Tenants
Overview
A FusionAuth Tenant is a named object that represents a discrete namespace for Users, Applications and Groups. A user is unique by email address or username within a tenant.
Tenants may be useful to support a multi-tenant application where you wish to use a single instance of FusionAuth but require the ability to have duplicate users across the tenants in your own application. In this scenario a user may exist multiple times with the same email address and different passwords across tenants.
Tenants may also be useful in a test or staging environment to allow multiple users to call APIs and create and modify users without possibility of collision.
The following APIs are provided to manage Tenants.
The following APIs provide a subset of the Tenant configuration without an API Key.
Create a Tenant
This API is used to create a new Tenant.
Request
Request Parameters
tenantId
UUIDDefaults to secure random UUIDThe Id to use for the new Tenant. If not specified a secure random UUID will be generated.
Request Body
tenant.accessControlConfiguration.uiIPAccessControlListId
UUIDAvailable since 1.30.0The Id of the IP Access Control List limiting access to all applications in this tenant.
Note: An Enterprise plan is required to utilize IP ACLs.
tenant.captchaConfiguration.captchaMethod
StringAvailable since 1.30.0The type of CAPTCHA method to use. This field is required when tenant.captchaConfiguration.enabled is set to true
. The possible values are:
GoogleRecaptchaV2
- use Google reCAPTCHA v2GoogleRecaptchaV3
- use Google reCAPTCHA v3HCaptcha
- use HCaptchaHCaptchaEnterprise
- use HCaptcha Enterprise - v25
Note: An Enterprise plan is required to utilize CAPTCHA.
tenant.captchaConfiguration.enabled
BooleanDefaults to falseAvailable since 1.30.0Whether CAPTCHA configuration is enabled.
Note: An Enterprise plan is required to utilize CAPTCHA.
tenant.captchaConfiguration.secretKey
StringAvailable since 1.30.0The secret key for this CAPTCHA method. This field is required when tenant.captchaConfiguration.enabled is set to true
.
Note: An Enterprise plan is required to utilize CAPTCHA.
tenant.captchaConfiguration.siteKey
StringAvailable since 1.30.0The site key for this CAPTCHA method. This field is required when tenant.captchaConfiguration.enabled is set to true
.
Note: An Enterprise plan is required to utilize CAPTCHA.
tenant.captchaConfiguration.threshold
FloatAvailable since 1.30.0The numeric threshold which separates a passing score from a failing one. This value only applies if using either the Google v3 or HCaptcha Enterprise method, otherwise this value is ignored.
The value must be between 0.0
and 1.0
. Values outside of that range will result in an error.
Note: An Enterprise plan is required to utilize CAPTCHA.
tenant.connectorPolicies
ArrayAvailable since 1.18.0A list of Connector policies. Users will be authenticated against Connectors in order. Each Connector can be included in this list at most once and must exist.
tenant.connectorPolicies[x].connectorId
UUIDAvailable since 1.18.0The identifier of the Connector to which this policy refers.
tenant.connectorPolicies[x].domains
Array<String>Available since 1.18.0An list of email domains to which this connector should apply.
A value of ["*"]
indicates this connector applies to all users.
tenant.connectorPolicies[x].migrate
BooleanDefaults to falseAvailable since 1.18.0If true, the user’s data will be migrated to FusionAuth at first successful authentication; subsequent authentications will occur against the FusionAuth datastore. If false, the Connector’s source will be treated as authoritative.
Prior to version 1.28.0
this value was required.
tenant.data
ObjectAn object that can hold any information about the Tenant that should be persisted.
tenant.emailConfiguration.additionalHeaders
Array<Object>Available since 1.32.0The additional SMTP headers to be added to each outgoing email. Each SMTP header consists of a name and a value.
tenant.emailConfiguration.debug
BooleanDefaults to falseAvailable since 1.37.0Determines if debug should be enabled to create an event log to assist in debugging SMTP errors.
tenant.emailConfiguration.defaultFromEmail
StringAvailable since 1.16.0The default email address that emails will be sent from when a from address is not provided on an individual email template. This is the address part email address (i.e. Jared Dunn jared@piedpiper.com
).
tenant.emailConfiguration.defaultFromName
StringAvailable since 1.16.0The default From Name used in sending emails when a from name is not provided on an individual email template. This is the display name part of the email address ( i.e. Jared Dunn jared@piedpiper.com
).
tenant.emailConfiguration.emailVerificationEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template used to send emails to users to verify that their email address is valid.
tenant.emailConfiguration.emailUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when their email address is updated.
tenant.emailConfiguration.emailVerifiedEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template used to notify a user that their email address has been verified.
tenant.emailConfiguration.forgotPasswordEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template that is used when a user is sent a forgot password email.
tenant.emailConfiguration.host
StringDefaults to localhostAvailable since 1.8.0The host name of the SMTP server that FusionAuth will use.
Prior to version 1.28.0
this value was required.
tenant.emailConfiguration.implicitEmailVerificationAllowed
Defaults to trueAvailable since 1.32.0When set to true, this allows email to be verified as a result of completing a similar email based workflow such as change password. When set to false, the user must explicitly complete the email verification workflow even if the user has already completed a similar email workflow such as change password.
tenant.emailConfiguration.loginIdInUseOnCreateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when another user attempts to create an account with their login Id.
tenant.emailConfiguration.loginIdInUseOnUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when another user attempts to update an existing account to use their login Id.
tenant.emailConfiguration.loginNewDeviceEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when they log in on a new device.
tenant.emailConfiguration.loginSuspiciousEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a suspicious login occurs.
tenant.emailConfiguration.password
StringAvailable since 1.8.0An optional password FusionAuth will use to authenticate with the SMTP server.
tenant.emailConfiguration.passwordlessEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Passwordless Email Template, sent to users when they start a passwordless login.
tenant.emailConfiguration.passwordResetSuccessEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when they have completed a ‘forgot password’ workflow and their password has been reset.
tenant.emailConfiguration.passwordUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when their password has been updated.
tenant.emailConfiguration.port
IntegerDefaults to 25Available since 1.8.0The port of the SMTP server that FusionAuth will use.
Prior to version 1.28.0
this value was required.
tenant.emailConfiguration.properties
StringAvailable since 1.8.0Custom SMTP configuration properties that may be necessary in some cases. This can contain any Java mail property. It will override anything FusionAuth sets by default.
The following property has a default value:
mail.smtp.ssl.protocols
has a default value ofTLSv1 TLSv1.1 TLSv1.2
.
Since version 1.44.0
, the following two properties have default values:
mail.smtp.timeout
has a default value of2000
.mail.smtp.connectiontimeout
has a default value of2000
.
Here’s an example value which overrides these properties; in this case setting both timeout defaults to 5 seconds.
mail.smtp.timeout=5000\nmail.smtp.connectiontimeout=5000
tenant.emailConfiguration.security
StringDefaults to NONEAvailable since 1.8.0The type of security protocol FusionAuth will use when connecting to the SMTP server. The possible values are:
NONE
- no security will be used. All communications will be sent plaintext.SSL
- SSL will be used to connect to the SMTP server. This protocol is not recommended unless it is the only one your SMTP server supports.TLS
- TLS will be used to connect to the SMTP server. This is the preferred protocol for all SMTP servers.
tenant.emailConfiguration.setPasswordEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password.
tenant.emailConfiguration.twoFactorMethodAddEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a MFA method has been added to their account.
tenant.emailConfiguration.twoFactorMethodRemoveEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a MFA method has been removed from their account.
tenant.emailConfiguration.unverified.allowEmailChangeWhenGated
BooleanDefaults to falseAvailable since 1.27.0When this value is set to true
, the user is allowed to change their email address when they are gated because they haven’t verified their email address.
tenant.emailConfiguration.unverified.behavior
StringDefaults to AllowAvailable since 1.27.0The desired behavior during login for a user that does not have a verified email. The possible values are:
Allow
- the user will be allowed to complete login.Gated
- verification is required before a user can complete login. The use of this value will require a paid plan.
tenant.emailConfiguration.username
StringAvailable since 1.8.0An optional username FusionAuth will to authenticate with the SMTP server.
tenant.emailConfiguration.verificationEmailTemplateId
UUIDThe Id of the Email Template used to send emails to users to verify that their email address is valid. If either the verifyEmail
or verifyEmailWhenChanged
fields are true
, this field is required.
tenant.emailConfiguration.verificationStrategy
StringAvailable since 1.27.0The process by which the user will verify their email address. The possible values are:
ClickableLink
- send the user a code with a clickable link.FormField
- send the user a short code intended to be manually entered into a form field. This is only available when tenant.emailConfiguration.unverified.behavior has theGated
value.
tenant.emailConfiguration.verifyEmail
BooleanDefaults to falseWhether the user’s email addresses are verified when the registers with your application.
tenant.emailConfiguration.verifyEmailWhenChanged
BooleanDefaults to falseWhether the user’s email addresses are verified when the user changes them.
tenant.eventConfiguration.events
ObjectAvailable since 1.8.0A mapping of the configuration for each event type that FusionAuth sends. The event types that are the keys into this Object are:
audit-log.create
- When an audit log is created Available since 1.30.0event-log.create
- When an event log is created Available since 1.30.0jwt.public-key.update
- When a JWT RSA Public / Private keypair may have been changedjwt.refresh
- When an access token is refreshed using a refresh token Available since 1.16.0jwt.refresh-token.revoke
- When a JWT Refresh Token is revokedkickstart.success
- When kickstart has successfully completed Available since 1.30.0user.action
- When a user action is triggereduser.bulk.create
- When multiple users are created in bulk (i.e. during an import)user.create
- When a user is createduser.create.complete
- When a user create transaction has completed Available since 1.30.0user.deactivate
- When a user is deactivateduser.delete
- When a user is deleteduser.delete.complete
- When a user delete transaction has completed Available since 1.30.0user.email.update
- When a user updates their email address Available since 1.30.0user.email.verified
- When a user verifies their email address Available since 1.8.0user.identity-provider.link
- When a link is created from a user to an Identity Provider Available since 1.36.0user.identity-provider.unlink
- When an existing Identity Provider link is removed from a User Available since 1.36.0user.loginId.duplicate.create
- When a request to create a user with a login Id (email or username) which is already in use has been received Available since 1.30.0Note: An Enterprise plan is required to utilize the
user.loginId.duplicate.create
event .user.loginId.duplicate.update
- When a request to update a user and change their login Id (email or username) to one that is already in use has been received Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.loginId.duplicate.update
event .user.login.failed
- When a user fails a login request Available since 1.6.0user.login.new-device
- When a user begins a login request with a new device Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.login.new-device
event .user.login.success
- When a user completes a login request Available since 1.6.0user.login.suspicious
- When a user logs in and is considered to be a potential threat (requires an activated Enterprise license) Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.login.suspicious
event .user.password.breach
- When Reactor detects a user is using a potentially breached password (requires an activated license) Available since 1.15.0
Note: A paid plan is required to utilize the
user.password.breach
event .user.password.reset.send
- When a forgot password email has been sent to a user Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.send
event.user.password.reset.start
- When the process to reset a user password has started Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.start
event.user.password.reset.success
- When a user has successfully reset their password Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.success
event.user.password.update
- When a user has updated their password Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.update
event.user.reactivate
- When a user is reactivateduser.registration.create
- When a user registration is created Available since 1.6.0user.registration.create.complete
- When a user registration create transaction has completed Available since 1.30.0user.registration.delete
- When a user registration is deleted Available since 1.6.0user.registration.delete.complete
- When a user registration delete transaction has completed Available since 1.30.0user.registration.update
- When a user registration is updated Available since 1.6.0user.registration.update.complete
- When a user registration update transaction has completed Available since 1.30.0user.registration.verified
- When a user completes registration verification Available since 1.8.0user.two-factor.method.add
- When a user has added a two-factor method Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.two-factor.method.add
event.user.two-factor.method.remove
- When a user has removed a two-factor method Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.two-factor.method.remove
event.user.update
- When a user is updateduser.update.complete
- When a user update transaction has completed Available since 1.30.0
tenant.eventConfiguration.events[type].enabled
BooleanDefaults to falseAvailable since 1.8.0Whether or not FusionAuth should send these types of events to any configured Webhooks.
tenant.eventConfiguration.events[type].transactionType
StringDefaults to NoneAvailable since 1.8.0The transaction type that FusionAuth uses when sending these types of events to any configured Webhooks. The transaction types are:
None
- No Webhooks are required to succeed for the FusionAuth transaction to be committed.Any
- Only a single Webhook is required to succeed for the FusionAuth transaction to be committed.SimpleMajority
- A simple majority (50% or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.SuperMajority
- A super majority (2/3 or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.AbsoluteMajority
- Every Webhook must succeed for the FusionAuth transaction to be committed.
Prior to version 1.36.0
, this value did not have a default. This meant at runtime the when the transaction type was calculated, it would be assumed to be AbsoluteMajority
even though this value was not set in the domain.
tenant.externalIdentifierConfiguration.authorizationGrantIdTimeToLiveInSeconds
IntegerDefaults to 30Available since 1.8.0The time in seconds until a OAuth authorization code in no longer valid to be exchanged for an access token. This is essentially the time allowed between the start of an Authorization request during the Authorization code grant and when you request an access token using this authorization code on the Token endpoint.
Value must be greater than 0 and less than or equal to 600.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.changePasswordIdGenerator.length
IntegerDefaults to 32Available since 1.8.0The length of the secure generator used for generating the change password Id.
If the changePasswordIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the changePasswordIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.changePasswordIdGenerator.type
StringDefaults to randomBytesAvailable since 1.8.0The type of the secure generator used for generating the change password Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.changePasswordIdTimeToLiveInSeconds
IntegerDefaults to 600Available since 1.8.0The time in seconds until a change password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.deviceCodeTimeToLiveInSeconds
IntegerDefaults to 300Available since 1.11.0The time in seconds until a device code Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.deviceUserCodeIdGenerator.length
IntegerDefaults to 6Available since 1.11.0The length of the secure generator used for generating the device code Id.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.deviceUserCodeIdGenerator.type
StringDefaults to randomAlphaNumericAvailable since 1.11.0The type of the secure generator used for generating the device code Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.emailVerificationIdGenerator.length
IntegerDefaults to 32Available since 1.8.0The length of the secure generator used for generating the the email verification Id.
If the emailVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.emailVerificationIdGenerator.type
StringDefaults to randomBytesAvailable since 1.8.0The type of the secure generator used for generating the email verification Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.emailVerificationIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a email verification Id is no longer valid and cannot be used by the Verify Email API. Value must be greater than 0.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.emailVerificationOneTimeCodeGenerator.length
IntegerDefaults to 6Available since 1.27.0The length of the secure generator used for generating the email verification one time code.
If the emailVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.emailVerificationOneTimeCodeGenerator.type
StringDefaults to randomAlphaNumericAvailable since 1.27.0The type of the secure generator used for generating the email verification one time code. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.externalAuthenticationIdTimeToLiveInSeconds
IntegerDefaults to 300Available since 1.12.0The time in seconds until an external authentication Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.loginIntentTimeToLiveInSeconds
IntegerDefaults to 1800Available since 1.53.0The time in seconds until a Login Timeout identifier is no longer valid to complete post-authentication steps in the OAuth workflow. Must be greater than 0.
tenant.externalIdentifierConfiguration.oneTimePasswordTimeToLiveInSeconds
IntegerDefaults to 60Available since 1.8.0The time in seconds until a One Time Password is no longer valid and cannot be used by the Login API. Value must be greater than 0.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.passwordlessLoginGenerator.length
IntegerDefaults to 32Available since 1.8.0The length of the secure generator used for generating the passwordless login.
If the passwordlessLoginGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the passwordlessLoginGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.passwordlessLoginGenerator.type
StringDefaults to randomBytesAvailable since 1.8.0The type of the secure generator used for generating the passwordless login. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.passwordlessLoginTimeToLiveInSeconds
IntegerDefaults to 180Available since 1.8.0The time in seconds until a passwordless code is no longer valid and cannot be used by the Passwordless API. Value must be greater than 0.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.pendingAccountLinkTimeToLiveInSeconds
IntegerDefaults to 3600Available since 1.28.0The number of seconds before the pending account link identifier is no longer valid to complete an account link request. Value must be greater than 0.
tenant.externalIdentifierConfiguration.registrationVerificationIdGenerator.length
IntegerDefaults to 32Available since 1.8.0The length of the secure generator used for generating the registration verification Id.
If the registrationVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.registrationVerificationIdGenerator.type
StringDefaults to randomBytesAvailable since 1.8.0The type of the secure generator used for generating the registration verification Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.registrationVerificationIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a registration verification Id is no longer valid and cannot be used by the Verify Registration API. Value must be greater than 0.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.registrationVerificationOneTimeCodeGenerator.length
IntegerDefaults to 6Available since 1.27.0The length of the secure generator used for generating the registration verification one time code.
If the registrationVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.registrationVerificationOneTimeCodeGenerator.type
StringDefaults to randomAlphaNumericAvailable since 1.27.0The type of the secure generator used for generating the registration verification one time code. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.rememberOAuthScopeConsentChoiceTimeToLiveInSeconds
IntegerDefaults to 2592000Available since 1.50.0The time in seconds until remembered OAuth scope consent choices are no longer valid, and the User will be prompted to consent to requested OAuth scopes even if they have not changed. Applies only when application.oauthConfiguration.consentMode is set to RememberDecision
. Value must be greater than 0.
Note: An Essentials or Enterprise plan is required to utilize advanced OAuth scopes.
tenant.externalIdentifierConfiguration.samlv2AuthNRequestIdTimeToLiveInSeconds
IntegerDefaults to 300Available since 1.19.0The time in seconds that a SAML AuthN request Id returned by the Start SAML v2 Login Request API will be eligible to be used to complete a SAML v2 Login request.
tenant.externalIdentifierConfiguration.setupPasswordIdGenerator.length
IntegerDefaults to 32Available since 1.8.0The length of the secure generator used for generating the setup password Id.
If the setupPasswordIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the setupPasswordIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.setupPasswordIdGenerator.type
StringDefaults to randomBytesAvailable since 1.8.0The type of the secure generator used for generating the setup password Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.setupPasswordIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a setup password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.trustTokenTimeToLiveInSeconds
IntegerDefaults to 180Available since 1.33.0The number of seconds before the Trust Token is no longer valid to complete a request that requires trust. Value must be greater than 0.
tenant.externalIdentifierConfiguration.twoFactorIdTimeToLiveInSeconds
IntegerDefaults to 300Available since 1.8.0The time in seconds until a two factor Id is no longer valid and cannot be used by the Two Factor Login API. Value must be greater than 0.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.twoFactorOneTimeCodeIdGenerator.length
IntegerDefaults to 6Available since 1.27.0The length of the secure generator used for generating the the two factor code Id.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.twoFactorOneTimeCodeIdGenerator.type
StringDefaults to randomDigitsAvailable since 1.27.0The type of the secure generator used for generating the two factor one time code Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.twoFactorOneTimeCodeIdTimeToLiveInSeconds
IntegerDefaults to 60Available since 1.26.0The number of seconds before the Two-Factor One Time Code used to enable or disable a two-factor method is no longer valid. Must be greater than 0.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.twoFactorTrustIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until an issued Two Factor trust Id is no longer valid and the User will be required to complete Two Factor authentication during the next authentication attempt. Value must be greater than 0.
Prior to version 1.28.0
this value was required.
tenant.externalIdentifierConfiguration.webAuthnAuthenticationChallengeTimeToLiveInSeconds
IntegerDefaults to 180Available since 1.41.0The time in seconds until a WebAuthn authentication challenge is no longer valid and the User will be required to restart the WebAuthn authentication ceremony by creating a new challenge. This value also controls the timeout for the client-side WebAuthn navigator.credentials.get
API call. Value must be greater than 0.
