> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Update OIDC Connection

> Update an OIDC SSO connection using the Stytch Vanilla JS SDK

export const action_0 = "update";

export const resource_0 = "stytch.sso";

export const organization = "Represents an instance or tenant in your application, typically mapping to each of your top-level customers.";

export const member = "Represents an individual end user's account within a given Organization, uniquely identified within that Organization by their email address.";

`sso.oidc.updateConnection` wraps the [Update OIDC Connection](/docs/api-reference/b2b/api/sso/oidc/update-oidc-connection) API endpoint. The `organization_id` will be automatically inferred from the logged-in <Tooltip tip={member}>Member's</Tooltip> session. This method cannot be used to update OIDC connections in other <Tooltip tip={organization}>Organizations</Tooltip>.

When the value of issuer changes, Stytch will attempt to retrieve the [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1%5F0.html#ProviderMetadata) document found at `${issuer}/.well-known/openid-configuration`. If the metadata document can be retrieved successfully, Stytch will use it to infer the values of `authorization_url`, `token_url`, `jwks_url`, and `userinfo_url`. The `client_id` and `client_secret` values cannot be inferred from the metadata document, and **must** be passed in explicitly.

If the metadata document cannot be retrieved, Stytch will still update the connection using values from the request body.

If the metadata document can be retrieved, and values are passed in the request body, the explicit values passed in from the request body will take precedence over the values inferred from the metadata document.

Note that a newly created connection will not become active until all of the following fields are provided:

* `issuer`
* `client_id`
* `client_secret`
* `authorization_url`
* `token_url`
* `userinfo_url`
* `jwks_url`

<Note>
  **RBAC Enforced Method**

  This method requires a valid Session for a member with permission to perform the **{action_0} Action** on the **{resource_0} Resource**.

  Before using this method, enable **Member actions & organization modifications** in the [Frontend SDK page](https://stytch.com/dashboard/sdk-configuration). To learn more, see our [RBAC guide](/docs/multi-tenant-auth/enterprise-ready/rbac/create-rbac-policy).
</Note>

## Parameters

<ParamField path="connection_id" type="string" required>
  Globally unique UUID that identifies a specific SSO `connection_id` for a Member.
</ParamField>

<ParamField path="identity_provider" type="string" required>
  Name of the IdP. Enum with possible values: `classlink`, `cyberark`, `duo`, `google-workspace`, `jumpcloud`, `keycloak`, `miniorange`, `microsoft-entra`, `okta`, `onelogin`, `pingfederate`, `rippling`, `salesforce`, `shibboleth`, or `generic`.

  Specifying a known provider allows Stytch to handle any provider-specific logic.
</ParamField>

<ParamField path="display_name" type="string" required>
  A human-readable display name for the connection.
</ParamField>

<ParamField path="issuer" type="string" required>
  A case-sensitive `https://` URL that **must** uniquely identify the IdP. This will be provided by the IdP.
</ParamField>

<ParamField path="client_id" type="string" required>
  The OAuth2.0 client ID used to authenticate login attempts. This will be provided by the IdP.
</ParamField>

<ParamField path="client_secret" type="string" required>
  The secret belonging to the OAuth2.0 client used to authenticate login attempts. This will be provided by the IdP.
</ParamField>

<ParamField path="authorization_url" type="string" required>
  The location of the URL that starts an OAuth login at the IdP. This will be provided by the IdP.
</ParamField>

<ParamField path="token_url" type="string" required>
  The location of the URL that issues OAuth2.0 access tokens and OIDC ID tokens. This will be provided by the IdP.
</ParamField>

<ParamField path="userinfo_url" type="string" required>
  The location of the IDP's [UserInfo Endpoint](https://openid.net/specs/openid-connect-core-1%5F0.html#UserInfo). This will be provided by the IdP.
</ParamField>

<ParamField path="jwks_url" type="string" required>
  The location of the IdP's JSON Web Key Set, used to verify credentials issued by the IdP. This will be provided by the IdP.
</ParamField>

## Response

<ResponseField name="connection" type="object">
  The [OIDC Connection object](/docs/api-reference/b2b/api/sso/oidc-connection-object) updated by this API call.
</ResponseField>

<ResponseField name="request_id" type="string">
  Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we
  may ask for this value to help identify a specific API call when helping you debug an issue.
</ResponseField>

<ResponseField name="status_code" type="number">
  The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values
  equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
</ResponseField>

<Panel>
  <RequestExample>
    ```javascript theme={null}
    import { StytchB2BClient } from '@stytch/vanilla-js/b2b';

    const stytch = new StytchB2BClient('public-token-test-b8c84de4-7d58-4ffc-9341-432b56596862');

    // Update OIDC connection
    const updateConnection = async () => {
      const response = await stytch.sso.oidc.updateConnection({
        connection_id: 'oidc-connection-test-d89ff7a0-e86f-4b4d-b6a3-9a74d967528e',
        display_name: 'Updated OIDC Connection',
        identity_provider: 'okta',
        issuer: 'https://example.okta.com',
        client_id: 'client-id-from-idp',
        client_secret: 'client-secret-from-idp',
      });
      console.log('Updated connection:', response.connection);
    };

    updateConnection();
    ```
  </RequestExample>
</Panel>