> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# On Organization Change

> Listen for changes to the Organization using the Stytch Next.js SDK

export const setting_0 = "View membership";

export const getBySlug_0 = undefined;

export const organization = "Represents an instance or tenant in your application, typically mapping to each of your top-level customers.";

export const member = "Represents an individual end user's account within a given Organization, uniquely identified within that Organization by their email address.";

export const isReact_0 = true

{isReact_0 &&
<Info>
  In React, use the <a href="../../hooks/use-stytch-organization"><code>useStytchOrganization</code></a> hook to easily access the Organization and react to changes.
</Info>
}

The Stytch SDK stores the <Tooltip tip={organization}>Organization</Tooltip> of the logged-in <Tooltip tip={member}>Member</Tooltip> in local storage. and will periodically refresh the cached data from the API.

Use the `organization.onChange` method to listen for and react to changes to the Organization object.

<Note>
  Before using this method, enable **{setting_0}** in the [Frontend SDK page](https://stytch.com/dashboard/sdk-configuration).
</Note>

If you need to asynchronously fetch guaranteed-fresh data from the API, use the [`organizations.get`](./get-organization) method.

## Parameters

<ResponseField name="callback" type="function">
  The callback function to call when the Organization changes.  The first parameter is the updated Organization object.

  <Expandable title="parameters">
    <ResponseField name="organization" type="object">
      The updated Organization object.

      <Expandable title="properties">
        <ResponseField name="organization_id" type="string">
          Globally unique UUID that identifies a specific Organization. The `organization_id` is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the `organization_slug` or `organization_external_id` here as a convenience.
        </ResponseField>

        <ResponseField name="organization_name" type="string">
          The name of the Organization. Must be between 1 and 128 characters in length.
        </ResponseField>

        <ResponseField name="organization_logo_url" type="string">
          The image URL of the Organization logo.
        </ResponseField>

        <ResponseField name="organization_slug" type="string">
          The unique URL slug of the Organization.

          The slug only accepts alphanumeric characters and the following reserved characters: `- . _ ~`. Must be between 2 and 128 characters in length.

          Wherever an `organization_id` is expected in a path or request parameter, you may also use the `organization_slug` as a convenience.
        </ResponseField>

        {!getBySlug_0 && (
                <ResponseField name="organization_external_id" type="string">
                A unique identifier for the Organization.
                </ResponseField>
                )}

        {!getBySlug_0 && (
                <ResponseField name="sso_jit_provisioning" type="string">
                The authentication setting that controls the JIT provisioning of Members when authenticating via SSO. The accepted values are:
                <ul>
                  <li><code>ALL_ALLOWED</code> – the default setting, new Members will be automatically provisioned upon successful authentication via any of the Organization's <code>sso_active_connections</code></li>
                  <li><code>RESTRICTED</code> – only new Members with SSO logins that comply with <code>sso_jit_provisioning_allowed_connections</code> can be provisioned upon authentication</li>
                  <li><code>NOT_ALLOWED</code> – disable JIT provisioning via SSO</li>
                </ul>
                </ResponseField>
                )}

        {!getBySlug_0 && (
                <ResponseField name="sso_jit_provisioning_allowed_connections" type="array[strings]">
                An array of <code>connection_ids</code> that reference <a href="/api-reference/b2b/api/sso/saml-connection-object">SAML Connection objects</a>. Only these
                connections will be allowed to JIT provision Members via SSO when <code>sso_jit_provisioning</code> is set to <code>RESTRICTED</code>.
                </ResponseField>
                )}

        <ResponseField name="sso_active_connections" type="array[objects]">
          An array of active [SAML Connection references](/api-reference/b2b/api/sso/saml-connection-object) or [OIDC Connection references](/api-reference/b2b/api/sso/oidc-connection-object).

          <Expandable title="sso_active_connections properties">
            <ResponseField name="connection_id" type="string">
              Globally unique UUID that identifies a specific SSO `connection_id` for a Member.
            </ResponseField>

            <ResponseField name="display_name" type="string">
              A human-readable display name for the connection.
            </ResponseField>
          </Expandable>
        </ResponseField>

        {!getBySlug_0 && (
                <ResponseField name="scim_active_connection" type="object">
                An active <a href="/api-reference/b2b/api/scim/overview">SCIM Connection references</a>.
                <Expandable title="scim_active_connection properties">
                  <ResponseField name="connection_id" type="string">
                    The ID of the SCIM connection.
                  </ResponseField>

                  <ResponseField name="display_name" type="string">
                    A human-readable display name for the connection.
                  </ResponseField>
                </Expandable>
                </ResponseField>
                )}

        <ResponseField name="email_allowed_domains" type="array[strings]">
          An array of email domains that allow invites or JIT provisioning for new Members. This list is enforced when either `email_invites` or `email_jit_provisioning` is set to `RESTRICTED`

