> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# useStytchOrganization Hook

> Get the current Organization using the Stytch Next.js SDK

export const getBySlug_0 = undefined;

export const member = "Represents an individual end user's account within a given Organization, uniquely identified within that Organization by their email address.";

export const organization = "Represents an instance or tenant in your application, typically mapping to each of your top-level customers.";

export const isReactNative_0 = undefined

To get the <Tooltip tip={organization}>Organization</Tooltip> of the currently signed in <Tooltip tip={member}>Member</Tooltip>, use the `useStytchOrganization` hook.

If the user is not signed in, the `organization` object will be `null`.

{!isReactNative_0 && <>If this hook will possibly be rendered in a server environment, use the <code>isInitialized</code> property to determine if the SDK has completed initialization before using the organization data.</>}

In non-React environments, use the [`organization.getSync`](../methods/organizations/get-organization-sync) method to get the Organization.

## Return Value

<ResponseField name="organization" type="object | null">
  The Organization of the currently signed in Member.

  <Expandable title="properties">
    <ResponseField name="organization_id" type="string">
      Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the `organization_slug` or `organization_external_id` here as a convenience.
    </ResponseField>

    <ResponseField name="organization_name" type="string">
      The name of the Organization. Must be between 1 and 128 characters in length.
    </ResponseField>

    <ResponseField name="organization_logo_url" type="string">
      The image URL of the Organization logo.
    </ResponseField>

    <ResponseField name="organization_slug" type="string">
      The unique URL slug of the Organization.

      The slug only accepts alphanumeric characters and the following reserved characters: `- . _ ~`. Must be between 2 and 128 characters in length.

      Wherever an `organization_id` is expected in a path or request parameter, you may also use the `organization_slug` as a convenience.
    </ResponseField>

    {!getBySlug_0 && (
        <ResponseField name="organization_external_id" type="string">
        A unique identifier for the Organization.
        </ResponseField>
        )}

    {!getBySlug_0 && (
        <ResponseField name="sso_jit_provisioning" type="string">
        The authentication setting that controls the JIT provisioning of Members when authenticating via SSO. The accepted values are:
        <ul>
          <li><code>ALL_ALLOWED</code> – the default setting, new Members will be automatically provisioned upon successful authentication via any of the Organization's <code>sso_active_connections</code></li>
          <li><code>RESTRICTED</code> – only new Members with SSO logins that comply with <code>sso_jit_provisioning_allowed_connections</code> can be provisioned upon authentication</li>
          <li><code>NOT_ALLOWED</code> – disable JIT provisioning via SSO</li>
        </ul>
        </ResponseField>
        )}

    {!getBySlug_0 && (
        <ResponseField name="sso_jit_provisioning_allowed_connections" type="array[strings]">
        An array of <code>connection_ids</code> that reference <a href="/api-reference/b2b/api/sso/saml-connection-object">SAML Connection objects</a>. Only these
        connections will be allowed to JIT provision Members via SSO when <code>sso_jit_provisioning</code> is set to <code>RESTRICTED</code>.
        </ResponseField>
        )}

    <ResponseField name="sso_active_connections" type="array[objects]">
      An array of active [SAML Connection references](/api-reference/b2b/api/sso/saml-connection-object) or [OIDC Connection references](/api-reference/b2b/api/sso/oidc-connection-object).

      <Expandable title="sso_active_connections properties">
        <ResponseField name="connection_id" type="string">
          Globally unique UUID that identifies a specific SSO `connection_id` for a Member.
        </ResponseField>

        <ResponseField name="display_name" type="string">
          A human-readable display name for the connection.
        </ResponseField>
      </Expandable>
    </ResponseField>

    {!getBySlug_0 && (
        <ResponseField name="scim_active_connection" type="object">
        An active <a href="/api-reference/b2b/api/scim/overview">SCIM Connection references</a>.
        <Expandable title="scim_active_connection properties">
          <ResponseField name="connection_id" type="string">
            The ID of the SCIM connection.
          </ResponseField>

          <ResponseField name="display_name" type="string">
            A human-readable display name for the connection.
          </ResponseField>
        </Expandable>
        </ResponseField>
        )}

    <ResponseField name="email_allowed_domains" type="array[strings]">
      An array of email domains that allow invites or JIT provisioning for new Members. This list is enforced when either `email_invites` or `email_jit_provisioning` is set to `RESTRICTED`

