> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Organization Sync

> Retrieve Organization details from cache using the Stytch Next.js SDK

export const setting_0 = "View membership";

export const getBySlug_0 = undefined;

export const organization = "Represents an instance or tenant in your application, typically mapping to each of your top-level customers.";

export const member = "Represents an individual end user's account within a given Organization, uniquely identified within that Organization by their email address.";

export const isReact_0 = true

{isReact_0 &&
<Info>
  In React, use the <a href="../../hooks/use-stytch-organization"><code>useStytchOrganization</code></a> hook to easily access the Organization and react to changes.
</Info>
}

The Stytch SDK stores the <Tooltip tip={organization}>Organization</Tooltip> of the logged-in <Tooltip tip={member}>Member</Tooltip> in local storage.  `organizations.getSync` is a synchronous method that fetches the cached data from local storage.

<Note>
  Before using this method, enable **{setting_0}** in the [Frontend SDK page](https://stytch.com/dashboard/sdk-configuration).
</Note>

If there is no cached data, this method will return `null`.

If you need to asynchronously fetch guaranteed-fresh data from the API, use the [`organizations.get`](./get-organization) method.

## Response

<ResponseField name="organization_id" type="string">
  Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the `organization_slug` or `organization_external_id` here as a convenience.
</ResponseField>

<ResponseField name="organization_name" type="string">
  The name of the Organization. Must be between 1 and 128 characters in length.
</ResponseField>

<ResponseField name="organization_logo_url" type="string">
  The image URL of the Organization logo.
</ResponseField>

<ResponseField name="organization_slug" type="string">
  The unique URL slug of the Organization.

  The slug only accepts alphanumeric characters and the following reserved characters: `- . _ ~`. Must be between 2 and 128 characters in length.

  Wherever an `organization_id` is expected in a path or request parameter, you may also use the `organization_slug` as a convenience.
</ResponseField>

{!getBySlug_0 && (
<ResponseField name="organization_external_id" type="string">
A unique identifier for the Organization.
</ResponseField>
)}

{!getBySlug_0 && (
<ResponseField name="sso_jit_provisioning" type="string">
The authentication setting that controls the JIT provisioning of Members when authenticating via SSO. The accepted values are:
<ul>
  <li><code>ALL_ALLOWED</code> – the default setting, new Members will be automatically provisioned upon successful authentication via any of the Organization's <code>sso_active_connections</code></li>
  <li><code>RESTRICTED</code> – only new Members with SSO logins that comply with <code>sso_jit_provisioning_allowed_connections</code> can be provisioned upon authentication</li>
  <li><code>NOT_ALLOWED</code> – disable JIT provisioning via SSO</li>
</ul>
</ResponseField>
)}

{!getBySlug_0 && (
<ResponseField name="sso_jit_provisioning_allowed_connections" type="array[strings]">
An array of <code>connection_ids</code> that reference <a href="/api-reference/b2b/api/sso/saml-connection-object">SAML Connection objects</a>. Only these
connections will be allowed to JIT provision Members via SSO when <code>sso_jit_provisioning</code> is set to <code>RESTRICTED</code>.
</ResponseField>
)}

<ResponseField name="sso_active_connections" type="array[objects]">
  An array of active [SAML Connection references](/api-reference/b2b/api/sso/saml-connection-object) or [OIDC Connection references](/api-reference/b2b/api/sso/oidc-connection-object).

  <Expandable title="sso_active_connections properties">
    <ResponseField name="connection_id" type="string">
      Globally unique UUID that identifies a specific SSO `connection_id` for a Member.
    </ResponseField>

    <ResponseField name="display_name" type="string">
      A human-readable display name for the connection.
    </ResponseField>
  </Expandable>
</ResponseField>

{!getBySlug_0 && (
<ResponseField name="scim_active_connection" type="object">
An active <a href="/api-reference/b2b/api/scim/overview">SCIM Connection references</a>.
<Expandable title="scim_active_connection properties">
  <ResponseField name="connection_id" type="string">
    The ID of the SCIM connection.
  </ResponseField>

  <ResponseField name="display_name" type="string">
    A human-readable display name for the connection.
  </ResponseField>
</Expandable>
</ResponseField>
)}

<ResponseField name="email_allowed_domains" type="array[strings]">
  An array of email domains that allow invites or JIT provisioning for new Members. This list is enforced when either `email_invites` or `email_jit_provisioning` is set to `RESTRICTED`

