Skip to main content

Documentation Index

Fetch the complete documentation index at: https://stytch.com/docs/llms.txt

Use this file to discover all available pages before exploring further.

An Organization must always have at least one auth setting that allows new Members to be created and join. As a result, sso_jit_provisioning, email_jit_provisioning, and email_invites cannot all be simultaneously set to NOT_ALLOWED. If no Organization authentication parameters are passed in, email_invites defaults to ALL_ALLOWED allowing the Organization to add Members. If some authentication parameters are passed but email_invites is omitted, it defaults to NOT_ALLOWED. Additionally, the following rules apply:

​
Allowed Auth Methods

  • If allowed_auth_methods is empty
    • then auth_methods cannot be set to RESTRICTED.
  • If allowed_auth_methods is not empty
    • and auth_methods is set to RESTRICTED, then all members looking to authenticate will be required to use one of these auth methods.
  • If allowed_auth_methods is updated
    • then the entire list will be overwritten by the new values.
    • then all currently active Members will remain active even if their auth methods no longer comply with allowed_auth_methods. However, the member will not be able to authenticate with the disallowed methods.
    • and auth_methods is set to RESTRICTED, then auth_methods cannot be set to an empty array.

​
Allowed MFA Methods

  • If allowed_mfa_methods is empty
    • then mfa_methods cannot be set to RESTRICTED.
  • If allowed_mfa_methods is not empty
    • and mfa_methods is set to RESTRICTED, then all members looking to authenticate with MFA will be required to use one of these MFA methods.
  • If allowed_mfa_methods is updated
    • then the entire list will be overwritten by the new values.
    • then all currently active Members will remain active even if their MFA methods no longer comply with allowed_mfa_methods. However, the member will not be able to MFA authenticate with the disallowed methods.
    • and mfa_methods is set to RESTRICTED, then mfa_methods cannot be set to an empty array.
  • If email_allowed_domains is empty
    • then email_invites cannot be set to RESTRICTED.
    • then email_jit_provisioning cannot be set to RESTRICTED.
  • If email_allowed_domains is not empty
    • and email_invites is set to RESTRICTED, then all new Members must have an email address that complies with email_allowed_domains in order to be invited by email.
    • and email_invites is set to ALL_ALLOWED, then any new Member can be invited to email.
    • and email_invites is set to NOT_ALLOWED, then email invites are disabled.
  • If email_allowed_domains is not empty
    • and email_jit_provisioning is set to RESTRICTED, then all new Members must have an email address that complies with email_allowed_domains in order to be provisioned via Email Magic Links.
    • and email_jit_provisioning is set to ALL_ALLOWED, then any new Member can be provisioned via Email Magic Links.
    • and email_jit_provisioning is set to NOT_ALLOWED, then JIT provisioning via Email Magic Links is disabled.
  • If email_allowed_domains is updated
    • then the entire list will be overwritten by the new value.
    • then all Members will remain active even if their email_address no longer complies with email_allowed_domains.
    • and either email_invites or email_jit_provisioning is set to RESTRICTED, then email_allowed_domains cannot be set to an empty array.

​
Single Sign On

  • If sso_jit_provisioning_allowed_connections is empty
    • then sso_jit_provisioning cannot be set to RESTRICTED.
  • If sso_jit_provisioning_allowed_connections is not empty
    • and sso_jit_provisioning is set to RESTRICTED, then all new Members must have an SSO login that complies with sso_jit_provisioning_allowed_connections in order to be provisioned via SSO.
    • and sso_jit_provisioning is set to ALL_ALLOWED, then all new Members will be automatically provisioned via any of the Organization’s sso_active_connections.
    • and sso_jit_provisioning is set to NOT_ALLOWED, then JIT provisioning via SSO is disabled.
  • If sso_jit_provisioning_allowed_connections is updated
    • then the entire list will be overwritten by the new value.
    • then all currently active Members will remain active even if their sso_registrations no longer complies with sso_jit_provisioning_allowed_connections.
    • and sso_jit_provisioning is set to RESTRICTED, then sso_jit_provisioning_allowed_connections cannot be set to an empty array.