      Common domains such as gmail.com are not allowed. See the [full list of disallowed common email domains](/multi-tenant-auth/enterprise-ready/org-management/jit-provision-members#by-email-domain).
    </ResponseField>

    <ResponseField name="email_jit_provisioning" type="string">
      The authentication setting that controls how a new Member can be provisioned by authenticating via Email Magic Link or OAuth. The accepted values are:

      * `RESTRICTED` – only new Members with verified emails that comply with `email_allowed_domains` can be provisioned upon authentication via Email Magic Link or OAuth
      * `NOT_ALLOWED` – the default setting, disables JIT provisioning via Email Magic Link and OAuth
    </ResponseField>

    {!getBySlug_0 && (
        <ResponseField name="email_invites" type="string">
        The authentication setting that controls how a new Member can be invited to an organization by email. The accepted values are:
        <ul>
          <li><code>ALL_ALLOWED</code> – any new Member can be invited to join via email</li>
          <li><code>RESTRICTED</code> – only new Members with verified emails that comply with <code>email_allowed_domains</code> can be invited via email</li>
          <li><code>NOT_ALLOWED</code> – disable email invites</li>
        </ul>
        </ResponseField>
        )}

    <ResponseField name="auth_methods" type="string">
      The setting that controls which authentication methods can be used by Members of an Organization. The accepted values are:

      * `ALL_ALLOWED` – the default setting which allows all authentication methods to be used
      * `RESTRICTED` – only methods that comply with `allowed_auth_methods` can be used for authentication. This setting does not apply to Members with `is_breakglass` set to true
    </ResponseField>

    <ResponseField name="allowed_auth_methods" type="array[strings]">
      An array of allowed authentication methods. This list is enforced when `auth_methods` is set to `RESTRICTED`. The list's accepted values are: `sso`, `magic_link`, `email_otp`, `password`, `google_oauth`, `microsoft_oauth`, `slack_oauth`, `github_oauth`, and `hubspot_oauth`.
    </ResponseField>

    {!getBySlug_0 && (
        <ResponseField name="mfa_methods" type="string">
        The setting that controls which MFA methods can be used by Members of an Organization. The accepted values are:
        <ul>
          <li><code>ALL_ALLOWED</code> – the default setting which allows all authentication methods to be used</li>
          <li><code>RESTRICTED</code> – only methods that comply with <code>allowed_mfa_methods</code> can be used for authentication. This setting does not apply to Members with <code>is_breakglass</code> set to true</li>
        </ul>
        </ResponseField>
        )}

    {!getBySlug_0 && (
        <ResponseField name="allowed_mfa_methods" type="array[strings]">
        An array of allowed MFA authentication methods. This list is enforced when <code>mfa_methods</code> is set to <code>RESTRICTED</code>. The
        list's accepted values are: <code>sms_otp</code> and <code>totp</code>.
        </ResponseField>
        )}

    {!getBySlug_0 && (
        <ResponseField name="trusted_metadata" type="object">
        An arbitrary JSON object for storing application-specific data or identity-provider-specific data.
        </ResponseField>
        )}

    <ResponseField name="sso_default_connection_id" type="string">
      The default connection used for SSO when there are multiple active connections.
    </ResponseField>

    {!getBySlug_0 && (
        <ResponseField name="rbac_email_implicit_role_assignments" type="array[object]">
        Implicit role assignments based off of email domains. For each domain-Role pair, all Members whose email addresses have the specified email domain will be granted the associated Role, regardless of their login method. See the <a href="/multi-tenant-auth/enterprise-ready/rbac/assigning-roles-to-members">RBAC guide</a> for more information about role assignment.

        <Expandable title="rbac_email_implicit_role_assignments properties">
          <ResponseField name="domain" type="string">
            Email domain that grants the specified Role.
          </ResponseField>

          <ResponseField name="role_id" type="string">
            The unique identifier of the RBAC Role, provided by the developer and intended to be human-readable.