  Common domains such as gmail.com are not allowed. See the [full list of disallowed common email domains](/multi-tenant-auth/enterprise-ready/org-management/jit-provision-members#by-email-domain).
</ResponseField>

<ResponseField name="email_jit_provisioning" type="string">
  The authentication setting that controls how a new Member can be provisioned by authenticating via Email Magic Link or OAuth. The accepted values are:

  * `RESTRICTED` – only new Members with verified emails that comply with `email_allowed_domains` can be provisioned upon authentication via Email Magic Link or OAuth
  * `NOT_ALLOWED` – the default setting, disables JIT provisioning via Email Magic Link and OAuth
</ResponseField>

{!getBySlug_0 && (
<ResponseField name="email_invites" type="string">
The authentication setting that controls how a new Member can be invited to an organization by email. The accepted values are:
<ul>
  <li><code>ALL_ALLOWED</code> – any new Member can be invited to join via email</li>
  <li><code>RESTRICTED</code> – only new Members with verified emails that comply with <code>email_allowed_domains</code> can be invited via email</li>
  <li><code>NOT_ALLOWED</code> – disable email invites</li>
</ul>
</ResponseField>
)}

<ResponseField name="auth_methods" type="string">
  The setting that controls which authentication methods can be used by Members of an Organization. The accepted values are:

  * `ALL_ALLOWED` – the default setting which allows all authentication methods to be used
  * `RESTRICTED` – only methods that comply with `allowed_auth_methods` can be used for authentication. This setting does not apply to Members with `is_breakglass` set to true
</ResponseField>

<ResponseField name="allowed_auth_methods" type="array[strings]">
  An array of allowed authentication methods. This list is enforced when `auth_methods` is set to `RESTRICTED`. The list's accepted values are: `sso`, `magic_link`, `email_otp`, `password`, `google_oauth`, `microsoft_oauth`, `slack_oauth`, `github_oauth`, and `hubspot_oauth`.
</ResponseField>

{!getBySlug_0 && (
<ResponseField name="mfa_methods" type="string">
The setting that controls which MFA methods can be used by Members of an Organization. The accepted values are:
<ul>
  <li><code>ALL_ALLOWED</code> – the default setting which allows all authentication methods to be used</li>
  <li><code>RESTRICTED</code> – only methods that comply with <code>allowed_mfa_methods</code> can be used for authentication. This setting does not apply to Members with <code>is_breakglass</code> set to true</li>
</ul>
</ResponseField>
)}

{!getBySlug_0 && (
<ResponseField name="allowed_mfa_methods" type="array[strings]">
An array of allowed MFA authentication methods. This list is enforced when <code>mfa_methods</code> is set to <code>RESTRICTED</code>. The
list's accepted values are: <code>sms_otp</code> and <code>totp</code>.
</ResponseField>
)}

{!getBySlug_0 && (
<ResponseField name="trusted_metadata" type="object">
An arbitrary JSON object for storing application-specific data or identity-provider-specific data.
</ResponseField>
)}

<ResponseField name="sso_default_connection_id" type="string">
  The default connection used for SSO when there are multiple active connections.
</ResponseField>

{!getBySlug_0 && (
<ResponseField name="rbac_email_implicit_role_assignments" type="array[object]">
Implicit role assignments based off of email domains. For each domain-Role pair, all Members whose email addresses have the specified email domain will be granted the associated Role, regardless of their login method. See the <a href="/multi-tenant-auth/enterprise-ready/rbac/assigning-roles-to-members">RBAC guide</a> for more information about role assignment.

<Expandable title="rbac_email_implicit_role_assignments properties">
  <ResponseField name="domain" type="string">
    Email domain that grants the specified Role.
  </ResponseField>

  <ResponseField name="role_id" type="string">
    The unique identifier of the RBAC Role, provided by the developer and intended to be human-readable.

