Stytch API

Stytch API

API version: 1.0.0

Auth

Bearer basic

Base URL

https://api.stytch.com

Setup

1. Set Authorization header with your Bearer token
2. GET /v1/sessions -- verify access
3. POST /v1/connected_apps/clients/search -- create first search

Endpoints

184 endpoints across 21 groups. See references/api-spec.lap for full details.

connected_apps

b2b

users

sessions

rbac

crypto_wallets

debug

fingerprint

rules

verdict_reasons

email

idp

impersonation

m2m

magic_links

passwords

oauth

otps

projects

totps

webauthn

Common Questions

Match user requests to endpoints in references/api-spec.lap. Key patterns:

• "Get client details?" -> GET /v1/connected_apps/clients/{client_id}
• "Update a client?" -> PUT /v1/connected_apps/clients/{client_id}
• "Delete a client?" -> DELETE /v1/connected_apps/clients/{client_id}
• "Create a search?" -> POST /v1/connected_apps/clients/search
• "Create a client?" -> POST /v1/connected_apps/clients
• "Create a start?" -> POST /v1/connected_apps/clients/{client_id}/secrets/rotate/start
• "Create a cancel?" -> POST /v1/connected_apps/clients/{client_id}/secrets/rotate/cancel
• "Create a rotate?" -> POST /v1/connected_apps/clients/{client_id}/secrets/rotate
• "Update a connection?" -> PUT /v1/b2b/scim/{organization_id}/connection/{connection_id}
• "Delete a connection?" -> DELETE /v1/b2b/scim/{organization_id}/connection/{connection_id}
• "Get connection details?" -> GET /v1/b2b/scim/{organization_id}/connection/{connection_id}
• "Create a start?" -> POST /v1/b2b/scim/{organization_id}/connection/{connection_id}/rotate/start
• "Create a complete?" -> POST /v1/b2b/scim/{organization_id}/connection/{connection_id}/rotate/complete
• "Create a cancel?" -> POST /v1/b2b/scim/{organization_id}/connection/{connection_id}/rotate/cancel
• "Create a connection?" -> POST /v1/b2b/scim/{organization_id}/connection
• "List all connection?" -> GET /v1/b2b/scim/{organization_id}/connection
• "Create a organization?" -> POST /v1/b2b/organizations
• "Get organization details?" -> GET /v1/b2b/organizations/{organization_id}
• "Update a organization?" -> PUT /v1/b2b/organizations/{organization_id}
• "Delete a organization?" -> DELETE /v1/b2b/organizations/{organization_id}
• "Create a search?" -> POST /v1/b2b/organizations/search
• "List all metrics?" -> GET /v1/b2b/organizations/{organization_id}/metrics
• "List all connected_apps?" -> GET /v1/b2b/organizations/{organization_id}/connected_apps
• "Get connected_app details?" -> GET /v1/b2b/organizations/{organization_id}/connected_apps/{connected_app_id}
• "Update a member?" -> PUT /v1/b2b/organizations/{organization_id}/members/{member_id}
• "Delete a member?" -> DELETE /v1/b2b/organizations/{organization_id}/members/{member_id}
• "Delete a mfa_phone_number?" -> DELETE /v1/b2b/organizations/{organization_id}/members/mfa_phone_numbers/{member_id}
• "Create a search?" -> POST /v1/b2b/organizations/members/search
• "Delete a password?" -> DELETE /v1/b2b/organizations/{organization_id}/members/passwords/{member_password_id}
• "Get dangerously_get details?" -> GET /v1/b2b/organizations/members/dangerously_get/{member_id}
• "List all oidc_providers?" -> GET /v1/b2b/organizations/{organization_id}/members/{member_id}/oidc_providers
• "Create a unlink_retired_email?" -> POST /v1/b2b/organizations/{organization_id}/members/{member_id}/unlink_retired_email