            Reserved <code>role_ids</code> that are predefined by Stytch include:
            <ul>
              <li><code>stytch_member</code></li>
              <li><code>stytch_admin</code></li>
            </ul>

            Check out the <a href="/multi-tenant-auth/enterprise-ready/rbac/create-rbac-policy">guide on Stytch default Roles</a> for a more detailed explanation.
          </ResponseField>
        </Expandable>
        </ResponseField>
        )}

    <ResponseField name="oauth_tenant_jit_provisioning" type="string">
      The authentication setting that controls how a new Member can JIT provision into an Organization by tenant. The accepted values are:

      * `RESTRICTED` – only new Members with tenants in `allowed_oauth_tenants` can JIT provision via tenant
      * `NOT_ALLOWED` – the default setting, disables JIT provisioning by OAuth Tenant
    </ResponseField>

    <ResponseField name="allowed_oauth_tenants" type="object">
      A map of allowed OAuth tenants. If this field is not passed in, the Organization will not allow JIT provisioning by OAuth Tenant. Allowed keys are "slack", "hubspot", and "github".
    </ResponseField>

    {!getBySlug_0 && (
        <ResponseField name="first_party_connected_apps_allowed_type" type="string">
        The authentication setting that sets the Organization's policy towards first party Connected Apps. The accepted values are:
        <ul>
          <li><code>ALL_ALLOWED</code> – the default setting, any first party Connected App in the Project is permitted for use by Members</li>
          <li><code>RESTRICTED</code> – only first party Connected Apps with IDs in <code>allowed_first_party_connected_apps</code> can be used by Members</li>
          <li><code>NOT_ALLOWED</code> – no first party Connected Apps are permitted</li>
        </ul>
        </ResponseField>
        )}

    {!getBySlug_0 && (
        <ResponseField name="allowed_first_party_connected_apps" type="array[strings]">
        An array of first party Connected App IDs that are allowed for the Organization. Only used when the Organization's <code>first_party_connected_apps_allowed_type</code> is <code>RESTRICTED</code>.
        </ResponseField>
        )}

    {!getBySlug_0 && (
        <ResponseField name="third_party_connected_apps_allowed_type" type="string">
        The authentication setting that sets the Organization's policy towards third party Connected Apps. The accepted values are:
        <ul>
          <li><code>ALL_ALLOWED</code> – the default setting, any third party Connected App in the Project is permitted for use by Members</li>
          <li><code>RESTRICTED</code> – only third party Connected Apps with IDs in <code>allowed_third_party_connected_apps</code> can be used by Members</li>
          <li><code>NOT_ALLOWED</code> – no third party Connected Apps are permitted</li>
        </ul>
        </ResponseField>
        )}

    {!getBySlug_0 && (
        <ResponseField name="allowed_third_party_connected_apps" type="array[strings]">
        An array of third party Connected App IDs that are allowed for the Organization. Only used when the Organization's <code>third_party_connected_apps_allowed_type</code> is <code>RESTRICTED</code>.
        </ResponseField>
        )}

    {!getBySlug_0 && (
        <ResponseField name="created_at" type="string">
        The timestamp of the Organization's creation. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. <code>2021-12-29T12:33:09Z</code>.
        </ResponseField>
        )}

    {!getBySlug_0 && (
        <ResponseField name="updated_at" type="string">
        The timestamp of when the Organization was last updated. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. <code>2021-12-29T12:33:09Z</code>.
        </ResponseField>
        )}
  </Expandable>
</ResponseField>

{!isReactNative_0 && (
<ResponseField name="isInitialized" type="boolean">
  Whether the SDK has completed initialization.
</ResponseField>
)}

<ResponseField name="fromCache" type="boolean">
  Whether the Organization data is from persistent storage.
</ResponseField>

<Panel>
  <RequestExample>
    ```jsx Next.js theme={null}
    import { useStytchOrganization } from '@stytch/nextjs/b2b';

    export const Home = () => {
      const { organization, isInitialized } = useStytchOrganization();

      if (!isInitialized) {
        return <p>Loading...</p>;
      }

      return organization
        ? <p>Welcome to {organization.organization_name}</p>
        : <p>Log in to continue!</p>;
    };
    ```
  </RequestExample>

  <ResponseExample>
    ```json Logged in theme={null}
    {
      "organization": { ... },
      "isInitialized": true,
      "fromCache": false
    }
    ```

    ```json Not initialized theme={null}
    {
      "organization": null,
      "isInitialized": false,
      "fromCache": false
    }
    ```

    ```json Logged out theme={null}
    {
      "organization": null,
      "isInitialized": true,
      "fromCache": false
    }
    ```
  </ResponseExample>
</Panel>