Globally unique UUID that identifies a specific Organization. The organization_id is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the organization_slug or organization_external_id here as a convenience.
SAML Connection object
Fields
organization_id string
connection_id string
Globally unique UUID that identifies a specific SAML Connection.
display_name string
A human-readable display name for the connection.
acs_url string
The URL of the Assertion Consumer Service. This value will be passed to the IdP to redirect the Member back to Stytch after a sign-in attempt. Read our SAML Overview for more info.
audience_uri string
The URL of the Audience Restriction. This value will indicate that Stytch is the intended audience of an assertion. Read our SAML Overview for more info.
attribute_mapping object
An object that represents the attributes used to identify a Member. This object will map the IdP-defined User attributes to Stytch-specific values. Required attributes: email and one of full_name or first_name and last_name.
email* string
The key that will be sent by the IdP to indicate the member's email. If your IdP is configured to have email as its Name ID format, you should use NameID for the value here.
full_name string
The key that will be sent by the IdP to indicate the member's full name.
groups string
The key that will be sent by the IdP to indicate the member's group memberships. This field is required if you would like to use SAML group implicit role assignments.
idp_user_id string
The ID of the member in the IdP. This is optional, but recommended, as it provides us with a stable identifier that can be used to correctly identify the Member and log them into their existing account after an IdP-driven email update.
idp_entity_id string
A globally unique name for the IdP. This will be provided by the IdP.
alternative_audience_uri string
An alternative URL to use for the Audience Restriction. This value can be used when you wish to migrate an existing SAML integration to Stytch with zero downtime. Read our SSO migration guide for more info.
alternative_acs_url string
An alternative URL to use for the AssertionConsumerServiceURL in SP initiated SAML AuthNRequests. This value can be used when you wish to migrate an existing SAML integration to Stytch with zero downtime. Note that you will be responsible for proxying requests sent to the Alternative ACS URL to Stytch. Read our SSO migration guide for more info.
nameid_format string
The NameID format the SAML Connection expects to use. Defaults to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.
idp_sso_url string
The URL for which assertions for login requests will be sent. This will be provided by the IdP.
signing_certificates array
A list of X.509 certificates Stytch will use to sign its assertion requests. Certificates should be uploaded to the IdP.
certificate string
The certificate, in PEM format.
created_at string
A timestamp that indicates when the certificate was created.
updated_at string
A timestamp that indicates when the certificate was updated.
expires_at string
A timestamp that indicates when the certificate will expire.
certificate_id string
The ID of the certificate.
issuer string
The issuer of the certificate. For signing certificates, this value will be "Stytch".
verification_certificates array
A list of X.509 certificates Stytch will use to validate an assertion callback. Certificates should be populated from the IdP.
certificate string
The certificate, in PEM format.
created_at string
A timestamp that indicates when the certificate was created.
updated_at string
A timestamp that indicates when the certificate was updated.
expires_at string
A timestamp that indicates when the certificate will expire.
certificate_id string
The ID of the certificate.
issuer string
The issuer of the certificate. For signing certificates, this value will be "Stytch".
saml_connection_implicit_role_assignments array[object]
All Members who log in with this SAML connection will implicitly receive the specified Roles. See the RBAC guide for more information about role assignment.
role_id string
The unique identifier of the RBAC Role, provided by the developer and intended to be human-readable.
Reserved role_ids that are predefined by Stytch include:
- stytch_member
- stytch_admin
Check out the guide on Stytch default Roles for a more detailed explanation.
saml_group_implicit_role_assignments array[object]
Defines the names of the SAML groups that grant specific role assignments. For each group-Role pair, if a Member logs in with this SAML connection and belongs to the specified SAML group, they will be granted the associated Role. See the RBAC guide for more information about role assignment.
group string
The name of the group that grants the specified role assignment.
role_id string
The unique identifier of the RBAC Role, provided by the developer and intended to be human-readable.
Reserved role_ids that are predefined by Stytch include:
- stytch_member
- stytch_admin
Check out the guide on Stytch default Roles for a more detailed explanation.
identity_provider string
Name of the IdP. Enum with possible values: classlink, cyberark, duo, google-workspace, jumpcloud, keycloak, miniorange, microsoft-entra, okta, onelogin, pingfederate, rippling, salesforce, shibboleth, or generic.
Specifying a known provider allows Stytch to handle any provider-specific logic.
idp_initiated_auth_disabled boolean
Determines whether IDP initiated auth is allowed for a given SAML connection. Defaults to false (IDP Initiated Auth is enabled).
status string
The status of the connection. The possible values are pending or active. See the Update SAML Connection endpoint for more details.
OBJECT 200
{
"connection": {
"acs_url": "https://test.stytch.com/v1/b2b/sso/callback/saml-connection-test-51861cbc-d3b9-428b-9761-227f5fb12be9",
"alternative_acs_url": "",
"attribute_mapping": {
"email": "email",
"full_name": "name",
"groups": "groups",
},
"audience_uri": "https://test.stytch.com/v1/b2b/sso/callback/saml-connection-test-51861cbc-d3b9-428b-9761-227f5fb12be9",
"alternative_audience_uri": "",
"connection_id": "saml-connection-test-51861cbc-d3b9-428b-9761-227f5fb12be9",
"display_name": "Example SAML Connection",
"idp_entity_id": "https://idp.example.com/51861cbc-d3b9-428b-9761-227f5fb12be9",
"idp_sso_url": "https://idp.example.com/51861cbc-d3b9-428b-9761-227f5fb12be9/sso/saml",
"nameid_format": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
"organization_id": "organization-test-07971b06-ac8b-4cdb-9c15-63b17e653931",
"saml_connection_implicit_role_assignments": [
{
"role_id": "admin"
}
],
"saml_group_implicit_role_assignments": [
{
"role_id": "editor",
"group": "editors"
},
{
"role_id": "reader",
"group": "readers"
}
],
"signing_certificates": [
{
"certificate": "-----BEGIN CERTIFICATE-----\n...base64 blob...\n-----END CERTIFICATE",
"created_at": "2023-01-01T00:00:00Z",
"expires_at": "2033-01-01T00:00:00Z",
"id": "",
"issuer": "Stytch"
}
],
"status": "active",
"identity_provider": "generic",
"verification_certificates": [
{
"certificate": "-----BEGIN CERTIFICATE-----\n...base64 blob...\n-----END CERTIFICATE",
"created_at": "2023-01-01T00:00:00Z",
"expires_at": "2033-01-01T00:00:00Z",
"id": "saml-verification-key-test-5ccbc642-9373-42b8-928f-c1646c868701",
"issuer": ""
}
],
"idp_initiated_auth_disabled": false
},
}