Note: A license is required to utilize WebAuthn
tenant.externalIdentifierConfiguration.webAuthnRegistrationChallengeTimeToLiveInSeconds
IntegerDefaults to 180Available since 1.41.0The time in seconds until a WebAuthn registration challenge is no longer valid and the User will be required to restart the WebAuthn registration ceremony by creating a new challenge. This value also controls the timeout for the client-side WebAuthn navigator.credentials.create
API call. Value must be greater than 0.
Note: A license is required to utilize WebAuthn
tenant.failedAuthenticationConfiguration.actionCancelPolicy.onPasswordReset
BooleanDefaults to falseAvailable since 1.42.0Indicates whether you want the user to be able to self-service unlock their account prior to the action duration by completing a password reset workflow.
tenant.failedAuthenticationConfiguration.actionDuration
LongDefaults to 3Available since 1.8.0The duration of the User Action. This value along with the actionDurationUnit
will be used to set the duration of the User Action. Value must be greater than 0.
tenant.failedAuthenticationConfiguration.actionDurationUnit
StringAvailable since 1.8.0The unit of time associated with a duration. The possible values are:
MINUTES
HOURS
DAYS
WEEKS
MONTHS
YEARS
tenant.failedAuthenticationConfiguration.emailUser
StringDefaults to falseAvailable since 1.42.0Indicates you would like to email the user when the user’s account is locked due to this action being taken. This requires the User Action specified by the tenant.failedAuthenticationConfiguration.userActionId to also be configured for email. If the User Action is not configured to be able to email the user, this configuration will be ignored. See userEmailingEnabled on the User Action.
The email template configuration will be in the User Action.
tenant.failedAuthenticationConfiguration.resetCountInSeconds
IntegerDefaults to 60Available since 1.8.0The length of time in seconds before the failed authentication count will be reset. Value must be greater than 0.
For example, if tooManyAttempts
is set to 5
and you fail to authenticate 4
times in a row, waiting for the duration specified here will cause your fifth attempt to start back at 1
.
tenant.failedAuthenticationConfiguration.tooManyAttempts
IntegerDefaults to 5Available since 1.8.0The number of failed attempts considered to be too many. Once this threshold is reached the specified User Action will be applied to the user for the duration specified. Value must be greater than 0.
tenant.failedAuthenticationConfiguration.userActionId
UUIDAvailable since 1.8.0The Id of the User Action that is applied when the threshold is reached for too many failed authentication attempts.
tenant.familyConfiguration.allowChildRegistrations
BooleanDefaults to trueAvailable since 1.8.0Whether to allow child registrations.
tenant.familyConfiguration.confirmChildEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use when confirming a child.
tenant.familyConfiguration.deleteOrphanedAccounts
BooleanDefaults to falseAvailable since 1.8.0Indicates that child users without parental verification will be permanently deleted after tenant.familyConfiguration.deleteOrphanedAccountsDays days.
tenant.familyConfiguration.deleteOrphanedAccountsDays
IntegerDefaults to 30Available since 1.8.0The number of days from creation child users will be retained before being deleted for not completing parental verification. Value must be greater than 0.
tenant.familyConfiguration.enabled
BooleanDefaults to falseAvailable since 1.8.0Whether family configuration is enabled.
tenant.familyConfiguration.familyRequestEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use when a family request is made.
tenant.familyConfiguration.maximumChildAge
IntegerDefaults to 12Available since 1.8.0The maximum age of a child. Value must be greater than 0.
tenant.familyConfiguration.minimumOwnerAge
IntegerDefaults to 21Available since 1.8.0The minimum age to be an owner. Value must be greater than 0.
tenant.familyConfiguration.parentEmailRequired
BooleanDefaults to falseAvailable since 1.8.0Whether a parent email is required.
tenant.familyConfiguration.parentRegistrationEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use for parent registration.
tenant.formConfiguration.adminUserFormId
UUIDAvailable since 1.20.0The unique Id of the form to use for the Add and Edit User form when used in the FusionAuth admin UI.
When this parameter is not provided, it will default to the form Id currently assigned to the Default tenant.
Note: A paid plan is required to utilize custom forms.
tenant.httpSessionMaxInactiveInterval
IntegerDefaults to 3600Available since 1.8.0Time in seconds until an inactive session will be invalidated. Used when creating a new session in the FusionAuth OAuth frontend.
tenant.issuer
StringAvailable since 1.8.0The named issuer used to sign tokens, this is generally your public fully qualified domain.
Prior to version 1.30.0
this value was required.
tenant.jwtConfiguration.accessTokenKeyId
UUIDDefaults to key value of the FusionAuth applicationAvailable since 1.8.0The unique id of the signing key used to sign the access token.
Prior to version 1.30.0
this value was required.
tenant.jwtConfiguration.idTokenKeyId
UUIDDefaults to key value of the FusionAuth applicationAvailable since 1.8.0The unique id of the signing key used to sign the Id token.
Prior to version 1.30.0
this value was required.
tenant.jwtConfiguration.refreshTokenExpirationPolicy
StringDefaults to FixedAvailable since 1.17.0The Refresh Token expiration policy.
The possible values are:
Fixed
- the expiration is calculated from the time the token is issued.SlidingWindow
- the expiration is calculated from the last time the token was used.SlidingWindowWithMaximumLifetime
- the expiration is calculated from the last time the token was used, or until the maximumTimeToLiveInMinutes is reached. Available since 1.46.0
tenant.jwtConfiguration.refreshTokenRevocationPolicy.onLoginPrevented
BooleanDefaults to trueAvailable since 1.17.0When enabled, all refresh tokens will be revoked when a user action, such as locking an account based on a number of failed login attempts, prevents user login.
tenant.jwtConfiguration.refreshTokenRevocationPolicy.onMultiFactorEnable
BooleanDefaults to falseAvailable since 1.42.0When enabled, all refresh tokens will be revoked when a user enables multi-factor authentication for the first time. This policy will not be applied when adding subsequent multi-factor methods to the user.
tenant.jwtConfiguration.refreshTokenRevocationPolicy.onPasswordChanged
BooleanDefaults to trueAvailable since 1.17.0When enabled, all refresh tokens will be revoked when a user changes their password.
tenant.jwtConfiguration.refreshTokenSlidingWindowConfiguration.maximumTimeToLiveInMinutes
IntegerAvailable since 1.46.0The maximum lifetime of a refresh token when using a refreshTokenExpirationPolicy of SlidingWindowWithMaximumLifetime
. Value must be greater than 0.
When refreshTokenExpirationPolicy is set to SlidingWindowWithMaximumLifetime
, this value must be greater than or equal to refreshTokenTimeToLiveInMinutes .
tenant.jwtConfiguration.refreshTokenTimeToLiveInMinutes
IntegerAvailable since 1.8.0The length of time in minutes a Refresh Token is valid from the time it was issued. Value must be greater than 0.
Prior to version 1.28.0
this value was required.
tenant.jwtConfiguration.refreshTokenUsagePolicy
StringDefaults to ReusableAvailable since 1.17.0The refresh token usage policy. The following are valid values:
Reusable
- the token does not change after it was issued.OneTimeUse
- the token value will be changed each time the token is used to refresh a JWT. The client must store the new value after each usage.
Prior to version 1.28.0
this value was required.
tenant.jwtConfiguration.timeToLiveInSeconds
IntegerAvailable since 1.8.0The length of time in seconds this JWT is valid from the time it was issued. Value must be greater than 0.
Prior to version 1.28.0
this value was required.
tenant.lambdaConfiguration.loginValidationId
UUIDAvailable since 1.53.0The Id of the lambda that will be invoked at the end of a successful login request in order to extend custom validation of a login request.
tenant.lambdaConfiguration.scimEnterpriseUserRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Request lambda that will be used to convert the SCIM Enterprise User request to a FusionAuth User.
Note: An Enterprise plan is required to utilize SCIM.
Required when tenant.scimServerConfiguration.enabled is true
.
tenant.lambdaConfiguration.scimEnterpriseUserResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Response lambda that will be used to convert a FusionAuth Enterprise User to a SCIM Server response.
Note: An Enterprise plan is required to utilize SCIM.
Required when tenant.scimServerConfiguration.enabled is true
.
tenant.lambdaConfiguration.scimGroupRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM Group Request lambda that will be used to convert the SCIM Group request to a FusionAuth Group.
Note: An Enterprise plan is required to utilize SCIM.
Required when tenant.scimServerConfiguration.enabled is true
.
tenant.lambdaConfiguration.scimGroupResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM Group Response lambda that will be used to convert a FusionAuth Group to a SCIM Server response.
Note: An Enterprise plan is required to utilize SCIM.
Required when tenant.scimServerConfiguration.enabled is true
.
tenant.lambdaConfiguration.scimUserRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Request lambda that will be used to convert the SCIM User request to a FusionAuth User.
Note: An Enterprise plan is required to utilize SCIM.
Required when tenant.scimServerConfiguration.enabled is true
.
tenant.lambdaConfiguration.scimUserResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Response lambda that will be used to convert a FusionAuth User to a SCIM Server response.
Note: An Enterprise plan is required to utilize SCIM.
Required when tenant.scimServerConfiguration.enabled is true
.
tenant.logoutURL
StringAvailable since 1.8.0The logout redirect URL when sending the user’s browser to the /oauth2/logout
URI of the FusionAuth Front End. This value is only used when a logout URL is not defined in your Application.
tenant.loginConfiguration.requireAuthentication
BooleanDefaults to trueAvailable since 1.26.0Indicates whether to require an API key for the Login API when an applicationId
is not provided. When an applicationId
is provided to the Login API call, the application configuration will take precedence.
In almost all cases, you will want to this to be true
.
tenant.logoutURL
StringAvailable since 1.8.0The logout redirect URL when sending the user’s browser to the /oauth2/logout
URI of the FusionAuth Front End. This value is only used when a logout URL is not defined in your Application.
tenant.maximumPasswordAge.days
IntegerDefaults to 180Available since 1.8.0The password maximum age in days. The number of days after which FusionAuth will require a user to change their password. Required when tenant.maximumPasswordAge.enabled is set to true
.
tenant.maximumPasswordAge.enabled
BooleanDefaults to falseAvailable since 1.8.0Indicates that the maximum password age is enabled and being enforced.
tenant.minimumPasswordAge.seconds
IntegerDefaults to 30Available since 1.8.0The password minimum age in seconds. When enabled FusionAuth will not allow a password to be changed until it reaches this minimum age. Required when tenant.minimumPasswordAge.enabled is set to true
.
tenant.minimumPasswordAge.enabled
BooleanDefaults to falseAvailable since 1.8.0Indicates that the minimum password age is enabled and being enforced.
tenant.multiFactorConfiguration.authenticator.enabled
BooleanDefaults to trueAvailable since 1.26.0When enabled, users may utilize an authenticator application to complete a multi-factor authentication request. This method uses TOTP (Time-Based One-Time Password) as defined in RFC 6238 and often uses an native mobile app such as Google Authenticator.
tenant.multiFactorConfiguration.email.enabled
BooleanDefaults to falseAvailable since 1.26.0When enabled, users may utilize an email address to complete a multi-factor authentication request.
tenant.multiFactorConfiguration.email.templateId
UUIDAvailable since 1.26.0The Id of the email template that is used when notifying a user to complete a multi-factor authentication request. This field is required when tenant.multiFactorConfiguration.email.enabled is set to true
.
tenant.multiFactorConfiguration.loginPolicy
StringAvailable since 1.37.0When set to Enabled
and a user has one or more two-factor methods configured, the user will be required to complete a two-factor challenge during login. When set to Disabled
, even when a user has configured one or more two-factor methods, the user will not be required to complete a two-factor challenge during login. When set to Required
, a two-factor challenge will be required during login. If a user has not configured any two-factor methods, they will not be able to log in.
This value may be overridden by the value configured by the application.multiFactorConfiguration.loginPolicy .
Supported values include:
Enabled
- Require a two-factor challenge during login when an eligible method is available.Disabled
- Do not require a two-factor challenge during login.Required
- Require a two-factor challenge during login. A user will be required to configure 2FA if no eligible methods are available. Available since 1.42.0
tenant.multiFactorConfiguration.sms.enabled
BooleanDefaults to falseAvailable since 1.26.0When enabled, users may utilize a mobile phone number to complete a multi-factor authentication request.
tenant.multiFactorConfiguration.sms.messengerId
UUIDAvailable since 1.26.0The messenger that is used to deliver a SMS multi-factor authentication request. This field is required when tenant.multiFactorConfiguration.sms.enabled is set to true
.
tenant.multiFactorConfiguration.sms.templateId
UUIDAvailable since 1.26.0The Id of the SMS template that is used when notifying a user to complete a multi-factor authentication request. This field is required when tenant.multiFactorConfiguration.sms.enabled is set to true
.
tenant.name
StringrequiredThe unique name of the Tenant.
tenant.oauthConfiguration.clientCredentialsAccessTokenPopulateLambdaId
UUIDAvailable since 1.26.0The Id of a lambda that will be called to populate the JWT during a client credentials grant.
Note: A paid plan is required to utilize client credentials grant.
tenant.passwordEncryptionConfiguration.encryptionScheme
StringAvailable since 1.8.0The default method for encrypting the User’s password. The following encryptors are provided with FusionAuth:
- salted-md5
- salted-sha256
- salted-hmac-sha256
- salted-pbkdf2-hmac-sha256
- salted-pbkdf2-hmac-sha256-512 available since 1.34.0
- salted-pbkdf2-hmac-sha512-512 available since 1.43.0
- bcrypt
- phpass-md5 available since 1.45.0
- phpass-sha512 available since 1.45.0
tenant.passwordEncryptionConfiguration.encryptionSchemeFactor
IntegerDefaults to 24000Available since 1.8.0The factor used by the password encryption scheme. If not provided, the PasswordEncryptor
provides a default value. Generally this will be used as an iteration count to generate the hash. The actual use of this value is up to the PasswordEncryptor
implementation.
tenant.passwordEncryptionConfiguration.modifyEncryptionSchemeOnLogin
BooleanDefaults to falseAvailable since 1.8.0When enabled a user’s hash configuration will be modified to match these configured settings. This can be useful to increase a password hash strength over time or upgrade imported users to a more secure encryption scheme after an initial import.
Beginning in version 1.42.0
when this configuration is enabled, in addition to re-hashing on login, the password will be re-hashed on password change as well.
tenant.passwordValidationRules.breachDetection.enabled
BooleanDefaults to falseAvailable since 1.15.0Whether to enable Reactor breach detection. Requires an activated license.
tenant.passwordValidationRules.breachDetection.matchMode
StringAvailable since 1.15.0The level of severity where Reactor will consider a breach. The following are valid values:
High
Only requires a password match, this is the most secure and is recommendedMedium
Exact match on username, email address or email sub-addressLow
Exact match on an email or username, or the password is a common breached value
tenant.passwordValidationRules.breachDetection.notifyUserEmailTemplateId
UUIDAvailable since 1.15.0The Id of the email template to use when notifying user of breached password. Required if tenant.passwordValidationRules.breachDetection.onLogin is set to NotifyUser
.
tenant.passwordValidationRules.breachDetection.onLogin
StringAvailable since 1.15.0The behavior when detecting breaches at time of user login. The following are valid values:
Off
Do not perform breach detection at loginRecordOnly
Only record the result, take no actionNotifyUser
Notify the end user via emailRequireChange
Require immediate password change
tenant.passwordValidationRules.maxLength
IntegerDefaults to 256Available since 1.8.0The maximum length of a password when a new user is created or a user requests a password change.
This value must be greater than 0
and less than or equal to 256
. When passwordEncryptionConfiguration.encryptionScheme is equal to bcrypt
, the maximum will be limited to 50
.
tenant.passwordValidationRules.minLength
IntegerDefaults to 8Available since 1.8.0The minimum length of a password when a new user is created or a user requests a password change.
tenant.passwordValidationRules.rememberPreviousPasswords.count
IntegerAvailable since 1.8.0The number of previous passwords to remember. Value must be greater than 0.
tenant.passwordValidationRules.rememberPreviousPasswords.enabled
BooleanDefaults to falseAvailable since 1.8.0Whether to prevent a user from using any of their previous passwords.
tenant.passwordValidationRules.requireMixedCase
BooleanDefaults to falseAvailable since 1.8.0Whether to force the user to use at least one uppercase and one lowercase character.
tenant.passwordValidationRules.requireNonAlpha
BooleanDefaults to falseAvailable since 1.8.0Whether to force the user to use at least one non-alphanumeric character.
tenant.passwordValidationRules.requireNumber
BooleanDefaults to falseAvailable since 1.8.0Whether to force the user to use at least one number.
tenant.passwordValidationRules.validateOnLogin
BooleanDefaults to falseAvailable since 1.15.0When enabled the user’s password will be validated during login. If the password does not meet the currently configured validation rules the user will be required to change their password.
tenant.rateLimitConfiguration.failedLogin.enabled
BooleanDefaults to falseAvailable since 1.30.0Whether rate limiting is enabled for failed login.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.failedLogin.limit
IntegerDefaults to 5Available since 1.30.0The number of times a user can fail to login within the configured timePeriodInSeconds duration. If a Failed authentication action has been configured then it will take precedence.
Required when enabled
is set to true
.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.failedLogin.timePeriodInSeconds
IntegerDefaults to 60Available since 1.30.0The duration for the number of times a user can fail login before being rate limited.
Required when enabled
is set to true
.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.forgotPassword.enabled
BooleanDefaults to falseAvailable since 1.30.0Whether rate limiting is enabled for forgot password.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.forgotPassword.limit
IntegerDefaults to 5Available since 1.30.0The number of times a user can request a forgot password email within the configured timePeriodInSeconds duration.
Required when enabled
is set to true
.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.forgotPassword.timePeriodInSeconds
IntegerDefaults to 60Available since 1.30.0The duration for the number of times a user can request a forgot password email before being rate limited.
Required when enabled
is set to true
.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.sendEmailVerification.enabled
BooleanDefaults to falseAvailable since 1.30.0Whether rate limiting is enabled for send email verification.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.sendEmailVerification.limit
IntegerDefaults to 5Available since 1.30.0The number of times a user can request a verification email within the configured timePeriodInSeconds duration.
Required when enabled
is set to true
.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.sendEmailVerification.timePeriodInSeconds
IntegerDefaults to 60Available since 1.30.0The duration for the number of times a user can request a verification email before being rate limited.
Required when enabled
is set to true
.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.sendPasswordless.enabled
BooleanDefaults to falseAvailable since 1.30.0Whether rate limiting is enabled for send passwordless.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.sendPasswordless.limit
IntegerDefaults to 5Available since 1.30.0The number of times a user can request a passwordless login email within the configured timePeriodInSeconds duration.
Required when enabled
is set to true
.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.sendPasswordless.timePeriodInSeconds
IntegerDefaults to 60Available since 1.30.0The duration for the number of times a user can request a passwordless login email before being rate limited.
Required when enabled
is set to true
.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.sendRegistrationVerification.enabled
BooleanDefaults to falseAvailable since 1.30.0Whether rate limiting is enabled for send registration verification.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.sendRegistrationVerification.limit
IntegerDefaults to 5Available since 1.30.0The number of times a user can request a registration verification email within the configured timePeriodInSeconds duration.
Required when enabled
is set to true
.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.sendRegistrationVerification.timePeriodInSeconds
IntegerDefaults to 60Available since 1.30.0The duration for the number of times a user can request a registration verification email before being rate limited.
Required when enabled
is set to true
.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.sendTwoFactor.enabled
BooleanDefaults to falseAvailable since 1.30.0Whether rate limiting is enabled for send two factor.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.sendTwoFactor.limit
IntegerDefaults to 5Available since 1.30.0The number of times a user can request a two-factor code by email or SMS within the configured timePeriodInSeconds duration.
Required when enabled
is set to true
.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.rateLimitConfiguration.sendTwoFactor.timePeriodInSeconds
IntegerDefaults to 60Available since 1.30.0The duration for the number of times a user can request a two-factor code by email or SMS before being rate limited.
