sso/oidc/{organization_id}`
- Auth: HTTP basic

Create a new OIDC Connection.

## Path parameters

- `organization_id` string, required: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the organization_slug or organization_external_id here as a convenience.

## Headers

- `X-Stytch-Member-Session` string
- `X-Stytch-Member-SessionJWT` string

## Request body

- ApiSsoV1SsoOidcCreateConnectionRequest: Request type
  - `display_name` string: A human-readable display name for the connection.
  - `identity_provider` 'classlink' | 'cyberark' | 'duo' | 'generic' | 'google-workspace' | 'jumpcloud' | 'keycloak' | 'miniorange' | 'microsoft-entra' | 'okta' | 'onelogin' | 'pingfederate' | 'rippling' | 'salesforce' | 'shibboleth'

## Response `200`

Successful response

- ApiSsoV1SsoOidcCreateConnectionResponse
  - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
  - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
  - `connection` ApiSsoV1OIDCConnection
    - `organization_id` string, required: Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the organization_slug or organization_external_id here as a convenience.
    - `connection_id` string, required: Globally unique UUID that identifies a specific OIDC Connection.
    - `status` string, required: The status of the connection. The possible values are pending or active. See the [Update OIDC Connection endpoint](https://stytch.com/docs/b2b/api/update-oidc-connection) for more details.
    - `display_name` string, required: A human-readable display name for the connection.
    - `redirect_url` string, required: The callback URL for this OIDC connection. This value will be passed to the IdP to redirect the Member back to Stytch after a sign-in attempt.
    - `client_id` string, required: The OAuth2.0 client ID used to authenticate login attempts. This will be provided by the IdP.
    - `client_secret` string, required: The secret belonging to the OAuth2.0 client used to authenticate login attempts. This will be provided by the IdP.
    - `issuer` string, required: A case-sensitive `https://` URL that uniquely identifies the IdP. This will be provided by the IdP.
    - `authorization_url` string, required: The location of the URL that starts an OAuth login at the IdP. This will be provided by the IdP.
    - `token_url` string, required: The location of the URL that issues OAuth2.0 access tokens and OIDC ID tokens. This will be provided by the IdP.
    - `userinfo_url` string, required: The location of the IDP's [UserInfo Endpoint](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo). This will be provided by the IdP.
    - `jwks_url` string, required: The location of the IdP's JSON Web Key Set, used to verify credentials issued by the IdP. This will be provided by the IdP.
    - `identity_provider` string, required: Name of the IdP. Enum with possible values: `classlink`, `cyberark`, `duo`, `google-workspace`, `jumpcloud`, `keycloak`, `miniorange`, `microsoft-entra`, `okta`, `onelogin`, `pingfederate`, `rippling`, `salesforce`, `shibboleth`, or `generic`. Specifying a known provider allows Stytch to handle any provider-specific logic.
    - `custom_scopes` string, required: A space-separated list of custom scopes that will be requested on every SSOStart call. If set, this value will replace the default set of OIDC scopes requested: `openid email profile`. Additional scopes can be requested using the `custom_scopes` query parameter on individual SSOStart calls.
    - `attribute_mapping` object: An object that represents the attributes used to identify a Member. This object will map the IdP-defined User attributes to Stytch-specific values, which will appear on the member's Trusted Metadata.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `429`: Too Many Requests
- `500`: Internal server error

## Changes

- **2026-03-07** `110f26a94e5b`: 1 info
  - endpoint added
- **2026-03-06** `9cab20b8eca7`: 1 breaking
  - api path removed without deprecation
- **2026-01-09** `7dfcc14e566c`: 1 breaking, 1 warning
  - the `connection/attribute_mapping` response's property type changed from `string` to `object` for status `200`
  - removed the request property `organization_id`
- **2025-11-03** `b2acbf387799`: 1 breaking
  - added the new required request property `organization_id`
- **2025-10-24** `69e827881158`: 1 warning
  - removed the request property `organization_id`

[Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/b2b/sso/oidc/:organization_id/post.md)

---

[API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)