          Common domains such as gmail.com are not allowed. See the [full list of disallowed common email domains](/multi-tenant-auth/enterprise-ready/org-management/jit-provision-members#by-email-domain).
        </ResponseField>

        <ResponseField name="email_jit_provisioning" type="string">
          The authentication setting that controls how a new Member can be provisioned by authenticating via Email Magic Link or OAuth. The accepted values are:

          * `RESTRICTED` – only new Members with verified emails that comply with `email_allowed_domains` can be provisioned upon authentication via Email Magic Link or OAuth
          * `NOT_ALLOWED` – the default setting, disables JIT provisioning via Email Magic Link and OAuth
        </ResponseField>

        {!getBySlug_0 && (
                <ResponseField name="email_invites" type="string">
                The authentication setting that controls how a new Member can be invited to an organization by email. The accepted values are:
                <ul>
                  <li><code>ALL_ALLOWED</code> – any new Member can be invited to join via email</li>
                  <li><code>RESTRICTED</code> – only new Members with verified emails that comply with <code>email_allowed_domains</code> can be invited via email</li>
                  <li><code>NOT_ALLOWED</code> – disable email invites</li>
                </ul>
                </ResponseField>
                )}

        <ResponseField name="auth_methods" type="string">
          The setting that controls which authentication methods can be used by Members of an Organization. The accepted values are:

          * `ALL_ALLOWED` – the default setting which allows all authentication methods to be used
          * `RESTRICTED` – only methods that comply with `allowed_auth_methods` can be used for authentication. This setting does not apply to Members with `is_breakglass` set to true
        </ResponseField>

        <ResponseField name="allowed_auth_methods" type="array[strings]">
          An array of allowed authentication methods. This list is enforced when `auth_methods` is set to `RESTRICTED`. The list's accepted values are: `sso`, `magic_link`, `email_otp`, `password`, `google_oauth`, `microsoft_oauth`, `slack_oauth`, `github_oauth`, and `hubspot_oauth`.
        </ResponseField>

        {!getBySlug_0 && (
                <ResponseField name="mfa_methods" type="string">
                The setting that controls which MFA methods can be used by Members of an Organization. The accepted values are:
                <ul>
                  <li><code>ALL_ALLOWED</code> – the default setting which allows all authentication methods to be used</li>
                  <li><code>RESTRICTED</code> – only methods that comply with <code>allowed_mfa_methods</code> can be used for authentication. This setting does not apply to Members with <code>is_breakglass</code> set to true</li>
                </ul>
                </ResponseField>
                )}

        {!getBySlug_0 && (
                <ResponseField name="allowed_mfa_methods" type="array[strings]">
                An array of allowed MFA authentication methods. This list is enforced when <code>mfa_methods</code> is set to <code>RESTRICTED</code>. The
                list's accepted values are: <code>sms_otp</code> and <code>totp</code>.
                </ResponseField>
                )}

        {!getBySlug_0 && (
                <ResponseField name="trusted_metadata" type="object">
                An arbitrary JSON object for storing application-specific data or identity-provider-specific data.
                </ResponseField>
                )}

        <ResponseField name="sso_default_connection_id" type="string">
          The default connection used for SSO when there are multiple active connections.
        </ResponseField>

        {!getBySlug_0 && (
                <ResponseField name="rbac_email_implicit_role_assignments" type="array[object]">
                Implicit role assignments based off of email domains. For each domain-Role pair, all Members whose email addresses have the specified email domain will be granted the associated Role, regardless of their login method. See the <a href="/multi-tenant-auth/enterprise-ready/rbac/assigning-roles-to-members">RBAC guide</a> for more information about role assignment.

                <Expandable title="rbac_email_implicit_role_assignments properties">
                  <ResponseField name="domain" type="string">
                    Email domain that grants the specified Role.
                  </ResponseField>

                  <ResponseField name="role_id" type="string">
                    The unique identifier of the RBAC Role, provided by the developer and intended to be human-readable.