Required when enabled
is set to true
.
Note: An Enterprise plan is required to utilize rate limiting.
tenant.registrationConfiguration.blockedDomains
Array<String>Available since 1.30.0A list of unique domains that are not allowed to register when self service is enabled.
Note: An Enterprise plan is required to utilize blocked domains.
tenant.scimServerConfiguration.clientEntityTypeId
UUIDAvailable since 1.36.0The Entity Type that will be used to represent SCIM Clients for this tenant.
Note: An Enterprise plan is required to utilize SCIM.
Required when tenant.scimServerConfiguration.enabled is true
.
tenant.scimServerConfiguration.enabled
BooleanAvailable since 1.36.0Whether or not this tenant has the SCIM endpoints enabled.
Note: An Enterprise plan is required to utilize SCIM.
tenant.scimServerConfiguration.schemas
MapAvailable since 1.36.0JSON formatted as a SCIM Schemas endpoint response. Because the SCIM lambdas may modify the JSON response, ensure the Schema’s response matches that generated by the response lambdas. More about Schema definitions.
When this parameter is not provided, it will default to EnterpriseUser, Group, and User schema definitions as defined by the SCIM core schemas spec.
Note: An Enterprise plan is required to utilize SCIM.
tenant.scimServerConfiguration.serverEntityTypeId
UUIDAvailable since 1.36.0The Entity Type that will be used to represent SCIM Servers for this tenant.
Note: An Enterprise plan is required to utilize SCIM.
Required when tenant.scimServerConfiguration.enabled is true
.
tenant.ssoConfiguration.deviceTrustTimeToLiveInSeconds
IntegerAvailable since 1.30.2The number of seconds before a trusted device is reset. When reset, a user is forced to complete captcha during login and complete two factor authentication if applicable.
tenant.themeId
UUIDAvailable since 1.8.0The unique Id of the theme to be used to style the login page and other end user templates.
Prior to version 1.30.0
this value was required.
tenant.userDeletePolicy.unverified.enabled
BooleanDefaults to falseAvailable since 1.13.0Indicates that users without a verified email address will be permanently deleted after tenant.userDeletePolicy.unverified.numberOfDaysToRetain days.
tenant.userDeletePolicy.unverified.numberOfDaysToRetain
IntegerAvailable since 1.13.0The number of days from creation users will be retained before being deleted for not completing email verification. This field is required when tenant.userDeletePolicy.unverified.enabled is set to true
. Value must be greater than 0.
tenant.usernameConfiguration.unique.enabled
BooleanDefaults to falseAvailable since 1.27.0When true
, FusionAuth will handle username collisions by generating a random suffix.
Note: A paid plan is required to utilize unique usernames.
tenant.usernameConfiguration.unique.numberOfDigits
IntegerDefaults to 5Available since 1.27.0The maximum number of digits to use when building a unique suffix for a username. A number will be randomly selected and will be 1 or more digits up to this configured value in length. For example, if this value is 5
, the suffix will be a number between 00001
and 99999
, inclusive. The value of this field must be greater than or equal to 3
and less than or equal to 10
.
tenant.usernameConfiguration.unique.separator
StringAvailable since 1.27.0A single character to use as a separator from the requested username and a unique suffix that is added when a duplicate username is detected. This value can be a single non-alphanumeric ASCII character.
tenant.usernameConfiguration.unique.strategy
StringDefaults to OnCollisionAvailable since 1.29.0This strategy instructions FusionAuth when to append a unique suffix to the username. The possible values are:
Always
- Always append a unique suffix even when the requested username is not in use.OnCollision
- Only append a unique suffix when the requested username is in use.
tenant.webAuthnConfiguration.bootstrapWorkflow.authenticatorAttachmentPreference
StringDefaults to crossPlatformAvailable since 1.41.0Determines the authenticator attachment requirement for WebAuthn passkey registration when using the bootstrap workflow. The possible values are:
any
- An authenticator with any attachment modality will be allowed during registration.crossPlatform
- Only authenticators with thecross-platform
attachment modality will be allowed during registration. These are also referred to as “roaming” authenticators.platform
- Only authenticators with theplatform
attachment modality will be allowed during registration.
The recommended value for the bootstrap workflow is any
.
Note: A license is required to utilize WebAuthn
Note: An Enterprise plan is required to utilize WebAuthn cross-platform authenticators.
tenant.webAuthnConfiguration.bootstrapWorkflow.enabled
BooleanDefaults to falseAvailable since 1.41.0Whether or not this tenant has the WebAuthn bootstrap workflow enabled. The bootstrap workflow is used when the user must “bootstrap” the authentication process by identifying themselves prior to the WebAuthn ceremony and can be used to authenticate from a new device using WebAuthn.
Note: A license is required to utilize WebAuthn
tenant.webAuthnConfiguration.bootstrapWorkflow.userVerificationRequirement
StringDefaults to requiredAvailable since 1.41.0Determines the user verification requirement for WebAuthn passkey registration and authentication when using the bootstrap workflow. The possible values are:
discouraged
- If possible, do not require user verification during registration and authentication.preferred
- Prefer authenticators that support user verification during registration and authentication but allow others.required
- Only authenticators that support user verification will be allowed.
It is highly recommended to use the required
option for the bootstrap workflow.
Note: A license is required to utilize WebAuthn
tenant.webAuthnConfiguration.debug
BooleanDefaults to falseAvailable since 1.41.0Determines if debug should be enabled for this tenant to create an event log to assist in debugging WebAuthn errors.
Note: A license is required to utilize WebAuthn
tenant.webAuthnConfiguration.enabled
BooleanDefaults to falseAvailable since 1.41.0Whether or not this tenant has WebAuthn enabled globally.
Note: A license is required to utilize WebAuthn
tenant.webAuthnConfiguration.reauthenticationWorkflow.authenticatorAttachmentPreference
StringDefaults to crossPlatformAvailable since 1.41.0Determines the authenticator attachment requirement for WebAuthn passkey registration when using the reauthentication workflow. The possible values are:
any
- An authenticator with any attachment modality will be allowed during registration.crossPlatform
- Only authenticators with thecross-platform
attachment modality will be allowed during registration. These are also referred to as “roaming” authenticators.platform
- Only authenticators with theplatform
attachment modality will be allowed during registration.
The recommended value for the reauthentication workflow is platform
.
Note: A license is required to utilize WebAuthn
Note: An Enterprise plan is required to utilize WebAuthn cross-platform authenticators.
tenant.webAuthnConfiguration.reauthenticationWorkflow.enabled
BooleanDefaults to falseAvailable since 1.41.0Whether or not this tenant has the WebAuthn reauthentication workflow enabled. The reauthentication workflow will automatically prompt a user to authenticate using WebAuthn for repeated logins from the same device.
Note: A license is required to utilize WebAuthn
tenant.webAuthnConfiguration.reauthenticationWorkflow.userVerificationRequirement
StringDefaults to requiredAvailable since 1.41.0Determines the user verification requirement for WebAuthn passkey registration and authentication when using the reauthentication workflow. The possible values are:
discouraged
- If possible, do not require user verification during registration and authentication.preferred
- Prefer authenticators that support user verification during registration and authentication but allow others.required
- Only authenticators that support user verification will be allowed.
It is highly recommended to use the required
option for the reauthentication workflow.
Note: A license is required to utilize WebAuthn
tenant.webAuthnConfiguration.relyingPartyId
StringAvailable since 1.41.0The value this tenant will use for the Relying Party Id in WebAuthn ceremonies. Passkeys can only be used to authenticate on sites using the same Relying Party Id they were registered with. This value must match the browser origin or be a registrable domain suffix of the browser origin. For example, if your domain is auth.piedpiper.com
, you could use auth.piedpiper.com
or piedpiper.com
but not m.auth.piedpiper.com
or com
.
When this parameter is omitted, FusionAuth will use null
for the Relying Party Id in passkey creation and request options. A null
value in the WebAuthn JavaScript API will use the browser origin.
Note: A license is required to utilize WebAuthn
tenant.webAuthnConfiguration.relyingPartyName
StringAvailable since 1.41.0The value this tenant will use for the Relying Party name in WebAuthn ceremonies. This value may be displayed by browser or operating system dialogs during WebAuthn ceremonies.
When this parameter is omitted, FusionAuth will use the tenant.issuer value.
Note: A license is required to utilize WebAuthn
webhookIds
Array<UUID>Available since 1.37.0An array of Webhook Ids. For Webhooks that are not already configured for All Tenants, specifying an Id on this request will indicate the associated Webhook should handle events for this tenant.
Example Request JSON
{
"tenant": {
"accessControlConfiguration": {
"uiIPAccessControlListId": "11d49de7-69f6-46fc-8270-0b3aa626327a"
},
"captchaConfiguration": {
"captchaMethod": "GoogleRecaptchaV3",
"enabled": true,
"secretKey": "6LdYWpMbAAAAAKhcksgk70us00012r66r96tt7rp",
"siteKey": "6LdYWpMbAAAAAKhcksgk75tz00022r66ombcfadr",
"threshold": 0.5
},
"connectorPolicies": [
{
"connectorId": "e3306678-a53a-4964-9040-1c96f36dda72",
"domains": [
"*"
],
"migrate": false
},
{
"connectorId": "27f22280-7e55-4d1c-b9f8-239bf9cc1a5e",
"domains": [
"*"
],
"migrate": true
}
],
"data": {
"description": "No more secrets, Marty."
},
"emailConfiguration": {
"additionalHeaders": [
{
"name": "X-SES-CONFIGURATION-SET",
"value": "example_configuration_set_name"
}
],
"defaultFromEmail": "jared@piedpiper.com",
"defaultFromName": "Jared Dunn",
"emailUpdateEmailTemplateId": "ec3045c7-97d8-47f8-8725-61b93deacf5d",
"emailVerifiedEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
"forgotPasswordEmailTemplateId": "49aba1de-0225-45d7-a2b1-f9fe46b0242c",
"host": "smtp.sendgrid.net",
"implicitEmailVerificationAllowed": true,
"loginIdInUseOnCreateEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginIdInUseOnUpdateEmailTemplateId": "2c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginNewDeviceEmailTemplateId": "3c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginSuspiciousEmailTemplateId": "4c3045c7-97d8-47f8-8725-61b93deacf5d",
"password": "password",
"passwordlessEmailTemplateId": "a917e23a-da58-4cda-be01-90f542f8c343",
"passwordResetSuccessEmailTemplateId": "5c3045c7-97d8-47f8-8725-61b93deacf5d",
"passwordUpdateEmailTemplateId": "6c3045c7-97d8-47f8-8725-61b93deacf5d",
"port": 587,
"properties": {
"key": "value"
},
"security": "TLS",
"setPasswordEmailTemplateId": "a9aba13e-0125-4fd7-a2b1-aaa146b02423",
"twoFactorMethodAddEmailTemplateId": "7c3045c7-97d8-47f8-8725-61b93deacf5d",
"twoFactorMethodRemoveEmailTemplateId": "8c3045c7-97d8-47f8-8725-61b93deacf5d",
"unverified": {
"allowEmailChangeWhenGated": false,
"behavior": "Allow"
},
"username": "username",
"verificationEmailTemplateId": "8da42c09-461c-45f3-b931-6e9f63b87ab5",
"verificationStrategy": "FormField",
"verifyEmail": true,
"verifyEmailWhenChanged": true
},
"eventConfiguration": {
"events": {
"user.delete": {
"enabled": true,
"transactionType": "None"
},
"user.create": {
"enabled": true,
"transactionType": "None"
},
"user.update": {
"enabled": true,
"transactionType": "None"
},
"user.deactivate": {
"enabled": true,
"transactionType": "None"
},
"user.bulk.create": {
"enabled": true,
"transactionType": "None"
},
"user.reactivate": {
"enabled": true,
"transactionType": "None"
},
"jwt.refresh": {
"enabled": true,
"transactionType": "None"
},
"jwt.refresh-token.revoke": {
"enabled": true,
"transactionType": "None"
},
"jwt.public-key.update": {
"enabled": true,
"transactionType": "None"
},
"user.login.success": {
"enabled": true,
"transactionType": "None"
},
"user.login.failed": {
"enabled": true,
"transactionType": "None"
},
"user.password.breach": {
"enabled": true,
"transactionType": "None"
},
"user.registration.create": {
"enabled": true,
"transactionType": "None"
},
"user.registration.update": {
"enabled": true,
"transactionType": "None"
},
"user.registration.delete": {
"enabled": true,
"transactionType": "None"
},
"user.registration.verified": {
"enabled": true,
"transactionType": "None"
},
"user.email.verified": {
"enabled": true,
"transactionType": "None"
}
}
},
"externalIdentifierConfiguration": {
"authorizationGrantIdTimeToLiveInSeconds": 30,
"changePasswordIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"changePasswordIdTimeToLiveInSeconds": 600,
"deviceCodeTimeToLiveInSeconds": 1800,
"deviceUserCodeIdGenerator": {
"length": 6,
"type": "randomAlphaNumeric"
},
"emailVerificationIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"emailVerificationIdTimeToLiveInSeconds": 86400,
"emailVerificationOneTimeCodeGenerator": {
"length": 6,
"type": "randomAlphaNumeric"
},
"externalAuthenticationIdTimeToLiveInSeconds": 300,
"loginIntentTimeToLiveInSeconds": 1800,
"oneTimePasswordTimeToLiveInSeconds": 60,
"passwordlessLoginGenerator": {
"length": 32,
"type": "randomBytes"
},
"passwordlessLoginTimeToLiveInSeconds": 180,
"pendingAccountLinkTimeToLiveInSeconds": 3600,
"registrationVerificationIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"registrationVerificationIdTimeToLiveInSeconds": 86400,
"registrationVerificationOneTimeCodeGenerator": {
"length": 6,
"type": "randomAlphaNumeric"
},
"rememberOAuthScopeConsentChoiceTimeToLiveInSeconds": 2592000,
"samlv2AuthNRequestIdTimeToLiveInSeconds": 300,
"setupPasswordIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"setupPasswordIdTimeToLiveInSeconds": 86400,
"trustTokenTimeToLiveInSeconds": 180,
"twoFactorIdTimeToLiveInSeconds": 300,
"twoFactorOneTimeCodeIdGenerator": {
"length": 6,
"type": "randomDigits"
},
"twoFactorOneTimeCodeIdTimeToLiveInSeconds": 60,
"twoFactorTrustIdTimeToLiveInSeconds": 2592000,
"webAuthnAuthenticationChallengeTimeToLiveInSeconds": 180,
"webAuthnRegistrationChallengeTimeToLiveInSeconds": 180
},
"failedAuthenticationConfiguration": {
"actionCancelPolicy": {
"onPasswordReset": false
},
"actionDuration": 3,
"actionDurationUnit": "MINUTES",
"emailUser": false,
"resetCountInSeconds": 60,
"tooManyAttempts": 5,
"userActionId": "16cfc707-268c-4c5b-8989-f71f3ee156d4"
},
"familyConfiguration": {
"allowChildRegistrations": true,
"confirmChildEmailTemplateId": "87654321-4321-8765-ba09-ba0987654321",
"deleteOrphanedAccounts": false,
"deleteOrphanedAccountsDays": 30,
"enabled": true,
"familyRequestEmailTemplateId": "57462514-a73b-cd76-0001-b8a65cd61230",
"maximumChildAge": 12,
"minimumOwnerAge": 21,
"parentEmailRequired": false,
"parentRegistrationEmailTemplateId": "12345678-1234-5678-90ab-1234567890ab"
},
"formConfiguration": {
"adminUserFormId": "e92751a5-25f4-4bca-ad91-66cdf67725d2"
},
"httpSessionMaxInactiveInterval": 3600,
"issuer": "https://example.com",
"jwtConfiguration": {
"accessTokenKeyId": "025233ca-d4f3-2aa4-eca9-7e4200e9b472",
"enabled": true,
"idTokenKeyId": "092dbedc-30af-4149-9c61-b578f2c72f59",
"refreshTokenExpirationPolicy": "Fixed",
"refreshTokenRevocationPolicy": {
"onLoginPrevented": true,
"onMultiFactorEnable": true,
"onPasswordChanged": true
},
"refreshTokenTimeToLiveInMinutes": 43200,
"refreshTokenUsagePolicy": "Reusable",
"timeToLiveInSeconds": 3600
},
"lambdaConfiguration": {
"loginValidationId": "c0dd79db-38dd-424b-b77a-4dccaad71052",
"scimEnterpriseUserRequestConverterId": "c2e70f8d-19bb-4df7-848a-33a9a1e26b84",
"scimEnterpriseUserResponseConverterId": "44fc9553-8a2e-408f-8aa2-fa65b70b55e2",
"scimGroupRequestConverterId": "66d65de0-1819-42f8-86ed-7daaa4e155dc",
"scimGroupResponseConverterId": "79812ede-432f-4375-9b43-23c0fe996fef",
"scimUserRequestConverterId": "8a51d7a1-5e3e-442a-b96a-0c31379bb3d4",
"scimUserResponseConverterId": "c8720843-dc4f-4e6c-b6ca-500e9c44695f"
},
"logoutURL": "http://example.com/logout",
"maximumPasswordAge": {
"days": 180,
"enabled": false
},
"minimumPasswordAge": {
"enabled": false,
"seconds": 30
},
"multiFactorConfiguration": {
"authenticator": {
"enabled": true
},
"email": {
"enabled": true,
"templateId": "d312fb71-d7d8-4b75-a497-6096a07220b3"
},
"loginPolicy": "Enabled",
"sms": {
"enabled": true,
"messengerId": "0a4bae38-ffef-4c33-b74c-1d50c796f600",
"templateId": "f35e04e6-72ec-4f52-b552-29cf950a4ed6"
}
},
"name": "Playtronics Co.",
"oauthConfiguration": {
"clientCredentialsAccessTokenPopulateLambdaId": "46e120c1-4c22-473f-95b4-e2c187cd20c2"
},
"passwordEncryptionConfiguration": {
"encryptionScheme": "salted-pbkdf2-hmac-sha256",
"encryptionSchemeFactor": 24000,
"modifyEncryptionSchemeOnLogin": false
},
"passwordValidationRules": {
"breachDetection": {
"enabled": true,
"notifyUserEmailTemplateId": "e6c74b53-d43d-471e-ae7e-906456d0f341",
"matchMode": "High",
"onLogin": "Off"
},
"maxLength": 256,
"minLength": 8,
"rememberPreviousPasswords": {
"count": 2,
"enabled": true
},
"requireMixedCase": true,
"requireNonAlpha": true,
"requireNumber": true,
"validateOnLogin": false
},
"rateLimitConfiguration": {
"failedLogin": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"forgotPassword": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"sendEmailVerification": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"sendRegistrationVerification": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"sendPasswordless": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"sendTwoFactor": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
}
},
"registrationConfiguration": {},
"scimServerConfiguration": {
"clientEntityTypeId": "d9ed49f7-1106-4b20-acdb-5cbda76ae77e",
"enabled": true,
"serverEntityTypeId": "919e0ac5-1cf0-4fcf-a8fc-29d77a0d1d8f",
"schemas": {}
},
"ssoConfiguration": {
"deviceTrustTimeToLiveInSeconds": 31536000
},
"themeId": "c6ad3fac-6f32-4db7-91a4-061ff035e871",
"userDeletePolicy": {
"unverified": {
"enabled": true,
"numberOfDaysToRetain": 30
}
},
"usernameConfiguration": {
"unique": {
"enabled": false,
"numberOfDigits": 5,
"separator": "#"
}
},
"webAuthnConfiguration": {
"enabled": true,
"bootstrapWorkflow": {
"authenticatorAttachmentPreference": "crossPlatform",
"enabled": true,
"userVerificationRequirement": "required"
},
"debug": false,
"reauthenticationWorkflow": {
"authenticatorAttachmentPreference": "platform",
"enabled": true,
"userVerificationRequirement": "required"
},
"relyingPartyId": "piedpiper.com",
"relyingPartyName": "Pied Piper"
},
"webhookIds": [
"00000000-0000-0000-0000-000000000042"
]
}
}
This API has been available since 1.14.0
This API has been available since 1.14.0
Request Parameters
tenantId
UUIDDefaults to secure random UUIDThe Id to use for the new Tenant. If not specified a secure random UUID will be generated.