• "Create a start_email_update?" -> POST /v1/b2b/organizations/{organization_id}/members/{member_id}/start_email_update
• "List all connected_apps?" -> GET /v1/b2b/organizations/{organization_id}/members/{member_id}/connected_apps
• "Create a member?" -> POST /v1/b2b/organizations/{organization_id}/members
• "List all member?" -> GET /v1/b2b/organizations/{organization_id}/member
• "List all google?" -> GET /v1/b2b/organizations/{organization_id}/members/{member_id}/oauth_providers/google
• "List all microsoft?" -> GET /v1/b2b/organizations/{organization_id}/members/{member_id}/oauth_providers/microsoft
• "List all slack?" -> GET /v1/b2b/organizations/{organization_id}/members/{member_id}/oauth_providers/slack
• "List all hubspot?" -> GET /v1/b2b/organizations/{organization_id}/members/{member_id}/oauth_providers/hubspot
• "List all github?" -> GET /v1/b2b/organizations/{organization_id}/members/{member_id}/oauth_providers/github
• "Create a revoke?" -> POST /v1/b2b/organizations/{organization_id}/members/{member_id}/connected_apps/{connected_app_id}/revoke
• "Create a start?" -> POST /v1/b2b/idp/oauth/authorize/start
• "Create a authorize?" -> POST /v1/b2b/idp/oauth/authorize
• "Create a user?" -> POST /v1/users
• "Get user details?" -> GET /v1/users/{user_id}
• "Update a user?" -> PUT /v1/users/{user_id}
• "Delete a user?" -> DELETE /v1/users/{user_id}
• "Create a search?" -> POST /v1/users/search
• "Delete a email?" -> DELETE /v1/users/emails/{email_id}
• "Delete a phone_number?" -> DELETE /v1/users/phone_numbers/{phone_id}
• "Delete a webauthn_registration?" -> DELETE /v1/users/webauthn_registrations/{webauthn_registration_id}
• "Delete a biometric_registration?" -> DELETE /v1/users/biometric_registrations/{biometric_registration_id}
• "Delete a totp?" -> DELETE /v1/users/totps/{totp_id}
• "Delete a crypto_wallet?" -> DELETE /v1/users/crypto_wallets/{crypto_wallet_id}
• "Delete a password?" -> DELETE /v1/users/passwords/{password_id}
• "Delete a oauth?" -> DELETE /v1/users/oauth/{oauth_user_registration_id}
• "List all connected_apps?" -> GET /v1/users/{user_id}/connected_apps
• "Create a revoke?" -> POST /v1/users/{user_id}/connected_apps/{connected_app_id}/revoke
• "List all sessions?" -> GET /v1/sessions
• "Create a authenticate?" -> POST /v1/sessions/authenticate
• "Create a revoke?" -> POST /v1/sessions/revoke
• "Create a migrate?" -> POST /v1/sessions/migrate
• "Create a exchange_access_token?" -> POST /v1/sessions/exchange_access_token
• "Get jwk details?" -> GET /v1/sessions/jwks/{project_id}
• "Create a attest?" -> POST /v1/sessions/attest
• "List all sessions?" -> GET /v1/b2b/sessions
• "Create a authenticate?" -> POST /v1/b2b/sessions/authenticate
• "Create a revoke?" -> POST /v1/b2b/sessions/revoke
• "Create a exchange?" -> POST /v1/b2b/sessions/exchange
• "Create a exchange_access_token?" -> POST /v1/b2b/sessions/exchange_access_token
• "Create a attest?" -> POST /v1/b2b/sessions/attest
• "Create a migrate?" -> POST /v1/b2b/sessions/migrate
• "Get jwk details?" -> GET /v1/b2b/sessions/jwks/{project_id}
• "Create a authenticate?" -> POST /v1/b2b/impersonation/authenticate
• "List all policy?" -> GET /v1/b2b/rbac/policy
• "Get organization details?" -> GET /v1/b2b/rbac/organizations/{organization_id}