                    Reserved <code>role_ids</code> that are predefined by Stytch include:
                    <ul>
                      <li><code>stytch_member</code></li>
                      <li><code>stytch_admin</code></li>
                    </ul>

                    Check out the <a href="/multi-tenant-auth/enterprise-ready/rbac/create-rbac-policy">guide on Stytch default Roles</a> for a more detailed explanation.
                  </ResponseField>
                </Expandable>
                </ResponseField>
                )}

        <ResponseField name="oauth_tenant_jit_provisioning" type="string">
          The authentication setting that controls how a new Member can JIT provision into an Organization by tenant. The accepted values are:

          * `RESTRICTED` – only new Members with tenants in `allowed_oauth_tenants` can JIT provision via tenant
          * `NOT_ALLOWED` – the default setting, disables JIT provisioning by OAuth Tenant
        </ResponseField>

        <ResponseField name="allowed_oauth_tenants" type="object">
          A map of allowed OAuth tenants. If this field is not passed in, the Organization will not allow JIT provisioning by OAuth Tenant. Allowed keys are "slack", "hubspot", and "github".
        </ResponseField>

        {!getBySlug_0 && (
                <ResponseField name="first_party_connected_apps_allowed_type" type="string">
                The authentication setting that sets the Organization's policy towards first party Connected Apps. The accepted values are:
                <ul>
                  <li><code>ALL_ALLOWED</code> – the default setting, any first party Connected App in the Project is permitted for use by Members</li>
                  <li><code>RESTRICTED</code> – only first party Connected Apps with IDs in <code>allowed_first_party_connected_apps</code> can be used by Members</li>
                  <li><code>NOT_ALLOWED</code> – no first party Connected Apps are permitted</li>
                </ul>
                </ResponseField>
                )}

        {!getBySlug_0 && (
                <ResponseField name="allowed_first_party_connected_apps" type="array[strings]">
                An array of first party Connected App IDs that are allowed for the Organization. Only used when the Organization's <code>first_party_connected_apps_allowed_type</code> is <code>RESTRICTED</code>.
                </ResponseField>
                )}

        {!getBySlug_0 && (
                <ResponseField name="third_party_connected_apps_allowed_type" type="string">
                The authentication setting that sets the Organization's policy towards third party Connected Apps. The accepted values are:
                <ul>
                  <li><code>ALL_ALLOWED</code> – the default setting, any third party Connected App in the Project is permitted for use by Members</li>
                  <li><code>RESTRICTED</code> – only third party Connected Apps with IDs in <code>allowed_third_party_connected_apps</code> can be used by Members</li>
                  <li><code>NOT_ALLOWED</code> – no third party Connected Apps are permitted</li>
                </ul>
                </ResponseField>
                )}

        {!getBySlug_0 && (
                <ResponseField name="allowed_third_party_connected_apps" type="array[strings]">
                An array of third party Connected App IDs that are allowed for the Organization. Only used when the Organization's <code>third_party_connected_apps_allowed_type</code> is <code>RESTRICTED</code>.
                </ResponseField>
                )}

        {!getBySlug_0 && (
                <ResponseField name="created_at" type="string">
                The timestamp of the Organization's creation. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. <code>2021-12-29T12:33:09Z</code>.
                </ResponseField>
                )}

        {!getBySlug_0 && (
                <ResponseField name="updated_at" type="string">
                The timestamp of when the Organization was last updated. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. <code>2021-12-29T12:33:09Z</code>.
                </ResponseField>
                )}
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

## Return value

<ResponseField name="unsubscribe" type="function">
  The function to call to unsubscribe from the Organization change event.
</ResponseField>

<Panel>
  <RequestExample>
    ```jsx theme={null}
    import { useEffect, useState } from 'react';
    import { useStytchB2BClient } from '@stytch/nextjs/b2b';

    export const OrganizationDisplay = () => {
      const stytch = useStytchB2BClient();
      const [organization, setOrganization] = useState(null);

      useEffect(() => {
        // Subscribe to organization changes
        const unsubscribe = stytch.organization.onChange((org) => {
          setOrganization(org);
        });

        // Cleanup subscription on unmount
        return unsubscribe;
      }, [stytch]);

      return (
        <div>
          {organization ? (
            <p>Organization: {organization.organization_name}</p>
          ) : (
            <p>No organization found</p>
          )}
        </div>
      );
    };
    ```
  </RequestExample>

  <ResponseExample>
    ```json theme={null}
    {
      "email_allowed_domains": [],
      "email_invites": "ALL_ALLOWED",
      "email_jit_provisioning": "NOT_ALLOWED",
      "mfa_policy": "OPTIONAL",
      "organization_id": "organization-test-07971b06-ac8b-4cdb-9c15-63b17e653931",
      "organization_logo_url": "",
      "organization_name": "Example Org Inc",
      "organization_slug": "exampleorg",
      "organization_external_id": "example-org-external-id",
      "sso_default_connection_id": null,
      "sso_jit_provisioning": "ALL_ALLOWED",
      "sso_jit_provisioning_allowed_connections": [],
      "sso_active_connections": [],
      "scim_active_connection": null,
      "trusted_metadata": {},
      "oauth_tenant_jit_provisioning": "RESTRICTED",
      "allowed_oauth_tenants": {
        "slack": ["T1234"],
        "hubspot": ["Hub2345", "Hub3456"]
      }
    }
    ```
  </ResponseExample>
</Panel>