Request Body
sourceTenantId
UUIDrequiredThe Id of an existing Tenant from which a copy will be made. All other values will be copied from the source Tenant to the new Tenant.
tenant.name
StringrequiredThe unique name of the Tenant.
Example request JSON
{
"sourceTenantId": "32306536-3036-6431-3865-646430303332",
"tenant": {
"name": "Playtronics Co. - copied"
}
}
Response
The response for this API contains the Tenant that was created.
Response CodesCode | Description |
---|---|
200 | The request was successful. The response will contain a JSON body. |
400 | The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. |
401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication. |
500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. |
Response Body
tenant.accessControlConfiguration.uiIPAccessControlListId
UUIDAvailable since 1.30.0The Id of the IP Access Control List limiting access to this all applications in this tenant.
tenant.captchaConfiguration.captchaMethod
StringAvailable since 1.30.0The type of captcha method to use.
tenant.captchaConfiguration.enabled
BooleanAvailable since 1.30.0Whether captcha configuration is enabled.
tenant.captchaConfiguration.secretKey
StringAvailable since 1.30.0The secret key for this captcha method.
tenant.captchaConfiguration.siteKey
StringAvailable since 1.30.0The site key for this captcha method.
tenant.captchaConfiguration.threshold
FloatAvailable since 1.30.0The numeric threshold which separates a passing score from a failing one. This value only applies if using either the Google v3 or HCaptcha Enterprise method, otherwise this value is ignored.
tenant.configured
BooleanIndicates the tenant has been configured. It is always true
, except for default tenant when the setup wizard has not been completed, in which case it is false
.
tenant.connectorPolicies
ArrayAvailable since 1.18.0A list of Connector policies. Users will be authenticated against Connectors in order. Each Connector can be included in this list at most once and must exist.
tenant.connectorPolicies[x].connectorId
UUIDAvailable since 1.18.0The identifier of the Connector to which this policy refers.
tenant.connectorPolicies[x].domains
StringAvailable since 1.18.0An list of email domains to which this connector should apply.
A value of ["*"]
indicates this connector applies to all users.
tenant.connectorPolicies[x].migrate
BooleanAvailable since 1.18.0If true, the user’s data will be migrated to FusionAuth at first successful authentication; subsequent authentications will occur against the FusionAuth datastore. If false, the Connector’s source will be treated as authoritative.
tenant.data
ObjectAn object that can hold any information about the Tenant that should be persisted.
tenant.emailConfiguration.additionalHeaders
Array<Object>Available since 1.32.0The additional SMTP headers to be added to each outgoing email. Each SMTP header consists of a name and a value.
tenant.emailConfiguration.debug
BooleanDefaults to falseAvailable since 1.37.0Determines if debug should be enabled to create an event log to assist in debugging SMTP errors.
tenant.emailConfiguration.defaultFromEmail
StringAvailable since 1.16.0The default email address that emails will be sent from when a from address is not provided on an individual email template. This is the address part email address (i.e. Jared Dunn jared@piedpiper.com
).
tenant.emailConfiguration.defaultFromName
StringAvailable since 1.16.0The default From Name used in sending emails when a from name is not provided on an individual email template. This is the display name part of the email address ( i.e. Jared Dunn jared@piedpiper.com
).
tenant.emailConfiguration.emailVerificationEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template used to send emails to users to verify that their email address is valid.
tenant.emailConfiguration.emailUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when their email address is updated.
tenant.emailConfiguration.emailVerifiedEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template used to notify a user that their email address has been verified.
tenant.emailConfiguration.forgotPasswordEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template that is used when a user is sent a forgot password email.
tenant.emailConfiguration.host
StringDefaults to localhostAvailable since 1.8.0The host name of the SMTP server that FusionAuth will use.
Prior to version 1.28.0
this value was required.
tenant.emailConfiguration.implicitEmailVerificationAllowed
Defaults to trueAvailable since 1.32.0When set to true, this allows email to be verified as a result of completing a similar email based workflow such as change password. When set to false, the user must explicitly complete the email verification workflow even if the user has already completed a similar email workflow such as change password.
tenant.emailConfiguration.loginIdInUseOnCreateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when another user attempts to create an account with their login Id.
tenant.emailConfiguration.loginIdInUseOnUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when another user attempts to update an existing account to use their login Id.
tenant.emailConfiguration.loginNewDeviceEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when they log in on a new device.
tenant.emailConfiguration.loginSuspiciousEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a suspicious login occurs.
tenant.emailConfiguration.password
StringAvailable since 1.8.0An optional password FusionAuth will use to authenticate with the SMTP server.
tenant.emailConfiguration.passwordlessEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Passwordless Email Template, sent to users when they start a passwordless login.
tenant.emailConfiguration.passwordResetSuccessEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when they have completed a ‘forgot password’ workflow and their password has been reset.
tenant.emailConfiguration.passwordUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when their password has been updated.
tenant.emailConfiguration.port
IntegerDefaults to 25Available since 1.8.0The port of the SMTP server that FusionAuth will use.
Prior to version 1.28.0
this value was required.
tenant.emailConfiguration.properties
StringAvailable since 1.8.0Custom SMTP configuration properties that may be necessary in some cases. This can contain any Java mail property. It will override anything FusionAuth sets by default.
The following property has a default value:
mail.smtp.ssl.protocols
has a default value ofTLSv1 TLSv1.1 TLSv1.2
.
Since version 1.44.0
, the following two properties have default values:
mail.smtp.timeout
has a default value of2000
.mail.smtp.connectiontimeout
has a default value of2000
.
Here’s an example value which overrides these properties; in this case setting both timeout defaults to 5 seconds.
mail.smtp.timeout=5000\nmail.smtp.connectiontimeout=5000
tenant.emailConfiguration.security
StringDefaults to NONEAvailable since 1.8.0The type of security protocol FusionAuth will use when connecting to the SMTP server. The possible values are:
NONE
- no security will be used. All communications will be sent plaintext.SSL
- SSL will be used to connect to the SMTP server. This protocol is not recommended unless it is the only one your SMTP server supports.TLS
- TLS will be used to connect to the SMTP server. This is the preferred protocol for all SMTP servers.
tenant.emailConfiguration.setPasswordEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password.
tenant.emailConfiguration.twoFactorMethodAddEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a MFA method has been added to their account.
tenant.emailConfiguration.twoFactorMethodRemoveEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a MFA method has been removed from their account.
tenant.emailConfiguration.unverified.allowEmailChangeWhenGated
BooleanDefaults to falseAvailable since 1.27.0When this value is set to true
, the user is allowed to change their email address when they are gated because they haven’t verified their email address.
tenant.emailConfiguration.unverified.behavior
StringDefaults to AllowAvailable since 1.27.0The desired behavior during login for a user that does not have a verified email. The possible values are:
Allow
- the user will be allowed to complete login.Gated
- verification is required before a user can complete login. The use of this value will require a paid plan.
tenant.emailConfiguration.username
StringAvailable since 1.8.0An optional username FusionAuth will to authenticate with the SMTP server.
tenant.emailConfiguration.verificationEmailTemplateId
UUIDThe Id of the Email Template used to send emails to users to verify that their email address is valid. If either the verifyEmail
or verifyEmailWhenChanged
fields are true
, this field is required.
tenant.emailConfiguration.verificationStrategy
StringAvailable since 1.27.0The process by which the user will verify their email address. The possible values are:
ClickableLink
- send the user a code with a clickable link.FormField
- send the user a short code intended to be manually entered into a form field. This is only available when tenant.emailConfiguration.unverified.behavior has theGated
value.
tenant.emailConfiguration.verifyEmail
BooleanDefaults to falseWhether the user’s email addresses are verified when the registers with your application.
tenant.emailConfiguration.verifyEmailWhenChanged
BooleanDefaults to falseWhether the user’s email addresses are verified when the user changes them.
tenant.eventConfiguration.events
ObjectAvailable since 1.8.0A mapping of the configuration for each event type that FusionAuth sends. The event types that are the keys into this Object are:
audit-log.create
- When an audit log is created Available since 1.30.0event-log.create
- When an event log is created Available since 1.30.0jwt.public-key.update
- When a JWT RSA Public / Private keypair may have been changedjwt.refresh
- When an access token is refreshed using a refresh token Available since 1.16.0jwt.refresh-token.revoke
- When a JWT Refresh Token is revokedkickstart.success
- When kickstart has successfully completed Available since 1.30.0user.action
- When a user action is triggereduser.bulk.create
- When multiple users are created in bulk (i.e. during an import)user.create
- When a user is createduser.create.complete
- When a user create transaction has completed Available since 1.30.0user.deactivate
- When a user is deactivateduser.delete
- When a user is deleteduser.delete.complete
- When a user delete transaction has completed Available since 1.30.0user.email.update
- When a user updates their email address Available since 1.30.0user.email.verified
- When a user verifies their email address Available since 1.8.0user.identity-provider.link
- When a link is created from a user to an Identity Provider Available since 1.36.0user.identity-provider.unlink
- When an existing Identity Provider link is removed from a User Available since 1.36.0user.loginId.duplicate.create
- When a request to create a user with a login Id (email or username) which is already in use has been received Available since 1.30.0Note: An Enterprise plan is required to utilize the
user.loginId.duplicate.create
event .user.loginId.duplicate.update
- When a request to update a user and change their login Id (email or username) to one that is already in use has been received Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.loginId.duplicate.update
event .user.login.failed
- When a user fails a login request Available since 1.6.0user.login.new-device
- When a user begins a login request with a new device Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.login.new-device
event .user.login.success
- When a user completes a login request Available since 1.6.0user.login.suspicious
- When a user logs in and is considered to be a potential threat (requires an activated Enterprise license) Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.login.suspicious
event .user.password.breach
- When Reactor detects a user is using a potentially breached password (requires an activated license) Available since 1.15.0
Note: A paid plan is required to utilize the
user.password.breach
event .user.password.reset.send
- When a forgot password email has been sent to a user Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.send
event.user.password.reset.start
- When the process to reset a user password has started Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.start
event.user.password.reset.success
- When a user has successfully reset their password Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.success
event.user.password.update
- When a user has updated their password Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.update
event.user.reactivate
- When a user is reactivateduser.registration.create
- When a user registration is created Available since 1.6.0user.registration.create.complete
- When a user registration create transaction has completed Available since 1.30.0user.registration.delete
- When a user registration is deleted Available since 1.6.0user.registration.delete.complete
- When a user registration delete transaction has completed Available since 1.30.0user.registration.update
- When a user registration is updated Available since 1.6.0user.registration.update.complete
- When a user registration update transaction has completed Available since 1.30.0user.registration.verified
- When a user completes registration verification Available since 1.8.0user.two-factor.method.add
- When a user has added a two-factor method Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.two-factor.method.add
event.user.two-factor.method.remove
- When a user has removed a two-factor method Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.two-factor.method.remove
event.user.update
- When a user is updateduser.update.complete
- When a user update transaction has completed Available since 1.30.0
tenant.eventConfiguration.events[type].enabled
BooleanAvailable since 1.8.0Whether or not FusionAuth should send these types of events to any configured Webhooks.
tenant.eventConfiguration.events[type].transactionType
StringAvailable since 1.8.0The transaction type that FusionAuth uses when sending these types of events to any configured Webhooks. The transaction types are:
None
- No Webhooks are required to succeed for the FusionAuth transaction to be committed.Any
- Only a single Webhook is required to succeed for the FusionAuth transaction to be committed.SimpleMajority
- A simple majority (50% or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.SuperMajority
- A super majority (2/3 or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.AbsoluteMajority
- Every Webhook must succeed for the FusionAuth transaction to be committed.
tenant.externalIdentifierConfiguration.authorizationGrantIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until an OAuth authorization code is no longer valid to be exchanged for an access token. This is essentially the time allowed between the start of an Authorization request during the Authorization code grant and when you request an access token using this authorization code on the Token endpoint.
Value must be greater than 0 and less than or equal to 600.
tenant.externalIdentifierConfiguration.changePasswordIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the change password Id.
If the changePasswordIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the changePasswordIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.changePasswordIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the change password Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.changePasswordIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a change password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.deviceCodeTimeToLiveInSeconds
IntegerAvailable since 1.11.0The time in seconds until a device code Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.deviceUserCodeIdGenerator.length
IntegerAvailable since 1.11.0The length of the secure generator used for generating the device code Id.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.deviceUserCodeIdGenerator.type
StringAvailable since 1.11.0The type of the secure generator used for generating the device code Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.emailVerificationIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the the email verification Id.
If the emailVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.emailVerificationIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the email verification Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.emailVerificationIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until an email verification Id is no longer valid and cannot be used by the Verify Email API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.emailVerificationOneTimeCodeGenerator.length
IntegerAvailable since 1.27.0The length of the secure generator used for generating the email verification one time code.
If the emailVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.emailVerificationOneTimeCodeGenerator.type
StringAvailable since 1.27.0The type of the secure generator used for generating the email verification one time code. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.externalAuthenticationIdTimeToLiveInSeconds
IntegerAvailable since 1.12.0The time in seconds until an external authentication Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.loginIntentTimeToLiveInSeconds
IntegerAvailable since 1.53.0The time in seconds until a Login Timeout identifier is no longer valid to complete post-authentication steps in the OAuth workflow. Must be greater than 0.
tenant.externalIdentifierConfiguration.oneTimePasswordTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a One Time Password is no longer valid and cannot be used by the Login API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.passwordlessLoginGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the passwordless login.
If the passwordlessLoginGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the passwordlessLoginGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.passwordlessLoginGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the passwordless login. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.passwordlessLoginTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a passwordless code is no longer valid and cannot be used by the Passwordless API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.pendingAccountLinkTimeToLiveInSeconds
IntegerAvailable since 1.28.0The number of seconds before the pending account link identifier is no longer valid to complete an account link request.
tenant.externalIdentifierConfiguration.registrationVerificationIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the registration verification Id.
If the registrationVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.registrationVerificationIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the registration verification Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.registrationVerificationIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a registration verification Id is no longer valid and cannot be used by the Verify Registration API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.registrationVerificationOneTimeCodeGenerator.length
IntegerAvailable since 1.27.0The length of the secure generator used for generating the registration verification one time code.
If the registrationVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.registrationVerificationOneTimeCodeGenerator.type
StringAvailable since 1.27.0The type of the secure generator used for generating the registration verification one time code. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.rememberOAuthScopeConsentChoiceTimeToLiveInSeconds
IntegerAvailable since 1.50.0The time in seconds until remembered OAuth scope consent choices are no longer valid, and the User will be prompted to consent to requested OAuth scopes even if they have not changed. Applies only when application.oauthConfiguration.consentMode is set to RememberDecision
. Value must be greater than 0.
tenant.externalIdentifierConfiguration.samlv2AuthNRequestIdTimeToLiveInSeconds
IntegerAvailable since 1.19.0The time in seconds that a SAML AuthN request Id returned by the Start SAML v2 Login Request API will be eligible to be used to complete a SAML v2 Login request.
tenant.externalIdentifierConfiguration.setupPasswordIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the setup password Id.
If the setupPasswordIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the setupPasswordIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.setupPasswordIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the setup password Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.setupPasswordIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a setup password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.trustTokenTimeToLiveInSeconds
IntegerAvailable since 1.33.0The number of seconds before the Trust Token is no longer valid to complete a request that requires trust. Value must be greater than 0.
tenant.externalIdentifierConfiguration.twoFactorIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a two factor Id is no longer valid and cannot be used by the Two Factor Login API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.twoFactorOneTimeCodeIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the the two factor one time code Id.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.twoFactorOneTimeCodeIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the two factor code Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.twoFactorOneTimeCodeIdTimeToLiveInSeconds
IntegerAvailable since 1.26.0The number of seconds before the Two-Factor One Time Code used to enable or disable a two-factor method is no longer valid. Must be greater than 0.
tenant.externalIdentifierConfiguration.twoFactorTrustIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until an issued Two Factor trust Id is no longer valid and the User will be required to complete Two Factor authentication during the next authentication attempt. Value must be greater than 0.
tenant.externalIdentifierConfiguration.webAuthnAuthenticationChallengeTimeToLiveInSeconds
IntegerAvailable since 1.41.0The time in seconds until a WebAuthn authentication challenge is no longer valid and the User will be required to restart the WebAuthn authentication ceremony by creating a new challenge. This value also controls the timeout for the client-side WebAuthn navigator.credentials.get
API call. Value must be greater than 0.
tenant.externalIdentifierConfiguration.webAuthnRegistrationChallengeTimeToLiveInSeconds
IntegerAvailable since 1.41.0The time in seconds until a WebAuthn registration challenge is no longer valid and the User will be required to restart the WebAuthn registration ceremony by creating a new challenge. This value also controls the timeout for the client-side WebAuthn navigator.credentials.create
API call. Value must be greater than 0.
tenant.failedAuthenticationConfiguration.actionCancelPolicy.onPasswordReset
BooleanAvailable since 1.42.0Indicates whether you want the user to be able to self-service unlock their account prior to the action duration by completing a password reset workflow.
tenant.failedAuthenticationConfiguration.actionDuration
LongAvailable since 1.8.0The duration of the User Action. This value along with the actionDurationUnit
will be used to set the duration of the User Action. Value must be greater than 0.
tenant.failedAuthenticationConfiguration.actionDurationUnit
StringAvailable since 1.8.0The unit of time associated with a duration. The possible values are:
MINUTES
HOURS
DAYS
WEEKS
MONTHS
YEARS
tenant.failedAuthenticationConfiguration.emailUser
StringAvailable since 1.42.0Indicates you would like to email the user when the user’s account is locked due to this action being taken. This requires the User Action specified by the tenant.failedAuthenticationConfiguration.userActionId to also be configured for email. If the User Action is not configured to be able to email the user, this configuration will be ignored. See userEmailingEnabled on the User Action.
tenant.failedAuthenticationConfiguration.resetCountInSeconds
IntegerAvailable since 1.8.0The length of time in seconds before the failed authentication count will be reset. Value must be greater than 0.
For example, if tooManyAttempts
is set to 5
and you fail to authenticate 4
times in a row, waiting for the duration specified here will cause your fifth attempt to start back at 1
.
tenant.failedAuthenticationConfiguration.tooManyAttempts
IntegerAvailable since 1.8.0The number of failed attempts considered to be too many. Once this threshold is reached the specified User Action will be applied to the user for the duration specified. Value must be greater than 0.
tenant.failedAuthenticationConfiguration.userActionId
UUIDAvailable since 1.8.0The Id of the User Action that is applied when the threshold is reached for too many failed authentication attempts.
tenant.familyConfiguration.allowChildRegistrations
BooleanAvailable since 1.8.0Whether to allow child registrations.
tenant.familyConfiguration.confirmChildEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use when confirming a child.
tenant.familyConfiguration.deleteOrphanedAccounts
BooleanAvailable since 1.8.0Indicates that child users without parental verification will be permanently deleted after tenant.familyConfiguration.deleteOrphanedAccountsDays days.
tenant.familyConfiguration.deleteOrphanedAccountsDays
IntegerAvailable since 1.8.0The number of days from creation child users will be retained before being deleted for not completing parental verification. Value must be greater than 0.
tenant.familyConfiguration.enabled
BooleanAvailable since 1.8.0Whether family configuration is enabled.
tenant.familyConfiguration.familyRequestEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use when a family request is made.
tenant.familyConfiguration.maximumChildAge
IntegerAvailable since 1.8.0The maximum age of a child. Value must be greater than 0.
tenant.familyConfiguration.minimumOwnerAge
IntegerAvailable since 1.8.0The minimum age to be an owner. Value must be greater than 0.
tenant.familyConfiguration.parentEmailRequired
BooleanAvailable since 1.8.0Whether a parent email is required.
tenant.familyConfiguration.parentRegistrationEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use for parent registration.
tenant.formConfiguration.adminUserFormId
UUIDAvailable since 1.20.0The unique Id of the form to use for the Add and Edit User form when used in the FusionAuth admin UI.
tenant.httpSessionMaxInactiveInterval
IntegerAvailable since 1.8.0Time in seconds until an inactive session will be invalidated. Used when creating a new session in the FusionAuth OAuth frontend.
tenant.id
UUIDThe unique identifier for this Tenant.
tenant.insertInstant
LongThe instant that the Tenant was added to the FusionAuth database.
tenant.issuer
StringAvailable since 1.8.0The named issuer used to sign tokens, this is generally your public fully qualified domain.
tenant.jwtConfiguration.accessTokenKeyId
UUIDAvailable since 1.8.0The unique id of the signing key used to sign the access token.
tenant.jwtConfiguration.idTokenKeyId
UUIDAvailable since 1.8.0The unique id of the signing key used to sign the Id token.
tenant.jwtConfiguration.refreshTokenExpirationPolicy
StringAvailable since 1.17.0The Refresh Token expiration policy.