• "Update a organization?" -> PUT /v1/b2b/rbac/organizations/{organization_id}
• "Create a recover?" -> POST /v1/b2b/recovery_codes/recover
• "Get recovery_code details?" -> GET /v1/b2b/recovery_codes/{organization_id}/{member_id}
• "Create a rotate?" -> POST /v1/b2b/recovery_codes/rotate
• "Create a totp?" -> POST /v1/b2b/totp
• "Create a authenticate?" -> POST /v1/b2b/totp/authenticate
• "Create a migrate?" -> POST /v1/b2b/totp/migrate
• "List all policy?" -> GET /v1/rbac/policy
• "Create a start?" -> POST /v1/crypto_wallets/authenticate/start
• "Create a authenticate?" -> POST /v1/crypto_wallets/authenticate
• "List all whoami?" -> GET /v1/debug/whoami
• "Create a exchange?" -> POST /v1/b2b/discovery/intermediate_sessions/exchange
• "Create a create?" -> POST /v1/b2b/discovery/organizations/create
• "Create a organization?" -> POST /v1/b2b/discovery/organizations
• "Create a lookup?" -> POST /v1/fingerprint/lookup
• "Create a set?" -> POST /v1/rules/set
• "Create a list?" -> POST /v1/rules/list
• "Create a override?" -> POST /v1/verdict_reasons/override
• "Create a list?" -> POST /v1/verdict_reasons/list
• "Create a risk?" -> POST /v1/email/risk
• "Create a start?" -> POST /v1/idp/oauth/authorize/start
• "Create a authorize?" -> POST /v1/idp/oauth/authorize
• "Create a authenticate?" -> POST /v1/impersonation/authenticate
• "Get client details?" -> GET /v1/m2m/clients/{client_id}
• "Update a client?" -> PUT /v1/m2m/clients/{client_id}
• "Delete a client?" -> DELETE /v1/m2m/clients/{client_id}
• "Create a search?" -> POST /v1/m2m/clients/search
• "Create a client?" -> POST /v1/m2m/clients
• "Create a start?" -> POST /v1/m2m/clients/{client_id}/secrets/rotate/start
• "Create a cancel?" -> POST /v1/m2m/clients/{client_id}/secrets/rotate/cancel
• "Create a rotate?" -> POST /v1/m2m/clients/{client_id}/secrets/rotate
• "Create a authenticate?" -> POST /v1/magic_links/authenticate
• "Create a magic_link?" -> POST /v1/magic_links
• "Create a send?" -> POST /v1/magic_links/email/send
• "Create a login_or_create?" -> POST /v1/magic_links/email/login_or_create
• "Create a invite?" -> POST /v1/magic_links/email/invite
• "Create a revoke_invite?" -> POST /v1/magic_links/email/revoke_invite
• "Create a authenticate?" -> POST /v1/b2b/magic_links/authenticate
• "Create a login_or_signup?" -> POST /v1/b2b/magic_links/email/login_or_signup
• "Create a invite?" -> POST /v1/b2b/magic_links/email/invite
• "Create a send?" -> POST /v1/b2b/magic_links/email/discovery/send
• "Create a authenticate?" -> POST /v1/b2b/magic_links/discovery/authenticate
• "Create a authenticate?" -> POST /v1/b2b/oauth/authenticate
• "Create a authenticate?" -> POST /v1/b2b/oauth/discovery/authenticate
• "Create a send?" -> POST /v1/b2b/otps/sms/send
• "Create a authenticate?" -> POST /v1/b2b/otps/sms/authenticate
• "Create a login_or_signup?" -> POST /v1/b2b/otps/email/login_or_signup
• "Create a authenticate?" -> POST /v1/b2b/otps/email/authenticate
• "Create a send?" -> POST /v1/b2b/otps/email/discovery/send
• "Create a authenticate?" -> POST /v1/b2b/otps/email/discovery/authenticate
• "Create a password?" -> POST /v1/passwords
• "Create a authenticate?" -> POST /v1/passwords/authenticate
• "Create a strength_check?" -> POST /v1/passwords/strength_check
• "Create a migrate?" -> POST /v1/passwords/migrate
• "Create a start?" -> POST /v1/passwords/email/reset/start