    Reserved <code>role_ids</code> that are predefined by Stytch include:
    <ul>
      <li><code>stytch_member</code></li>
      <li><code>stytch_admin</code></li>
    </ul>

    Check out the <a href="/multi-tenant-auth/enterprise-ready/rbac/create-rbac-policy">guide on Stytch default Roles</a> for a more detailed explanation.
  </ResponseField>
</Expandable>
</ResponseField>
)}

<ResponseField name="oauth_tenant_jit_provisioning" type="string">
  The authentication setting that controls how a new Member can JIT provision into an Organization by tenant. The accepted values are:

  * `RESTRICTED` – only new Members with tenants in `allowed_oauth_tenants` can JIT provision via tenant
  * `NOT_ALLOWED` – the default setting, disables JIT provisioning by OAuth Tenant
</ResponseField>

<ResponseField name="allowed_oauth_tenants" type="object">
  A map of allowed OAuth tenants. If this field is not passed in, the Organization will not allow JIT provisioning by OAuth Tenant. Allowed keys are "slack", "hubspot", and "github".
</ResponseField>

{!getBySlug_0 && (
<ResponseField name="first_party_connected_apps_allowed_type" type="string">
The authentication setting that sets the Organization's policy towards first party Connected Apps. The accepted values are:
<ul>
  <li><code>ALL_ALLOWED</code> – the default setting, any first party Connected App in the Project is permitted for use by Members</li>
  <li><code>RESTRICTED</code> – only first party Connected Apps with IDs in <code>allowed_first_party_connected_apps</code> can be used by Members</li>
  <li><code>NOT_ALLOWED</code> – no first party Connected Apps are permitted</li>
</ul>
</ResponseField>
)}

{!getBySlug_0 && (
<ResponseField name="allowed_first_party_connected_apps" type="array[strings]">
An array of first party Connected App IDs that are allowed for the Organization. Only used when the Organization's <code>first_party_connected_apps_allowed_type</code> is <code>RESTRICTED</code>.
</ResponseField>
)}

{!getBySlug_0 && (
<ResponseField name="third_party_connected_apps_allowed_type" type="string">
The authentication setting that sets the Organization's policy towards third party Connected Apps. The accepted values are:
<ul>
  <li><code>ALL_ALLOWED</code> – the default setting, any third party Connected App in the Project is permitted for use by Members</li>
  <li><code>RESTRICTED</code> – only third party Connected Apps with IDs in <code>allowed_third_party_connected_apps</code> can be used by Members</li>
  <li><code>NOT_ALLOWED</code> – no third party Connected Apps are permitted</li>
</ul>
</ResponseField>
)}

{!getBySlug_0 && (
<ResponseField name="allowed_third_party_connected_apps" type="array[strings]">
An array of third party Connected App IDs that are allowed for the Organization. Only used when the Organization's <code>third_party_connected_apps_allowed_type</code> is <code>RESTRICTED</code>.
</ResponseField>
)}

{!getBySlug_0 && (
<ResponseField name="created_at" type="string">
The timestamp of the Organization's creation. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. <code>2021-12-29T12:33:09Z</code>.
</ResponseField>
)}

{!getBySlug_0 && (
<ResponseField name="updated_at" type="string">
The timestamp of when the Organization was last updated. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. <code>2021-12-29T12:33:09Z</code>.
</ResponseField>
)}

<Panel>
  <RequestExample>
    ```jsx theme={null}
    import { useStytchB2BClient } from '@stytch/nextjs/b2b';

    export const OrganizationDisplay = () => {
      const stytch = useStytchB2BClient();

      // Get cached organization data synchronously
      const organization = stytch.organization.getSync();

      return (
        <div>
          {organization ? (
            <p>Organization: {organization.organization_name}</p>
          ) : (
            <p>No organization found</p>
          )}
        </div>
      );
    };
    ```
  </RequestExample>

  <ResponseExample>
    ```json theme={null}
    {
      "email_allowed_domains": [],
      "email_invites": "ALL_ALLOWED",
      "email_jit_provisioning": "NOT_ALLOWED",
      "mfa_policy": "OPTIONAL",
      "organization_id": "organization-test-07971b06-ac8b-4cdb-9c15-63b17e653931",
      "organization_logo_url": "",
      "organization_name": "Example Org Inc",
      "organization_slug": "exampleorg",
      "organization_external_id": "example-org-external-id",
      "sso_default_connection_id": null,
      "sso_jit_provisioning": "ALL_ALLOWED",
      "sso_jit_provisioning_allowed_connections": [],
      "sso_active_connections": [],
      "scim_active_connection": null,
      "trusted_metadata": {},
      "oauth_tenant_jit_provisioning": "RESTRICTED",
      "allowed_oauth_tenants": {
        "slack": ["T1234"],
        "hubspot": ["Hub2345", "Hub3456"]
      }
    }
    ```
  </ResponseExample>
</Panel>