The possible values are:
Fixed
- the expiration is calculated from the time the token is issued.SlidingWindow
- the expiration is calculated from the last time the token was used.SlidingWindowWithMaximumLifetime
- the expiration is calculated from the last time the token was used, or until the maximumTimeToLiveInMinutes is reached. Available since 1.46.0
tenant.jwtConfiguration.refreshTokenRevocationPolicy.onLoginPrevented
BooleanAvailable since 1.17.0When enabled, all refresh tokens will be revoked when a user action, such as locking an account based on a number of failed login attempts, prevents user login.
tenant.jwtConfiguration.refreshTokenRevocationPolicy.onMultiFactorEnable
BooleanAvailable since 1.42.0When enabled, all refresh tokens will be revoked when a user enables multi-factor authentication for the first time. This policy will not be applied when adding subsequent multi-factor methods to the user.
tenant.jwtConfiguration.refreshTokenRevocationPolicy.onPasswordChanged
BooleanAvailable since 1.17.0When enabled, all refresh tokens will be revoked when a user changes their password.
tenant.jwtConfiguration.refreshTokenSlidingWindowConfiguration.maximumTimeToLiveInMinutes
IntegerAvailable since 1.46.0The maximum lifetime of a refresh token when using a refreshTokenExpirationPolicy of SlidingWindowWithMaximumLifetime
.
tenant.jwtConfiguration.refreshTokenTimeToLiveInMinutes
IntegerAvailable since 1.8.0The length of time in minutes a Refresh Token is valid from the time it was issued. Value must be greater than 0.
tenant.jwtConfiguration.refreshTokenUsagePolicy
StringAvailable since 1.17.0The refresh token usage policy. The following are valid values:
-
Reusable
- the token does not change after it was issued. -
OneTimeUse
- the token value will be changed each time the token is used to refresh a JWT. The client must store the new value after each usage.tenant.jwtConfiguration.timeToLiveInSeconds
IntegerAvailable since 1.8.0The length of time in seconds this JWT is valid from the time it was issued. Value must be greater than 0.
tenant.lambdaConfiguration.loginValidationId
UUIDAvailable since 1.53.0The Id of the lambda that will be invoked at the end of a successful login request in order to extend custom validation of a login request.
tenant.lambdaConfiguration.scimEnterpriseUserRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Request Lambda that will be used to convert the SCIM Enterprise User request to a FusionAuth User.
tenant.lambdaConfiguration.scimEnterpriseUserResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth Enterprise User to a SCIM Server response.
tenant.lambdaConfiguration.scimGroupRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM Group Request Lambda that will be used to convert the SCIM Group request to a FusionAuth Group.
tenant.lambdaConfiguration.scimGroupResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM GroupResponse Lambda that will be used to convert a FusionAuth Group to a SCIM Server response.
tenant.lambdaConfiguration.scimUserRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Request Lambda that will be used to convert the SCIM User request to a FusionAuth User.
tenant.lambdaConfiguration.scimUserResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth User to a SCIM Server response.
tenant.lastUpdateInstant
LongThe instant that the Tenant was last updated in the FusionAuth database.
tenant.loginConfiguration.requireAuthentication
BooleanAvailable since 1.26.0Indicates whether to require an API key for the Login API when an
applicationId
is not provided. When anapplicationId
is provided to the Login API call, the application configuration will take precedence.tenant.logoutURL
StringAvailable since 1.8.0The logout redirect URL when sending the user’s browser to the
/oauth2/logout
URI of the FusionAuth Front End. This value is only used when a logout URL is not defined in your Application.tenant.maximumPasswordAge.days
IntegerAvailable since 1.8.0The password maximum age in days. The number of days after which FusionAuth will require a user to change their password. Required when tenant.maximumPasswordAge.enabled is set to
true
.tenant.maximumPasswordAge.enabled
BooleanAvailable since 1.8.0Indicates that the maximum password age is enabled and being enforced.
tenant.minimumPasswordAge.seconds
IntegerAvailable since 1.8.0The password minimum age in seconds. When enabled FusionAuth will not allow a password to be changed until it reaches this minimum age. Required when tenant.minimumPasswordAge.enabled is set to
true
.tenant.minimumPasswordAge.enabled
BooleanAvailable since 1.8.0Indicates that the minimum password age is enabled and being enforced.
tenant.multiFactorConfiguration.authenticator.algorithm
StringAvailable since 1.26.0The algorithm used by the TOTP authenticator. This value is
HmacSHA1
and read only.tenant.multiFactorConfiguration.authenticator.codeLength
IntegerAvailable since 1.26.0The length of the code generated by the TOTP. This value is
6
and read only.tenant.multiFactorConfiguration.authenticator.enabled
BooleanAvailable since 1.26.0When enabled, users may utilize an authenticator application to complete a multi-factor authentication request. This method uses TOTP (Time-Based One-Time Password) as defined in RFC 6238 and often uses an native mobile app such as Google Authenticator.
tenant.multiFactorConfiguration.authenticator.timeStep
IntegerAvailable since 1.26.0The time-step size in seconds. This value is
30
and read only.tenant.multiFactorConfiguration.email.enabled
BooleanAvailable since 1.26.0When enabled, users may utilize an email address to complete a two-factor authentication request.
tenant.multiFactorConfiguration.email.templateId
UUIDAvailable since 1.26.0The Id of the email template that is used when notifying a user to complete a two-factor authentication request.
tenant.multiFactorConfiguration.sms.enabled
BooleanAvailable since 1.26.0When enabled, users may utilize a mobile phone number to complete a two-factor authentication request.
tenant.multiFactorConfiguration.sms.messengerId
UUIDAvailable since 1.26.0The messenger that is used to deliver a SMS two-factor authentication request.
tenant.multiFactorConfiguration.sms.templateId
UUIDAvailable since 1.26.0The Id of the SMS template that is used when notifying a user to complete a two-factor authentication request.
tenant.name
StringThe unique name of the Tenant.
tenant.oauthConfiguration.clientCredentialsAccessTokenPopulateLambdaId
UUIDAvailable since 1.26.0The Id of a lambda that will be called to populate the JWT during a client credentials grant.
tenant.passwordEncryptionConfiguration.encryptionScheme
StringAvailable since 1.8.0The default method for encrypting the User’s password. The following encryptors are provided with FusionAuth:
- salted-md5
- salted-sha256
- salted-hmac-sha256
- salted-pbkdf2-hmac-sha256
- salted-pbkdf2-hmac-sha256-512 available since 1.34.0
- salted-pbkdf2-hmac-sha512-512 available since 1.43.0
- bcrypt
- phpass-md5 available since 1.45.0
- phpass-sha512 available since 1.45.0
tenant.passwordEncryptionConfiguration.encryptionSchemeFactor
IntegerAvailable since 1.8.0The factor used by the password encryption scheme. If not provided, the
PasswordEncryptor
provides a default value. Generally this will be used as an iteration count to generate the hash. The actual use of this value is up to thePasswordEncryptor
implementation.tenant.passwordEncryptionConfiguration.modifyEncryptionSchemeOnLogin
BooleanAvailable since 1.8.0When enabled a user’s hash configuration will be modified to match these configured settings. This can be useful to increase a password hash strength over time or upgrade imported users to a more secure encryption scheme after an initial import.
Beginning in version
1.42.0
when this configuration is enabled, in addition to re-hashing on login, the password will be re-hashed on password change as well.tenant.passwordValidationRules.breachDetection.enabled
BooleanAvailable since 1.15.0Whether to enable Reactor breach detection. Requires an activated license.
tenant.passwordValidationRules.breachDetection.matchMode
StringAvailable since 1.15.0The level of severity where Reactor will consider a breach. The following are valid values:
High
Only requires a password match, this is the most secure and is recommendedMedium
Exact match on username, email address or email sub-addressLow
Exact match on an email or username, or the password is a common breached value
tenant.passwordValidationRules.breachDetection.notifyUserEmailTemplateId
UUIDAvailable since 1.15.0The Id of the email template to use when notifying a user of a breached password.
tenant.passwordValidationRules.breachDetection.onLogin
StringAvailable since 1.15.0The behavior when detecting breaches at time of user login. The following are valid values:
Off
Do not perform breach detection at loginRecordOnly
Only record the result, take no actionNotifyUser
Notify the end user via emailRequireChange
Require immediate password change
tenant.passwordValidationRules.maxLength
IntegerAvailable since 1.8.0The maximum length of a password when a new user is created or a user requests a password change.
tenant.passwordValidationRules.minLength
IntegerAvailable since 1.8.0The minimum length of a password when a new user is created or a user requests a password change.
tenant.passwordValidationRules.rememberPreviousPasswords.count
IntegerAvailable since 1.8.0The number of previous passwords to remember. Value must be greater than 0.
tenant.passwordValidationRules.rememberPreviousPasswords.enabled
BooleanAvailable since 1.8.0Whether to prevent a user from using any of their previous passwords.
tenant.passwordValidationRules.requireMixedCase
BooleanAvailable since 1.8.0Whether to force the user to use at least one uppercase and one lowercase character.
tenant.passwordValidationRules.requireNonAlpha
BooleanAvailable since 1.8.0Whether to force the user to use at least one non-alphanumeric character.
tenant.passwordValidationRules.requireNumber
BooleanAvailable since 1.8.0Whether to force the user to use at least one number.
tenant.passwordValidationRules.validateOnLogin
BooleanAvailable since 1.15.0When enabled the user’s password will be validated during login. If the password does not meet the currently configured validation rules the user will be required to change their password.
tenant.rateLimitConfiguration.failedLogin.limit
IntegerAvailable since 1.30.0The number of times a user can fail to login within the configured timePeriodInSeconds duration. If a Failed authentication action has been configured then it will take precedence.
tenant.rateLimitConfiguration.failedLogin.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can fail login before being rate limited.
tenant.rateLimitConfiguration.forgotPassword.limit
IntegerAvailable since 1.30.0The number of times a user can request a forgot password email within the configured timePeriodInSeconds duration.
tenant.rateLimitConfiguration.forgotPassword.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a forgot password email before being rate limited.
tenant.rateLimitConfiguration.sendEmailVerification.limit
IntegerAvailable since 1.30.0The number of times a user can request a verification email within the configured timePeriodInSeconds duration.
tenant.rateLimitConfiguration.sendEmailVerification.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a verification email before being rate limited.
tenant.rateLimitConfiguration.sendPasswordless.limit
IntegerAvailable since 1.30.0The number of times a user can request a passwordless login email within the configured timePeriodInSeconds duration.
tenant.rateLimitConfiguration.sendPasswordless.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a passwordless login email before being rate limited.
tenant.rateLimitConfiguration.sendRegistrationVerification.limit
IntegerAvailable since 1.30.0The number of times a user can request a registration verification email within the configured timePeriodInSeconds duration.
tenant.rateLimitConfiguration.sendRegistrationVerification.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a registration verification email before being rate limited.
tenant.rateLimitConfiguration.sendTwoFactor.limit
IntegerAvailable since 1.30.0The number of times a user can request a two-factor code by email or SMS within the configured timePeriodInSeconds duration.
tenant.rateLimitConfiguration.sendTwoFactor.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a two-factor code by email or SMS before being rate limited.
tenant.registrationConfiguration.blockedDomains
Array<String>Available since 1.30.0A list of unique domains that are not allowed to register when self service is enabled.
tenant.scimServerConfiguration.clientEntityTypeId
UUIDAvailable since 1.36.0The Entity Type that will be used to represent SCIM Clients for this tenant.
tenant.scimServerConfiguration.enabled
BooleanAvailable since 1.36.0Whether or not this tenant has the SCIM endpoints enabled.
tenant.scimServerConfiguration.schemas
MapAvailable since 1.36.0JSON formatted as a SCIM Schemas endpoint response. Because the SCIM lambdas may modify the JSON response, ensure the Schema’s response matches that generated by the response lambdas. More about Schema definitions.
tenant.scimServerConfiguration.serverEntityTypeId
UUIDAvailable since 1.36.0The Entity Type that will be used to represent SCIM Servers for this tenant.
tenant.ssoConfiguration.deviceTrustTimeToLiveInSeconds
IntegerAvailable since 1.30.2The number of seconds before a trusted device is reset. When reset, a user is forced to complete captcha during login and complete two factor authentication if applicable.
tenant.state
StringAvailable since 1.22.0The current state of the tenant. The following are valid values:
Active
- The tenant is active.PendingDelete
- A delete request has been requested and is being processed.
tenant.themeId
UUIDAvailable since 1.8.0The unique Id of the theme to be used to style the login page and other end user templates.
tenant.userDeletePolicy.unverified.enabled
BooleanAvailable since 1.13.0Indicates that users without a verified email address will be permanently deleted after tenant.userDeletePolicy.unverified.numberOfDaysToRetain days.
tenant.userDeletePolicy.unverified.enabledInstant
LongAvailable since 1.48.0The instant that this policy was enabled.
Users created before this time will not be eligible to be deleted. This means that you can safely enable this feature and the policy will only be enforced for users created after this policy was enabled. If you would like to delete users created prior to this policy being enabled that have an unverified email address, you can use the User Search API or User Bulk Delete API to search on the
insertInstant
andverified
fields to identify users that you would like to delete.For example, the following query string will return users that were created at least 7 days ago that have not verified their email address.
insertInstant:<now-7d AND verified:false
Please note that prior to version
1.48.0
, when enabling this policy all user’s with an unverified email were eligible for deletion.tenant.userDeletePolicy.unverified.numberOfDaysToRetain
IntegerAvailable since 1.13.0The number of days from creation users will be retained before being deleted for not completing email verification. Value must be greater than 0.
tenant.usernameConfiguration.unique.enabled
BooleanAvailable since 1.27.0When
true
, FusionAuth will handle username collisions by generating a random suffix. Users with colliding usernames will be able to use the same one, but in the admin and API interfaces, a unique username will be displayed.tenant.usernameConfiguration.unique.numberOfDigits
IntegerAvailable since 1.27.0The maximum number of digits to use when building a unique suffix for a username. A number will be randomly selected and will be 1 or more digits up to this configured value in length. For example, if this value is
5
, the suffix will be a number between00001
and99999
, inclusive.tenant.usernameConfiguration.unique.separator
StringAvailable since 1.27.0A single character to use as a separator from the requested username and a unique suffix that is added when a duplicate username is detected. This value can be a single non alphanumeric ASCII character.
tenant.usernameConfiguration.unique.strategy
StringAvailable since 1.29.0This strategy instructions FusionAuth when to append a unique suffix to the username. The possible values are:
Always
- Always append a unique suffix even when the requested username is not in use.OnCollision
- Only append a unique suffix when the requested username is in use.
tenant.webAuthnConfiguration.bootstrapWorkflow.authenticatorAttachmentPreference
StringAvailable since 1.41.0The authenticator attachment requirement for WebAuthn passkey registration when using the bootstrap workflow. The possible values are:
any
- An authenticator with any attachment modality will be allowed during registration.crossPlatform
- Only authenticators with thecross-platform
attachment modality will be allowed during registration. These are also referred to as “roaming” authenticators.platform
- Only authenticators with theplatform
attachment modality will be allowed during registration.
tenant.webAuthnConfiguration.bootstrapWorkflow.enabled
BooleanAvailable since 1.41.0Whether the WebAuthn bootstrap workflow is enabled.
tenant.webAuthnConfiguration.bootstrapWorkflow.userVerificationRequirement
StringAvailable since 1.41.0The user verification requirement for WebAuthn passkey registration and authentication when using the bootstrap workflow. The possible values are:
discouraged
- If possible, do not require user verification during registration and authentication.preferred
- Prefer authenticators that support user verification during registration and authentication but allow others.required
- Only authenticators that support user verification will be allowed.
tenant.webAuthnConfiguration.debug
BooleanAvailable since 1.41.0Whether debug event log output is enabled for WebAuthn.
tenant.webAuthnConfiguration.enabled
BooleanAvailable since 1.41.0Whether WebAuthn configuration is enabled.
tenant.webAuthnConfiguration.reauthenticationWorkflow.authenticatorAttachmentPreference
StringAvailable since 1.41.0The authenticator attachment requirement for WebAuthn passkey registration when using the reauthentication workflow. The possible values are:
any
- An authenticator with any attachment modality will be allowed during registration.crossPlatform
- Only authenticators with thecross-platform
attachment modality will be allowed during registration. These are also referred to as “roaming” authenticators.platform
- Only authenticators with theplatform
attachment modality will be allowed during registration.
tenant.webAuthnConfiguration.reauthenticationWorkflow.enabled
BooleanAvailable since 1.41.0Whether the WebAuthn reauthentication workflow is enabled.
tenant.webAuthnConfiguration.reauthenticationWorkflow.userVerificationRequirement
StringAvailable since 1.41.0The user verification requirement for WebAuthn passkey registration and authentication when using the reauthentication workflow. The possible values are:
discouraged
- If possible, do not require user verification during registration and authentication.preferred
- Prefer authenticators that support user verification during registration and authentication but allow others.required
- Only authenticators that support user verification will be allowed.
tenant.webAuthnConfiguration.relyingPartyId
StringAvailable since 1.41.0The Relying Party Id the tenant will use in WebAuthn ceremonies. Passkeys can only be used to authenticate on sites using the same Relying Party Id they were registered with.
The default value is
null
, which instructs the WebAuthn JavaScript API to use the browser origin.tenant.webAuthnConfiguration.relyingPartyName
StringAvailable since 1.41.0The Relying Party name the tenant will use in WebAuthn ceremonies. This value is used only for display and may be shown by browser or OS dialogs during WebAuthn ceremonies.
If no value is configured, the tenant.issuer value will be used.
Example Response JSON
{
"tenant": {
"accessControlConfiguration": {
"uiIPAccessControlListId": "11d49de7-69f6-46fc-8270-0b3aa626327a"
},
"configured": true,
"captchaConfiguration": {
"captchaMethod": "GoogleRecaptchaV3",
"enabled": true,
"secretKey": "6LdYWpMbAAAAAKhcksgk70us00012r66r96tt7rp",
"siteKey": "6LdYWpMbAAAAAKhcksgk75tz00022r66ombcfadr",
"threshold": 0.5
},
"connectorPolicies": [
{
"connectorId": "e3306678-a53a-4964-9040-1c96f36dda72",
"domains": [
"*"
],
"migrate": false
},
{
"connectorId": "27f22280-7e55-4d1c-b9f8-239bf9cc1a5e",
"domains": [
"*"
],
"migrate": true
}
],
"data": {
"description": "No more secrets, Marty."