• "Create a reset?" -> POST /v1/passwords/email/reset
• "Create a reset?" -> POST /v1/passwords/existing_password/reset
• "Create a reset?" -> POST /v1/passwords/session/reset
• "Create a strength_check?" -> POST /v1/b2b/passwords/strength_check
• "Create a migrate?" -> POST /v1/b2b/passwords/migrate
• "Create a authenticate?" -> POST /v1/b2b/passwords/authenticate
• "Create a start?" -> POST /v1/b2b/passwords/email/reset/start
• "Create a reset?" -> POST /v1/b2b/passwords/email/reset
• "Create a require_reset?" -> POST /v1/b2b/passwords/email/require_reset
• "Create a reset?" -> POST /v1/b2b/passwords/session/reset
• "Create a reset?" -> POST /v1/b2b/passwords/existing_password/reset
• "Create a authenticate?" -> POST /v1/b2b/passwords/discovery/authenticate
• "Create a start?" -> POST /v1/b2b/passwords/discovery/email/reset/start
• "Create a reset?" -> POST /v1/b2b/passwords/discovery/email/reset
• "Create a attach?" -> POST /v1/oauth/attach
• "Create a authenticate?" -> POST /v1/oauth/authenticate
• "Create a authenticate?" -> POST /v1/otps/authenticate
• "Create a send?" -> POST /v1/otps/sms/send
• "Create a login_or_create?" -> POST /v1/otps/sms/login_or_create
• "Create a send?" -> POST /v1/otps/whatsapp/send
• "Create a login_or_create?" -> POST /v1/otps/whatsapp/login_or_create
• "Create a send?" -> POST /v1/otps/email/send
• "Create a login_or_create?" -> POST /v1/otps/email/login_or_create
• "List all metrics?" -> GET /v1/projects/metrics
• "Get sso details?" -> GET /v1/b2b/sso/{organization_id}
• "Delete a connection?" -> DELETE /v1/b2b/sso/{organization_id}/connections/{connection_id}
• "Create a authenticate?" -> POST /v1/b2b/sso/authenticate
• "Update a connection?" -> PUT /v1/b2b/sso/oidc/{organization_id}/connections/{connection_id}
• "Update a connection?" -> PUT /v1/b2b/sso/saml/{organization_id}/connections/{connection_id}
• "Delete a verification_certificate?" -> DELETE /v1/b2b/sso/saml/{organization_id}/connections/{connection_id}/verification_certificates/{certificate_id}
• "Delete a encryption_private_key?" -> DELETE /v1/b2b/sso/saml/{organization_id}/connections/{connection_id}/encryption_private_keys/{private_key_id}
• "Update a connection?" -> PUT /v1/b2b/sso/external/{organization_id}/connections/{connection_id}
• "Create a totp?" -> POST /v1/totps
• "Create a authenticate?" -> POST /v1/totps/authenticate
• "Create a recovery_code?" -> POST /v1/totps/recovery_codes
• "Create a recover?" -> POST /v1/totps/recover
• "Create a start?" -> POST /v1/webauthn/register/start
• "Create a register?" -> POST /v1/webauthn/register
• "Create a start?" -> POST /v1/webauthn/authenticate/start
• "Create a authenticate?" -> POST /v1/webauthn/authenticate
• "Update a webauthn?" -> PUT /v1/webauthn/{webauthn_registration_id}
• "Get credential details?" -> GET /v1/webauthn/credentials/{user_id}/{domain}
• "How to authenticate?" -> See Auth section

Response Tips

• Check response schemas in references/api-spec.lap for field details
• List endpoints may support pagination; check for limit, offset, or cursor params
• Create/update endpoints typically return the created/updated object

References

• Full spec: See references/api-spec.lap for complete endpoint details, parameter tables, and response schemas

Generated from the official API spec by LAP