},
"emailConfiguration": {
"additionalHeaders": [
{
"name": "X-SES-CONFIGURATION-SET",
"value": "example_configuration_set_name"
}
],
"defaultFromEmail": "jared@piedpiper.com",
"defaultFromName": "Jared Dunn",
"emailUpdateEmailTemplateId": "ec3045c7-97d8-47f8-8725-61b93deacf5d",
"emailVerifiedEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
"forgotPasswordEmailTemplateId": "49aba1de-0225-45d7-a2b1-f9fe46b0242c",
"host": "smtp.sendgrid.net",
"implicitEmailVerificationAllowed": true,
"loginIdInUseOnCreateEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginIdInUseOnUpdateEmailTemplateId": "2c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginNewDeviceEmailTemplateId": "3c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginSuspiciousEmailTemplateId": "4c3045c7-97d8-47f8-8725-61b93deacf5d",
"password": "password",
"passwordlessEmailTemplateId": "a917e23a-da58-4cda-be01-90f542f8c343",
"passwordResetSuccessEmailTemplateId": "5c3045c7-97d8-47f8-8725-61b93deacf5d",
"passwordUpdateEmailTemplateId": "6c3045c7-97d8-47f8-8725-61b93deacf5d",
"port": 587,
"properties": {
"key": "value"
},
"security": "TLS",
"setPasswordEmailTemplateId": "a9aba13e-0125-4fd7-a2b1-aaa146b02423",
"twoFactorMethodAddEmailTemplateId": "7c3045c7-97d8-47f8-8725-61b93deacf5d",
"twoFactorMethodRemoveEmailTemplateId": "8c3045c7-97d8-47f8-8725-61b93deacf5d",
"unverified": {
"allowEmailChangeWhenGated": false,
"behavior": "Allow"
},
"username": "username",
"verificationEmailTemplateId": "8da42c09-461c-45f3-b931-6e9f63b87ab5",
"verificationStrategy": "FormField",
"verifyEmail": true,
"verifyEmailWhenChanged": true
},
"eventConfiguration": {
"events": {
"user.delete": {
"enabled": true,
"transactionType": "None"
},
"user.create": {
"enabled": true,
"transactionType": "None"
},
"user.update": {
"enabled": true,
"transactionType": "None"
},
"user.deactivate": {
"enabled": true,
"transactionType": "None"
},
"user.bulk.create": {
"enabled": true,
"transactionType": "None"
},
"user.reactivate": {
"enabled": true,
"transactionType": "None"
},
"jwt.refresh": {
"enabled": true,
"transactionType": "None"
},
"jwt.refresh-token.revoke": {
"enabled": true,
"transactionType": "None"
},
"jwt.public-key.update": {
"enabled": true,
"transactionType": "None"
},
"user.login.success": {
"enabled": true,
"transactionType": "None"
},
"user.login.failed": {
"enabled": true,
"transactionType": "None"
},
"user.password.breach": {
"enabled": true,
"transactionType": "None"
},
"user.registration.create": {
"enabled": true,
"transactionType": "None"
},
"user.registration.update": {
"enabled": true,
"transactionType": "None"
},
"user.registration.delete": {
"enabled": true,
"transactionType": "None"
},
"user.registration.verified": {
"enabled": true,
"transactionType": "None"
},
"user.email.verified": {
"enabled": true,
"transactionType": "None"
}
}
},
"externalIdentifierConfiguration": {
"authorizationGrantIdTimeToLiveInSeconds": 30,
"changePasswordIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"changePasswordIdTimeToLiveInSeconds": 600,
"deviceCodeTimeToLiveInSeconds": 1800,
"deviceUserCodeIdGenerator": {
"length": 6,
"type": "randomAlphaNumeric"
},
"emailVerificationIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"emailVerificationIdTimeToLiveInSeconds": 86400,
"emailVerificationOneTimeCodeGenerator": {
"length": 6,
"type": "randomAlphaNumeric"
},
"externalAuthenticationIdTimeToLiveInSeconds": 300,
"loginIntentTimeToLiveInSeconds": 1800,
"oneTimePasswordTimeToLiveInSeconds": 60,
"passwordlessLoginGenerator": {
"length": 32,
"type": "randomBytes"
},
"passwordlessLoginTimeToLiveInSeconds": 180,
"pendingAccountLinkTimeToLiveInSeconds": 3600,
"registrationVerificationIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"registrationVerificationIdTimeToLiveInSeconds": 86400,
"registrationVerificationOneTimeCodeGenerator": {
"length": 6,
"type": "randomAlphaNumeric"
},
"rememberOAuthScopeConsentChoiceTimeToLiveInSeconds": 2592000,
"samlv2AuthNRequestIdTimeToLiveInSeconds": 300,
"setupPasswordIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"setupPasswordIdTimeToLiveInSeconds": 86400,
"trustTokenTimeToLiveInSeconds": 180,
"twoFactorIdTimeToLiveInSeconds": 300,
"twoFactorOneTimeCodeIdGenerator": {
"length": 6,
"type": "randomDigits"
},
"twoFactorOneTimeCodeIdTimeToLiveInSeconds": 60,
"twoFactorTrustIdTimeToLiveInSeconds": 2592000,
"webAuthnAuthenticationChallengeTimeToLiveInSeconds": 180,
"webAuthnRegistrationChallengeTimeToLiveInSeconds": 180
},
"failedAuthenticationConfiguration": {
"actionCancelPolicy": {
"onPasswordReset": false
},
"actionDuration": 3,
"actionDurationUnit": "MINUTES",
"emailUser": false,
"resetCountInSeconds": 60,
"tooManyAttempts": 5,
"userActionId": "16cfc707-268c-4c5b-8989-f71f3ee156d4"
},
"familyConfiguration": {
"allowChildRegistrations": true,
"confirmChildEmailTemplateId": "87654321-4321-8765-ba09-ba0987654321",
"deleteOrphanedAccounts": false,
"deleteOrphanedAccountsDays": 30,
"enabled": true,
"familyRequestEmailTemplateId": "57462514-a73b-cd76-0001-b8a65cd61230",
"maximumChildAge": 12,
"minimumOwnerAge": 21,
"parentEmailRequired": false,
"parentRegistrationEmailTemplateId": "12345678-1234-5678-90ab-1234567890ab"
},
"formConfiguration": {
"adminUserFormId": "e92751a5-25f4-4bca-ad91-66cdf67725d2"
},
"httpSessionMaxInactiveInterval": 3600,
"id": "32306536-3036-6431-3865-646430303332",
"insertInstant": 1572469040579,
"issuer": "https://example.com",
"jwtConfiguration": {
"accessTokenKeyId": "025233ca-d4f3-2aa4-eca9-7e4200e9b472",
"enabled": true,
"idTokenKeyId": "092dbedc-30af-4149-9c61-b578f2c72f59",
"refreshTokenExpirationPolicy": "Fixed",
"refreshTokenRevocationPolicy": {
"onLoginPrevented": true,
"onMultiFactorEnable": true,
"onPasswordChanged": true
},
"refreshTokenTimeToLiveInMinutes": 43200,
"refreshTokenUsagePolicy": "Reusable",
"timeToLiveInSeconds": 3600
},
"lambdaConfiguration": {
"loginValidationId": "c0dd79db-38dd-424b-b77a-4dccaad71052",
"scimEnterpriseUserRequestConverterId": "c2e70f8d-19bb-4df7-848a-33a9a1e26b84",
"scimEnterpriseUserResponseConverterId": "44fc9553-8a2e-408f-8aa2-fa65b70b55e2",
"scimGroupRequestConverterId": "66d65de0-1819-42f8-86ed-7daaa4e155dc",
"scimGroupResponseConverterId": "79812ede-432f-4375-9b43-23c0fe996fef",
"scimUserRequestConverterId": "8a51d7a1-5e3e-442a-b96a-0c31379bb3d4",
"scimUserResponseConverterId": "c8720843-dc4f-4e6c-b6ca-500e9c44695f"
},
"lastUpdateInstant": 1595361143101,
"loginConfiguration": {
"requireAuthentication": true
},
"logoutURL": "http://example.com/logout",
"maximumPasswordAge": {
"days": 180,
"enabled": false
},
"minimumPasswordAge": {
"enabled": false,
"seconds": 30
},
"multiFactorConfiguration": {
"authenticator": {
"algorithm": "HmacSHA1",
"codeLength": 6,
"enabled": true,
"timeStep": 30
},
"email": {
"enabled": true,
"templateId": "d312fb71-d7d8-4b75-a497-6096a07220b3"
},
"loginPolicy": "Enabled",
"sms": {
"enabled": true,
"messengerId": "0a4bae38-ffef-4c33-b74c-1d50c796f600",
"templateId": "f35e04e6-72ec-4f52-b552-29cf950a4ed6"
}
},
"name": "Playtronics Co.",
"oauthConfiguration": {
"clientCredentialsAccessTokenPopulateLambdaId": "46e120c1-4c22-473f-95b4-e2c187cd20c2"
},
"passwordEncryptionConfiguration": {
"encryptionScheme": "salted-pbkdf2-hmac-sha256",
"encryptionSchemeFactor": 24000,
"modifyEncryptionSchemeOnLogin": false
},
"passwordValidationRules": {
"breachDetection": {
"enabled": true,
"notifyUserEmailTemplateId": "e6c74b53-d43d-471e-ae7e-906456d0f341",
"matchMode": "High",
"onLogin": "Off"
},
"maxLength": 256,
"minLength": 8,
"rememberPreviousPasswords": {
"count": 2,
"enabled": true
},
"requireMixedCase": true,
"requireNonAlpha": true,
"requireNumber": true,
"validateOnLogin": false
},
"rateLimitConfiguration": {
"failedLogin": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"forgotPassword": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"sendEmailVerification": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"sendRegistrationVerification": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"sendPasswordless": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"sendTwoFactor": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
}
},
"registrationConfiguration": {},
"scimServerConfiguration": {
"clientEntityTypeId": "d9ed49f7-1106-4b20-acdb-5cbda76ae77e",
"enabled": true,
"serverEntityTypeId": "919e0ac5-1cf0-4fcf-a8fc-29d77a0d1d8f",
"schemas": {}
},
"ssoConfiguration": {
"deviceTrustTimeToLiveInSeconds": 31536000
},
"state": "Active",
"themeId": "c6ad3fac-6f32-4db7-91a4-061ff035e871",
"userDeletePolicy": {
"unverified": {
"enabled": true,
"enabledInstant": 1698772159415,
"numberOfDaysToRetain": 30
}
},
"usernameConfiguration": {
"unique": {
"enabled": false,
"numberOfDigits": 5,
"separator": "#",
"strategy": "OnCollision"
}
},
"webAuthnConfiguration": {
"enabled": true,
"bootstrapWorkflow": {
"authenticatorAttachmentPreference": "crossPlatform",
"enabled": true,
"userVerificationRequirement": "required"
},
"debug": false,
"reauthenticationWorkflow": {
"authenticatorAttachmentPreference": "platform",
"enabled": true,
"userVerificationRequirement": "required"
},
"relyingPartyId": "piedpiper.com",
"relyingPartyName": "Pied Piper"
}
}
}
Retrieve a Tenant
This API is used to retrieve a single Tenant by unique Id or all of the configured Tenants.
Request
Request Parameters
tenantId
UUIDrequiredThe unique Id of the Tenant to retrieve.
Request Headers
X-FusionAuth-TenantId
StringThe unique Id of the tenant used to scope this API request.
The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.
Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.
See Making an API request using a Tenant Id for additional information.
Response
The response for this API contains either a single Tenant or all of the Tenants. When you call this API with an Id the response will contain a single Tenant. When you call this API without an Id the response will contain all of the Tenants. Both response types are defined below along with an example JSON response.
Response CodesCode | Description |
---|---|
200 | The request was successful. The response will contain a JSON body. |
400 | The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. |
401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication. |
404 | The object you requested doesn't exist. The response will be empty. |
500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. |
Response Body
tenant.accessControlConfiguration.uiIPAccessControlListId
UUIDAvailable since 1.30.0The Id of the IP Access Control List limiting access to this all applications in this tenant.
tenant.captchaConfiguration.captchaMethod
StringAvailable since 1.30.0The type of captcha method to use.
tenant.captchaConfiguration.enabled
BooleanAvailable since 1.30.0Whether captcha configuration is enabled.
tenant.captchaConfiguration.secretKey
StringAvailable since 1.30.0The secret key for this captcha method.
tenant.captchaConfiguration.siteKey
StringAvailable since 1.30.0The site key for this captcha method.
tenant.captchaConfiguration.threshold
FloatAvailable since 1.30.0The numeric threshold which separates a passing score from a failing one. This value only applies if using either the Google v3 or HCaptcha Enterprise method, otherwise this value is ignored.
tenant.configured
BooleanIndicates the tenant has been configured. It is always true
, except for default tenant when the setup wizard has not been completed, in which case it is false
.
tenant.connectorPolicies
ArrayAvailable since 1.18.0A list of Connector policies. Users will be authenticated against Connectors in order. Each Connector can be included in this list at most once and must exist.
tenant.connectorPolicies[x].connectorId
UUIDAvailable since 1.18.0The identifier of the Connector to which this policy refers.
tenant.connectorPolicies[x].domains
StringAvailable since 1.18.0An list of email domains to which this connector should apply.
A value of ["*"]
indicates this connector applies to all users.
tenant.connectorPolicies[x].migrate
BooleanAvailable since 1.18.0If true, the user’s data will be migrated to FusionAuth at first successful authentication; subsequent authentications will occur against the FusionAuth datastore. If false, the Connector’s source will be treated as authoritative.
tenant.data
ObjectAn object that can hold any information about the Tenant that should be persisted.
tenant.emailConfiguration.additionalHeaders
Array<Object>Available since 1.32.0The additional SMTP headers to be added to each outgoing email. Each SMTP header consists of a name and a value.
tenant.emailConfiguration.debug
BooleanDefaults to falseAvailable since 1.37.0Determines if debug should be enabled to create an event log to assist in debugging SMTP errors.
tenant.emailConfiguration.defaultFromEmail
StringAvailable since 1.16.0The default email address that emails will be sent from when a from address is not provided on an individual email template. This is the address part email address (i.e. Jared Dunn jared@piedpiper.com
).
tenant.emailConfiguration.defaultFromName
StringAvailable since 1.16.0The default From Name used in sending emails when a from name is not provided on an individual email template. This is the display name part of the email address ( i.e. Jared Dunn jared@piedpiper.com
).
tenant.emailConfiguration.emailVerificationEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template used to send emails to users to verify that their email address is valid.
tenant.emailConfiguration.emailUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when their email address is updated.
tenant.emailConfiguration.emailVerifiedEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template used to notify a user that their email address has been verified.
tenant.emailConfiguration.forgotPasswordEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template that is used when a user is sent a forgot password email.
tenant.emailConfiguration.host
StringDefaults to localhostAvailable since 1.8.0The host name of the SMTP server that FusionAuth will use.
Prior to version 1.28.0
this value was required.
tenant.emailConfiguration.implicitEmailVerificationAllowed
Defaults to trueAvailable since 1.32.0When set to true, this allows email to be verified as a result of completing a similar email based workflow such as change password. When set to false, the user must explicitly complete the email verification workflow even if the user has already completed a similar email workflow such as change password.
tenant.emailConfiguration.loginIdInUseOnCreateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when another user attempts to create an account with their login Id.
tenant.emailConfiguration.loginIdInUseOnUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when another user attempts to update an existing account to use their login Id.
tenant.emailConfiguration.loginNewDeviceEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when they log in on a new device.
tenant.emailConfiguration.loginSuspiciousEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a suspicious login occurs.
tenant.emailConfiguration.password
StringAvailable since 1.8.0An optional password FusionAuth will use to authenticate with the SMTP server.
tenant.emailConfiguration.passwordlessEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Passwordless Email Template, sent to users when they start a passwordless login.
tenant.emailConfiguration.passwordResetSuccessEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when they have completed a ‘forgot password’ workflow and their password has been reset.
tenant.emailConfiguration.passwordUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when their password has been updated.
tenant.emailConfiguration.port
IntegerDefaults to 25Available since 1.8.0The port of the SMTP server that FusionAuth will use.
Prior to version 1.28.0
this value was required.
tenant.emailConfiguration.properties
StringAvailable since 1.8.0Custom SMTP configuration properties that may be necessary in some cases. This can contain any Java mail property. It will override anything FusionAuth sets by default.
The following property has a default value:
mail.smtp.ssl.protocols
has a default value ofTLSv1 TLSv1.1 TLSv1.2
.
Since version 1.44.0
, the following two properties have default values:
mail.smtp.timeout
has a default value of2000
.mail.smtp.connectiontimeout
has a default value of2000
.
Here’s an example value which overrides these properties; in this case setting both timeout defaults to 5 seconds.
mail.smtp.timeout=5000\nmail.smtp.connectiontimeout=5000
tenant.emailConfiguration.security
StringDefaults to NONEAvailable since 1.8.0The type of security protocol FusionAuth will use when connecting to the SMTP server. The possible values are:
NONE
- no security will be used. All communications will be sent plaintext.SSL
- SSL will be used to connect to the SMTP server. This protocol is not recommended unless it is the only one your SMTP server supports.TLS
- TLS will be used to connect to the SMTP server. This is the preferred protocol for all SMTP servers.
tenant.emailConfiguration.setPasswordEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password.
tenant.emailConfiguration.twoFactorMethodAddEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a MFA method has been added to their account.
tenant.emailConfiguration.twoFactorMethodRemoveEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a MFA method has been removed from their account.
tenant.emailConfiguration.unverified.allowEmailChangeWhenGated
BooleanDefaults to falseAvailable since 1.27.0When this value is set to true
, the user is allowed to change their email address when they are gated because they haven’t verified their email address.
tenant.emailConfiguration.unverified.behavior
StringDefaults to AllowAvailable since 1.27.0The desired behavior during login for a user that does not have a verified email. The possible values are:
Allow
- the user will be allowed to complete login.Gated
- verification is required before a user can complete login. The use of this value will require a paid plan.
tenant.emailConfiguration.username
StringAvailable since 1.8.0An optional username FusionAuth will to authenticate with the SMTP server.
tenant.emailConfiguration.verificationEmailTemplateId
UUIDThe Id of the Email Template used to send emails to users to verify that their email address is valid. If either the verifyEmail
or verifyEmailWhenChanged
fields are true
, this field is required.
tenant.emailConfiguration.verificationStrategy
StringAvailable since 1.27.0The process by which the user will verify their email address. The possible values are:
ClickableLink
- send the user a code with a clickable link.FormField
- send the user a short code intended to be manually entered into a form field. This is only available when tenant.emailConfiguration.unverified.behavior has theGated
value.
tenant.emailConfiguration.verifyEmail
BooleanDefaults to falseWhether the user’s email addresses are verified when the registers with your application.
tenant.emailConfiguration.verifyEmailWhenChanged
BooleanDefaults to falseWhether the user’s email addresses are verified when the user changes them.
tenant.eventConfiguration.events
ObjectAvailable since 1.8.0A mapping of the configuration for each event type that FusionAuth sends. The event types that are the keys into this Object are:
audit-log.create
- When an audit log is created Available since 1.30.0event-log.create
- When an event log is created Available since 1.30.0jwt.public-key.update
- When a JWT RSA Public / Private keypair may have been changedjwt.refresh
- When an access token is refreshed using a refresh token Available since 1.16.0jwt.refresh-token.revoke
- When a JWT Refresh Token is revokedkickstart.success
- When kickstart has successfully completed Available since 1.30.0user.action
- When a user action is triggereduser.bulk.create
- When multiple users are created in bulk (i.e. during an import)user.create
- When a user is createduser.create.complete
- When a user create transaction has completed Available since 1.30.0user.deactivate
- When a user is deactivateduser.delete
- When a user is deleteduser.delete.complete
- When a user delete transaction has completed Available since 1.30.0user.email.update
- When a user updates their email address Available since 1.30.0user.email.verified
- When a user verifies their email address Available since 1.8.0user.identity-provider.link
- When a link is created from a user to an Identity Provider Available since 1.36.0user.identity-provider.unlink
- When an existing Identity Provider link is removed from a User Available since 1.36.0user.loginId.duplicate.create
- When a request to create a user with a login Id (email or username) which is already in use has been received Available since 1.30.0Note: An Enterprise plan is required to utilize the
user.loginId.duplicate.create
event .user.loginId.duplicate.update
- When a request to update a user and change their login Id (email or username) to one that is already in use has been received Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.loginId.duplicate.update
event .user.login.failed
- When a user fails a login request Available since 1.6.0user.login.new-device
- When a user begins a login request with a new device Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.login.new-device
event .user.login.success
- When a user completes a login request Available since 1.6.0user.login.suspicious
- When a user logs in and is considered to be a potential threat (requires an activated Enterprise license) Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.login.suspicious
event .user.password.breach
- When Reactor detects a user is using a potentially breached password (requires an activated license) Available since 1.15.0
Note: A paid plan is required to utilize the
user.password.breach
event .user.password.reset.send
- When a forgot password email has been sent to a user Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.send
event.user.password.reset.start
- When the process to reset a user password has started Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.start
event.user.password.reset.success
- When a user has successfully reset their password Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.success
event.user.password.update
- When a user has updated their password Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.update
event.user.reactivate
- When a user is reactivateduser.registration.create
- When a user registration is created Available since 1.6.0user.registration.create.complete
- When a user registration create transaction has completed Available since 1.30.0user.registration.delete
- When a user registration is deleted Available since 1.6.0user.registration.delete.complete
- When a user registration delete transaction has completed Available since 1.30.0user.registration.update
- When a user registration is updated Available since 1.6.0user.registration.update.complete
- When a user registration update transaction has completed Available since 1.30.0user.registration.verified
- When a user completes registration verification Available since 1.8.0user.two-factor.method.add
- When a user has added a two-factor method Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.two-factor.method.add
event.user.two-factor.method.remove
- When a user has removed a two-factor method Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.two-factor.method.remove
event.user.update
- When a user is updateduser.update.complete
- When a user update transaction has completed Available since 1.30.0
tenant.eventConfiguration.events[type].enabled
BooleanAvailable since 1.8.0Whether or not FusionAuth should send these types of events to any configured Webhooks.
tenant.eventConfiguration.events[type].transactionType
StringAvailable since 1.8.0The transaction type that FusionAuth uses when sending these types of events to any configured Webhooks. The transaction types are:
None
- No Webhooks are required to succeed for the FusionAuth transaction to be committed.Any
- Only a single Webhook is required to succeed for the FusionAuth transaction to be committed.SimpleMajority
- A simple majority (50% or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.SuperMajority
- A super majority (2/3 or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.AbsoluteMajority
- Every Webhook must succeed for the FusionAuth transaction to be committed.
tenant.externalIdentifierConfiguration.authorizationGrantIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until an OAuth authorization code is no longer valid to be exchanged for an access token. This is essentially the time allowed between the start of an Authorization request during the Authorization code grant and when you request an access token using this authorization code on the Token endpoint.
Value must be greater than 0 and less than or equal to 600.
tenant.externalIdentifierConfiguration.changePasswordIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the change password Id.
If the changePasswordIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the changePasswordIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.changePasswordIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the change password Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.changePasswordIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a change password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.deviceCodeTimeToLiveInSeconds
IntegerAvailable since 1.11.0The time in seconds until a device code Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.deviceUserCodeIdGenerator.length
IntegerAvailable since 1.11.0The length of the secure generator used for generating the device code Id.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.deviceUserCodeIdGenerator.type
StringAvailable since 1.11.0The type of the secure generator used for generating the device code Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.emailVerificationIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the the email verification Id.
If the emailVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.emailVerificationIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the email verification Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.emailVerificationIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until an email verification Id is no longer valid and cannot be used by the Verify Email API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.emailVerificationOneTimeCodeGenerator.length
IntegerAvailable since 1.27.0The length of the secure generator used for generating the email verification one time code.
If the emailVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.emailVerificationOneTimeCodeGenerator.type
StringAvailable since 1.27.0The type of the secure generator used for generating the email verification one time code. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.externalAuthenticationIdTimeToLiveInSeconds
IntegerAvailable since 1.12.0The time in seconds until an external authentication Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.loginIntentTimeToLiveInSeconds
IntegerAvailable since 1.53.0The time in seconds until a Login Timeout identifier is no longer valid to complete post-authentication steps in the OAuth workflow. Must be greater than 0.
tenant.externalIdentifierConfiguration.oneTimePasswordTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a One Time Password is no longer valid and cannot be used by the Login API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.passwordlessLoginGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the passwordless login.
If the passwordlessLoginGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the passwordlessLoginGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.passwordlessLoginGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the passwordless login. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.passwordlessLoginTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a passwordless code is no longer valid and cannot be used by the Passwordless API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.pendingAccountLinkTimeToLiveInSeconds
IntegerAvailable since 1.28.0The number of seconds before the pending account link identifier is no longer valid to complete an account link request.
tenant.externalIdentifierConfiguration.registrationVerificationIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the registration verification Id.
If the registrationVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.registrationVerificationIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the registration verification Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.registrationVerificationIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a registration verification Id is no longer valid and cannot be used by the Verify Registration API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.registrationVerificationOneTimeCodeGenerator.length
IntegerAvailable since 1.27.0The length of the secure generator used for generating the registration verification one time code.
If the registrationVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.registrationVerificationOneTimeCodeGenerator.type
StringAvailable since 1.27.0The type of the secure generator used for generating the registration verification one time code. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.rememberOAuthScopeConsentChoiceTimeToLiveInSeconds
IntegerAvailable since 1.50.0The time in seconds until remembered OAuth scope consent choices are no longer valid, and the User will be prompted to consent to requested OAuth scopes even if they have not changed. Applies only when application.oauthConfiguration.consentMode is set to RememberDecision
. Value must be greater than 0.
tenant.externalIdentifierConfiguration.samlv2AuthNRequestIdTimeToLiveInSeconds
IntegerAvailable since 1.19.0The time in seconds that a SAML AuthN request Id returned by the Start SAML v2 Login Request API will be eligible to be used to complete a SAML v2 Login request.
tenant.externalIdentifierConfiguration.setupPasswordIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the setup password Id.
If the setupPasswordIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the setupPasswordIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.setupPasswordIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the setup password Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.setupPasswordIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a setup password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.trustTokenTimeToLiveInSeconds
IntegerAvailable since 1.33.0The number of seconds before the Trust Token is no longer valid to complete a request that requires trust. Value must be greater than 0.
tenant.externalIdentifierConfiguration.twoFactorIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a two factor Id is no longer valid and cannot be used by the Two Factor Login API. Value must be greater than 0.
tenant.externalIdentifierConfiguration.twoFactorOneTimeCodeIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the the two factor one time code Id.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenant.externalIdentifierConfiguration.twoFactorOneTimeCodeIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the two factor code Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenant.externalIdentifierConfiguration.twoFactorOneTimeCodeIdTimeToLiveInSeconds
IntegerAvailable since 1.26.0The number of seconds before the Two-Factor One Time Code used to enable or disable a two-factor method is no longer valid. Must be greater than 0.
tenant.externalIdentifierConfiguration.twoFactorTrustIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until an issued Two Factor trust Id is no longer valid and the User will be required to complete Two Factor authentication during the next authentication attempt. Value must be greater than 0.
tenant.externalIdentifierConfiguration.webAuthnAuthenticationChallengeTimeToLiveInSeconds
IntegerAvailable since 1.41.0The time in seconds until a WebAuthn authentication challenge is no longer valid and the User will be required to restart the WebAuthn authentication ceremony by creating a new challenge. This value also controls the timeout for the client-side WebAuthn navigator.credentials.get
API call. Value must be greater than 0.
tenant.externalIdentifierConfiguration.webAuthnRegistrationChallengeTimeToLiveInSeconds
IntegerAvailable since 1.41.0The time in seconds until a WebAuthn registration challenge is no longer valid and the User will be required to restart the WebAuthn registration ceremony by creating a new challenge. This value also controls the timeout for the client-side WebAuthn navigator.credentials.create
API call. Value must be greater than 0.
tenant.failedAuthenticationConfiguration.actionCancelPolicy.onPasswordReset
BooleanAvailable since 1.42.0Indicates whether you want the user to be able to self-service unlock their account prior to the action duration by completing a password reset workflow.
tenant.failedAuthenticationConfiguration.actionDuration
LongAvailable since 1.8.0The duration of the User Action. This value along with the actionDurationUnit
will be used to set the duration of the User Action. Value must be greater than 0.
tenant.failedAuthenticationConfiguration.actionDurationUnit
StringAvailable since 1.8.0The unit of time associated with a duration. The possible values are:
MINUTES
HOURS
DAYS
WEEKS
MONTHS
YEARS
tenant.failedAuthenticationConfiguration.emailUser
StringAvailable since 1.42.0Indicates you would like to email the user when the user’s account is locked due to this action being taken. This requires the User Action specified by the tenant.failedAuthenticationConfiguration.userActionId to also be configured for email. If the User Action is not configured to be able to email the user, this configuration will be ignored. See userEmailingEnabled on the User Action.
tenant.failedAuthenticationConfiguration.resetCountInSeconds
IntegerAvailable since 1.8.0The length of time in seconds before the failed authentication count will be reset. Value must be greater than 0.
For example, if tooManyAttempts
is set to 5
and you fail to authenticate 4
times in a row, waiting for the duration specified here will cause your fifth attempt to start back at 1
.
tenant.failedAuthenticationConfiguration.tooManyAttempts
IntegerAvailable since 1.8.0The number of failed attempts considered to be too many. Once this threshold is reached the specified User Action will be applied to the user for the duration specified. Value must be greater than 0.
tenant.failedAuthenticationConfiguration.userActionId
UUIDAvailable since 1.8.0The Id of the User Action that is applied when the threshold is reached for too many failed authentication attempts.
tenant.familyConfiguration.allowChildRegistrations
BooleanAvailable since 1.8.0Whether to allow child registrations.
tenant.familyConfiguration.confirmChildEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use when confirming a child.
tenant.familyConfiguration.deleteOrphanedAccounts
BooleanAvailable since 1.8.0Indicates that child users without parental verification will be permanently deleted after tenant.familyConfiguration.deleteOrphanedAccountsDays days.
tenant.familyConfiguration.deleteOrphanedAccountsDays
IntegerAvailable since 1.8.0The number of days from creation child users will be retained before being deleted for not completing parental verification. Value must be greater than 0.
tenant.familyConfiguration.enabled
BooleanAvailable since 1.8.0Whether family configuration is enabled.
tenant.familyConfiguration.familyRequestEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use when a family request is made.
tenant.familyConfiguration.maximumChildAge
IntegerAvailable since 1.8.0The maximum age of a child. Value must be greater than 0.
tenant.familyConfiguration.minimumOwnerAge
IntegerAvailable since 1.8.0The minimum age to be an owner. Value must be greater than 0.
tenant.familyConfiguration.parentEmailRequired
BooleanAvailable since 1.8.0Whether a parent email is required.
tenant.familyConfiguration.parentRegistrationEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use for parent registration.
tenant.formConfiguration.adminUserFormId
UUIDAvailable since 1.20.0The unique Id of the form to use for the Add and Edit User form when used in the FusionAuth admin UI.
tenant.httpSessionMaxInactiveInterval
IntegerAvailable since 1.8.0Time in seconds until an inactive session will be invalidated. Used when creating a new session in the FusionAuth OAuth frontend.
tenant.id
UUIDThe unique identifier for this Tenant.
tenant.insertInstant
LongThe instant that the Tenant was added to the FusionAuth database.
tenant.issuer
StringAvailable since 1.8.0The named issuer used to sign tokens, this is generally your public fully qualified domain.
tenant.jwtConfiguration.accessTokenKeyId
UUIDAvailable since 1.8.0The unique id of the signing key used to sign the access token.
tenant.jwtConfiguration.idTokenKeyId
UUIDAvailable since 1.8.0The unique id of the signing key used to sign the Id token.
tenant.jwtConfiguration.refreshTokenExpirationPolicy
StringAvailable since 1.17.0The Refresh Token expiration policy.
The possible values are:
Fixed
- the expiration is calculated from the time the token is issued.SlidingWindow
- the expiration is calculated from the last time the token was used.SlidingWindowWithMaximumLifetime
- the expiration is calculated from the last time the token was used, or until the maximumTimeToLiveInMinutes is reached. Available since 1.46.0
tenant.jwtConfiguration.refreshTokenRevocationPolicy.onLoginPrevented
BooleanAvailable since 1.17.0When enabled, all refresh tokens will be revoked when a user action, such as locking an account based on a number of failed login attempts, prevents user login.
tenant.jwtConfiguration.refreshTokenRevocationPolicy.onMultiFactorEnable
BooleanAvailable since 1.42.0When enabled, all refresh tokens will be revoked when a user enables multi-factor authentication for the first time. This policy will not be applied when adding subsequent multi-factor methods to the user.
tenant.jwtConfiguration.refreshTokenRevocationPolicy.onPasswordChanged
BooleanAvailable since 1.17.0When enabled, all refresh tokens will be revoked when a user changes their password.
tenant.jwtConfiguration.refreshTokenSlidingWindowConfiguration.maximumTimeToLiveInMinutes
IntegerAvailable since 1.46.0The maximum lifetime of a refresh token when using a refreshTokenExpirationPolicy of SlidingWindowWithMaximumLifetime
.
tenant.jwtConfiguration.refreshTokenTimeToLiveInMinutes
IntegerAvailable since 1.8.0The length of time in minutes a Refresh Token is valid from the time it was issued. Value must be greater than 0.
tenant.jwtConfiguration.refreshTokenUsagePolicy
StringAvailable since 1.17.0The refresh token usage policy. The following are valid values:
-
Reusable
- the token does not change after it was issued. -
OneTimeUse
- the token value will be changed each time the token is used to refresh a JWT. The client must store the new value after each usage.tenant.jwtConfiguration.timeToLiveInSeconds
IntegerAvailable since 1.8.0The length of time in seconds this JWT is valid from the time it was issued. Value must be greater than 0.
tenant.lambdaConfiguration.loginValidationId
UUIDAvailable since 1.53.0The Id of the lambda that will be invoked at the end of a successful login request in order to extend custom validation of a login request.
tenant.lambdaConfiguration.scimEnterpriseUserRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Request Lambda that will be used to convert the SCIM Enterprise User request to a FusionAuth User.
tenant.lambdaConfiguration.scimEnterpriseUserResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth Enterprise User to a SCIM Server response.
tenant.lambdaConfiguration.scimGroupRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM Group Request Lambda that will be used to convert the SCIM Group request to a FusionAuth Group.
tenant.lambdaConfiguration.scimGroupResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM GroupResponse Lambda that will be used to convert a FusionAuth Group to a SCIM Server response.
tenant.lambdaConfiguration.scimUserRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Request Lambda that will be used to convert the SCIM User request to a FusionAuth User.
tenant.lambdaConfiguration.scimUserResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth User to a SCIM Server response.
tenant.lastUpdateInstant
LongThe instant that the Tenant was last updated in the FusionAuth database.
tenant.loginConfiguration.requireAuthentication
BooleanAvailable since 1.26.0Indicates whether to require an API key for the Login API when an
applicationId
is not provided. When anapplicationId
is provided to the Login API call, the application configuration will take precedence.tenant.logoutURL
StringAvailable since 1.8.0The logout redirect URL when sending the user’s browser to the
/oauth2/logout
URI of the FusionAuth Front End. This value is only used when a logout URL is not defined in your Application.tenant.maximumPasswordAge.days
IntegerAvailable since 1.8.0The password maximum age in days. The number of days after which FusionAuth will require a user to change their password. Required when tenant.maximumPasswordAge.enabled is set to
true
.tenant.maximumPasswordAge.enabled
BooleanAvailable since 1.8.0Indicates that the maximum password age is enabled and being enforced.
tenant.minimumPasswordAge.seconds
IntegerAvailable since 1.8.0The password minimum age in seconds. When enabled FusionAuth will not allow a password to be changed until it reaches this minimum age. Required when tenant.minimumPasswordAge.enabled is set to
true
.tenant.minimumPasswordAge.enabled
BooleanAvailable since 1.8.0Indicates that the minimum password age is enabled and being enforced.
tenant.multiFactorConfiguration.authenticator.algorithm
StringAvailable since 1.26.0The algorithm used by the TOTP authenticator. This value is
HmacSHA1
and read only.tenant.multiFactorConfiguration.authenticator.codeLength
IntegerAvailable since 1.26.0The length of the code generated by the TOTP. This value is
6
and read only.tenant.multiFactorConfiguration.authenticator.enabled
BooleanAvailable since 1.26.0When enabled, users may utilize an authenticator application to complete a multi-factor authentication request. This method uses TOTP (Time-Based One-Time Password) as defined in RFC 6238 and often uses an native mobile app such as Google Authenticator.
tenant.multiFactorConfiguration.authenticator.timeStep
IntegerAvailable since 1.26.0The time-step size in seconds. This value is
30
and read only.tenant.multiFactorConfiguration.email.enabled
BooleanAvailable since 1.26.0When enabled, users may utilize an email address to complete a two-factor authentication request.
tenant.multiFactorConfiguration.email.templateId
UUIDAvailable since 1.26.0The Id of the email template that is used when notifying a user to complete a two-factor authentication request.
tenant.multiFactorConfiguration.sms.enabled
BooleanAvailable since 1.26.0When enabled, users may utilize a mobile phone number to complete a two-factor authentication request.
tenant.multiFactorConfiguration.sms.messengerId
UUIDAvailable since 1.26.0The messenger that is used to deliver a SMS two-factor authentication request.
tenant.multiFactorConfiguration.sms.templateId
UUIDAvailable since 1.26.0The Id of the SMS template that is used when notifying a user to complete a two-factor authentication request.
tenant.name
StringThe unique name of the Tenant.
tenant.oauthConfiguration.clientCredentialsAccessTokenPopulateLambdaId
UUIDAvailable since 1.26.0The Id of a lambda that will be called to populate the JWT during a client credentials grant.
tenant.passwordEncryptionConfiguration.encryptionScheme
StringAvailable since 1.8.0The default method for encrypting the User’s password. The following encryptors are provided with FusionAuth:
- salted-md5
- salted-sha256
- salted-hmac-sha256
- salted-pbkdf2-hmac-sha256
- salted-pbkdf2-hmac-sha256-512 available since 1.34.0
- salted-pbkdf2-hmac-sha512-512 available since 1.43.0
- bcrypt
- phpass-md5 available since 1.45.0
- phpass-sha512 available since 1.45.0
tenant.passwordEncryptionConfiguration.encryptionSchemeFactor
IntegerAvailable since 1.8.0The factor used by the password encryption scheme. If not provided, the
PasswordEncryptor
provides a default value. Generally this will be used as an iteration count to generate the hash. The actual use of this value is up to thePasswordEncryptor
implementation.tenant.passwordEncryptionConfiguration.modifyEncryptionSchemeOnLogin
BooleanAvailable since 1.8.0When enabled a user’s hash configuration will be modified to match these configured settings. This can be useful to increase a password hash strength over time or upgrade imported users to a more secure encryption scheme after an initial import.
Beginning in version
1.42.0
when this configuration is enabled, in addition to re-hashing on login, the password will be re-hashed on password change as well.tenant.passwordValidationRules.breachDetection.enabled
BooleanAvailable since 1.15.0Whether to enable Reactor breach detection. Requires an activated license.
tenant.passwordValidationRules.breachDetection.matchMode
StringAvailable since 1.15.0The level of severity where Reactor will consider a breach. The following are valid values:
High
Only requires a password match, this is the most secure and is recommendedMedium
Exact match on username, email address or email sub-addressLow
Exact match on an email or username, or the password is a common breached value
tenant.passwordValidationRules.breachDetection.notifyUserEmailTemplateId
UUIDAvailable since 1.15.0The Id of the email template to use when notifying a user of a breached password.
tenant.passwordValidationRules.breachDetection.onLogin
StringAvailable since 1.15.0The behavior when detecting breaches at time of user login. The following are valid values:
Off
Do not perform breach detection at loginRecordOnly
Only record the result, take no actionNotifyUser
Notify the end user via emailRequireChange
Require immediate password change
tenant.passwordValidationRules.maxLength
IntegerAvailable since 1.8.0The maximum length of a password when a new user is created or a user requests a password change.
tenant.passwordValidationRules.minLength
IntegerAvailable since 1.8.0The minimum length of a password when a new user is created or a user requests a password change.
tenant.passwordValidationRules.rememberPreviousPasswords.count
IntegerAvailable since 1.8.0The number of previous passwords to remember. Value must be greater than 0.
tenant.passwordValidationRules.rememberPreviousPasswords.enabled
BooleanAvailable since 1.8.0Whether to prevent a user from using any of their previous passwords.
tenant.passwordValidationRules.requireMixedCase
BooleanAvailable since 1.8.0Whether to force the user to use at least one uppercase and one lowercase character.
tenant.passwordValidationRules.requireNonAlpha
BooleanAvailable since 1.8.0Whether to force the user to use at least one non-alphanumeric character.
tenant.passwordValidationRules.requireNumber
BooleanAvailable since 1.8.0Whether to force the user to use at least one number.
tenant.passwordValidationRules.validateOnLogin
BooleanAvailable since 1.15.0When enabled the user’s password will be validated during login. If the password does not meet the currently configured validation rules the user will be required to change their password.
tenant.rateLimitConfiguration.failedLogin.limit
IntegerAvailable since 1.30.0The number of times a user can fail to login within the configured timePeriodInSeconds duration. If a Failed authentication action has been configured then it will take precedence.
tenant.rateLimitConfiguration.failedLogin.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can fail login before being rate limited.
tenant.rateLimitConfiguration.forgotPassword.limit
IntegerAvailable since 1.30.0The number of times a user can request a forgot password email within the configured timePeriodInSeconds duration.
tenant.rateLimitConfiguration.forgotPassword.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a forgot password email before being rate limited.
tenant.rateLimitConfiguration.sendEmailVerification.limit
IntegerAvailable since 1.30.0The number of times a user can request a verification email within the configured timePeriodInSeconds duration.
tenant.rateLimitConfiguration.sendEmailVerification.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a verification email before being rate limited.
tenant.rateLimitConfiguration.sendPasswordless.limit
IntegerAvailable since 1.30.0The number of times a user can request a passwordless login email within the configured timePeriodInSeconds duration.
tenant.rateLimitConfiguration.sendPasswordless.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a passwordless login email before being rate limited.
tenant.rateLimitConfiguration.sendRegistrationVerification.limit
IntegerAvailable since 1.30.0The number of times a user can request a registration verification email within the configured timePeriodInSeconds duration.
tenant.rateLimitConfiguration.sendRegistrationVerification.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a registration verification email before being rate limited.
tenant.rateLimitConfiguration.sendTwoFactor.limit
IntegerAvailable since 1.30.0The number of times a user can request a two-factor code by email or SMS within the configured timePeriodInSeconds duration.
tenant.rateLimitConfiguration.sendTwoFactor.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a two-factor code by email or SMS before being rate limited.
tenant.registrationConfiguration.blockedDomains
Array<String>Available since 1.30.0A list of unique domains that are not allowed to register when self service is enabled.
tenant.scimServerConfiguration.clientEntityTypeId
UUIDAvailable since 1.36.0The Entity Type that will be used to represent SCIM Clients for this tenant.
tenant.scimServerConfiguration.enabled
BooleanAvailable since 1.36.0Whether or not this tenant has the SCIM endpoints enabled.
tenant.scimServerConfiguration.schemas
MapAvailable since 1.36.0JSON formatted as a SCIM Schemas endpoint response. Because the SCIM lambdas may modify the JSON response, ensure the Schema’s response matches that generated by the response lambdas. More about Schema definitions.
tenant.scimServerConfiguration.serverEntityTypeId
UUIDAvailable since 1.36.0The Entity Type that will be used to represent SCIM Servers for this tenant.
tenant.ssoConfiguration.deviceTrustTimeToLiveInSeconds
IntegerAvailable since 1.30.2The number of seconds before a trusted device is reset. When reset, a user is forced to complete captcha during login and complete two factor authentication if applicable.
tenant.state
StringAvailable since 1.22.0The current state of the tenant. The following are valid values:
Active
- The tenant is active.PendingDelete
- A delete request has been requested and is being processed.
tenant.themeId
UUIDAvailable since 1.8.0The unique Id of the theme to be used to style the login page and other end user templates.
tenant.userDeletePolicy.unverified.enabled
BooleanAvailable since 1.13.0Indicates that users without a verified email address will be permanently deleted after tenant.userDeletePolicy.unverified.numberOfDaysToRetain days.
tenant.userDeletePolicy.unverified.enabledInstant
LongAvailable since 1.48.0The instant that this policy was enabled.
Users created before this time will not be eligible to be deleted. This means that you can safely enable this feature and the policy will only be enforced for users created after this policy was enabled. If you would like to delete users created prior to this policy being enabled that have an unverified email address, you can use the User Search API or User Bulk Delete API to search on the
insertInstant
andverified
fields to identify users that you would like to delete.For example, the following query string will return users that were created at least 7 days ago that have not verified their email address.
insertInstant:<now-7d AND verified:false
Please note that prior to version
1.48.0
, when enabling this policy all user’s with an unverified email were eligible for deletion.tenant.userDeletePolicy.unverified.numberOfDaysToRetain
IntegerAvailable since 1.13.0The number of days from creation users will be retained before being deleted for not completing email verification. Value must be greater than 0.
tenant.usernameConfiguration.unique.enabled
BooleanAvailable since 1.27.0When
true
, FusionAuth will handle username collisions by generating a random suffix. Users with colliding usernames will be able to use the same one, but in the admin and API interfaces, a unique username will be displayed.tenant.usernameConfiguration.unique.numberOfDigits
IntegerAvailable since 1.27.0The maximum number of digits to use when building a unique suffix for a username. A number will be randomly selected and will be 1 or more digits up to this configured value in length. For example, if this value is
5
, the suffix will be a number between00001
and99999
, inclusive.tenant.usernameConfiguration.unique.separator
StringAvailable since 1.27.0A single character to use as a separator from the requested username and a unique suffix that is added when a duplicate username is detected. This value can be a single non alphanumeric ASCII character.
tenant.usernameConfiguration.unique.strategy
StringAvailable since 1.29.0This strategy instructions FusionAuth when to append a unique suffix to the username. The possible values are:
Always
- Always append a unique suffix even when the requested username is not in use.OnCollision
- Only append a unique suffix when the requested username is in use.
tenant.webAuthnConfiguration.bootstrapWorkflow.authenticatorAttachmentPreference
StringAvailable since 1.41.0The authenticator attachment requirement for WebAuthn passkey registration when using the bootstrap workflow. The possible values are:
any
- An authenticator with any attachment modality will be allowed during registration.crossPlatform
- Only authenticators with thecross-platform
attachment modality will be allowed during registration. These are also referred to as “roaming” authenticators.platform
- Only authenticators with theplatform
attachment modality will be allowed during registration.
tenant.webAuthnConfiguration.bootstrapWorkflow.enabled
BooleanAvailable since 1.41.0Whether the WebAuthn bootstrap workflow is enabled.
tenant.webAuthnConfiguration.bootstrapWorkflow.userVerificationRequirement
StringAvailable since 1.41.0The user verification requirement for WebAuthn passkey registration and authentication when using the bootstrap workflow. The possible values are:
discouraged
- If possible, do not require user verification during registration and authentication.preferred
- Prefer authenticators that support user verification during registration and authentication but allow others.required
- Only authenticators that support user verification will be allowed.
tenant.webAuthnConfiguration.debug
BooleanAvailable since 1.41.0Whether debug event log output is enabled for WebAuthn.
tenant.webAuthnConfiguration.enabled
BooleanAvailable since 1.41.0Whether WebAuthn configuration is enabled.
tenant.webAuthnConfiguration.reauthenticationWorkflow.authenticatorAttachmentPreference
StringAvailable since 1.41.0The authenticator attachment requirement for WebAuthn passkey registration when using the reauthentication workflow. The possible values are:
any
- An authenticator with any attachment modality will be allowed during registration.crossPlatform
- Only authenticators with thecross-platform
attachment modality will be allowed during registration. These are also referred to as “roaming” authenticators.platform
- Only authenticators with theplatform
attachment modality will be allowed during registration.
tenant.webAuthnConfiguration.reauthenticationWorkflow.enabled
BooleanAvailable since 1.41.0Whether the WebAuthn reauthentication workflow is enabled.
tenant.webAuthnConfiguration.reauthenticationWorkflow.userVerificationRequirement
StringAvailable since 1.41.0The user verification requirement for WebAuthn passkey registration and authentication when using the reauthentication workflow. The possible values are:
discouraged
- If possible, do not require user verification during registration and authentication.preferred
- Prefer authenticators that support user verification during registration and authentication but allow others.required
- Only authenticators that support user verification will be allowed.
tenant.webAuthnConfiguration.relyingPartyId
StringAvailable since 1.41.0The Relying Party Id the tenant will use in WebAuthn ceremonies. Passkeys can only be used to authenticate on sites using the same Relying Party Id they were registered with.
The default value is
null
, which instructs the WebAuthn JavaScript API to use the browser origin.tenant.webAuthnConfiguration.relyingPartyName
StringAvailable since 1.41.0The Relying Party name the tenant will use in WebAuthn ceremonies. This value is used only for display and may be shown by browser or OS dialogs during WebAuthn ceremonies.
If no value is configured, the tenant.issuer value will be used.
Example Response JSON
{
"tenant": {
"accessControlConfiguration": {
"uiIPAccessControlListId": "11d49de7-69f6-46fc-8270-0b3aa626327a"
},
"configured": true,
"captchaConfiguration": {
"captchaMethod": "GoogleRecaptchaV3",
"enabled": true,
"secretKey": "6LdYWpMbAAAAAKhcksgk70us00012r66r96tt7rp",
"siteKey": "6LdYWpMbAAAAAKhcksgk75tz00022r66ombcfadr",
"threshold": 0.5
},
"connectorPolicies": [
{
"connectorId": "e3306678-a53a-4964-9040-1c96f36dda72",
"domains": [
"*"
],
"migrate": false
},
{
"connectorId": "27f22280-7e55-4d1c-b9f8-239bf9cc1a5e",
"domains": [
"*"
],
"migrate": true
}
],
"data": {
"description": "No more secrets, Marty."
},
"emailConfiguration": {
"additionalHeaders": [
{
"name": "X-SES-CONFIGURATION-SET",
"value": "example_configuration_set_name"
}
],
"defaultFromEmail": "jared@piedpiper.com",
"defaultFromName": "Jared Dunn",
"emailUpdateEmailTemplateId": "ec3045c7-97d8-47f8-8725-61b93deacf5d",
"emailVerifiedEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
"forgotPasswordEmailTemplateId": "49aba1de-0225-45d7-a2b1-f9fe46b0242c",
"host": "smtp.sendgrid.net",
"implicitEmailVerificationAllowed": true,
"loginIdInUseOnCreateEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginIdInUseOnUpdateEmailTemplateId": "2c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginNewDeviceEmailTemplateId": "3c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginSuspiciousEmailTemplateId": "4c3045c7-97d8-47f8-8725-61b93deacf5d",
"password": "password",
"passwordlessEmailTemplateId": "a917e23a-da58-4cda-be01-90f542f8c343",
"passwordResetSuccessEmailTemplateId": "5c3045c7-97d8-47f8-8725-61b93deacf5d",
"passwordUpdateEmailTemplateId": "6c3045c7-97d8-47f8-8725-61b93deacf5d",
"port": 587,
"properties": {
"key": "value"
},
"security": "TLS",
"setPasswordEmailTemplateId": "a9aba13e-0125-4fd7-a2b1-aaa146b02423",
"twoFactorMethodAddEmailTemplateId": "7c3045c7-97d8-47f8-8725-61b93deacf5d",
"twoFactorMethodRemoveEmailTemplateId": "8c3045c7-97d8-47f8-8725-61b93deacf5d",
"unverified": {
"allowEmailChangeWhenGated": false,
"behavior": "Allow"
},
"username": "username",
"verificationEmailTemplateId": "8da42c09-461c-45f3-b931-6e9f63b87ab5",
"verificationStrategy": "FormField",
"verifyEmail": true,
"verifyEmailWhenChanged": true
},
"eventConfiguration": {
"events": {
"user.delete": {
"enabled": true,
"transactionType": "None"
},
"user.create": {
"enabled": true,
"transactionType": "None"
},
"user.update": {
"enabled": true,
"transactionType": "None"
},
"user.deactivate": {
"enabled": true,
"transactionType": "None"
},
"user.bulk.create": {
"enabled": true,
"transactionType": "None"
},
"user.reactivate": {
"enabled": true,
"transactionType": "None"
},
"jwt.refresh": {
"enabled": true,
"transactionType": "None"
},
"jwt.refresh-token.revoke": {
"enabled": true,
"transactionType": "None"
},
"jwt.public-key.update": {
"enabled": true,
"transactionType": "None"
},
"user.login.success": {
"enabled": true,
"transactionType": "None"
},
"user.login.failed": {
"enabled": true,
"transactionType": "None"
},
"user.password.breach": {
"enabled": true,
"transactionType": "None"
},
"user.registration.create": {
"enabled": true,
"transactionType": "None"
},
"user.registration.update": {
"enabled": true,
"transactionType": "None"
},
"user.registration.delete": {
"enabled": true,
"transactionType": "None"
},
"user.registration.verified": {
"enabled": true,
"transactionType": "None"
},
"user.email.verified": {
"enabled": true,
"transactionType": "None"
}
}
},
"externalIdentifierConfiguration": {
"authorizationGrantIdTimeToLiveInSeconds": 30,
"changePasswordIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"changePasswordIdTimeToLiveInSeconds": 600,
"deviceCodeTimeToLiveInSeconds": 1800,
"deviceUserCodeIdGenerator": {
"length": 6,
"type": "randomAlphaNumeric"
},
"emailVerificationIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"emailVerificationIdTimeToLiveInSeconds": 86400,
"emailVerificationOneTimeCodeGenerator": {
"length": 6,
"type": "randomAlphaNumeric"
},
"externalAuthenticationIdTimeToLiveInSeconds": 300,
"loginIntentTimeToLiveInSeconds": 1800,
"oneTimePasswordTimeToLiveInSeconds": 60,
"passwordlessLoginGenerator": {
"length": 32,
"type": "randomBytes"
},
"passwordlessLoginTimeToLiveInSeconds": 180,
"pendingAccountLinkTimeToLiveInSeconds": 3600,
"registrationVerificationIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"registrationVerificationIdTimeToLiveInSeconds": 86400,
"registrationVerificationOneTimeCodeGenerator": {
"length": 6,
"type": "randomAlphaNumeric"
},
"rememberOAuthScopeConsentChoiceTimeToLiveInSeconds": 2592000,
"samlv2AuthNRequestIdTimeToLiveInSeconds": 300,
"setupPasswordIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"setupPasswordIdTimeToLiveInSeconds": 86400,
"trustTokenTimeToLiveInSeconds": 180,
"twoFactorIdTimeToLiveInSeconds": 300,
"twoFactorOneTimeCodeIdGenerator": {
"length": 6,
"type": "randomDigits"
},
"twoFactorOneTimeCodeIdTimeToLiveInSeconds": 60,
"twoFactorTrustIdTimeToLiveInSeconds": 2592000,
"webAuthnAuthenticationChallengeTimeToLiveInSeconds": 180,
"webAuthnRegistrationChallengeTimeToLiveInSeconds": 180
},
"failedAuthenticationConfiguration": {
"actionCancelPolicy": {
"onPasswordReset": false
},
"actionDuration": 3,
"actionDurationUnit": "MINUTES",
"emailUser": false,
"resetCountInSeconds": 60,
"tooManyAttempts": 5,
"userActionId": "16cfc707-268c-4c5b-8989-f71f3ee156d4"
},
"familyConfiguration": {
"allowChildRegistrations": true,
"confirmChildEmailTemplateId": "87654321-4321-8765-ba09-ba0987654321",
"deleteOrphanedAccounts": false,
"deleteOrphanedAccountsDays": 30,
"enabled": true,
"familyRequestEmailTemplateId": "57462514-a73b-cd76-0001-b8a65cd61230",
"maximumChildAge": 12,
"minimumOwnerAge": 21,
"parentEmailRequired": false,
"parentRegistrationEmailTemplateId": "12345678-1234-5678-90ab-1234567890ab"
},
"formConfiguration": {
"adminUserFormId": "e92751a5-25f4-4bca-ad91-66cdf67725d2"
},
"httpSessionMaxInactiveInterval": 3600,
"id": "32306536-3036-6431-3865-646430303332",
"insertInstant": 1572469040579,
"issuer": "https://example.com",
"jwtConfiguration": {
"accessTokenKeyId": "025233ca-d4f3-2aa4-eca9-7e4200e9b472",
"enabled": true,
"idTokenKeyId": "092dbedc-30af-4149-9c61-b578f2c72f59",
"refreshTokenExpirationPolicy": "Fixed",
"refreshTokenRevocationPolicy": {
"onLoginPrevented": true,
"onMultiFactorEnable": true,
"onPasswordChanged": true
},
"refreshTokenTimeToLiveInMinutes": 43200,
"refreshTokenUsagePolicy": "Reusable",
"timeToLiveInSeconds": 3600
},
"lambdaConfiguration": {
"loginValidationId": "c0dd79db-38dd-424b-b77a-4dccaad71052",
"scimEnterpriseUserRequestConverterId": "c2e70f8d-19bb-4df7-848a-33a9a1e26b84",
"scimEnterpriseUserResponseConverterId": "44fc9553-8a2e-408f-8aa2-fa65b70b55e2",
"scimGroupRequestConverterId": "66d65de0-1819-42f8-86ed-7daaa4e155dc",
"scimGroupResponseConverterId": "79812ede-432f-4375-9b43-23c0fe996fef",
"scimUserRequestConverterId": "8a51d7a1-5e3e-442a-b96a-0c31379bb3d4",
"scimUserResponseConverterId": "c8720843-dc4f-4e6c-b6ca-500e9c44695f"
},
"lastUpdateInstant": 1595361143101,
"loginConfiguration": {
"requireAuthentication": true
},
"logoutURL": "http://example.com/logout",
"maximumPasswordAge": {
"days": 180,
"enabled": false
},
"minimumPasswordAge": {
"enabled": false,
"seconds": 30
},
"multiFactorConfiguration": {
"authenticator": {
"algorithm": "HmacSHA1",
"codeLength": 6,
"enabled": true,
"timeStep": 30
},
"email": {
"enabled": true,
"templateId": "d312fb71-d7d8-4b75-a497-6096a07220b3"
},
"loginPolicy": "Enabled",
"sms": {
"enabled": true,
"messengerId": "0a4bae38-ffef-4c33-b74c-1d50c796f600",
"templateId": "f35e04e6-72ec-4f52-b552-29cf950a4ed6"
}
},
"name": "Playtronics Co.",
"oauthConfiguration": {
"clientCredentialsAccessTokenPopulateLambdaId": "46e120c1-4c22-473f-95b4-e2c187cd20c2"
},
"passwordEncryptionConfiguration": {
"encryptionScheme": "salted-pbkdf2-hmac-sha256",
"encryptionSchemeFactor": 24000,
"modifyEncryptionSchemeOnLogin": false
},
"passwordValidationRules": {
"breachDetection": {
"enabled": true,
"notifyUserEmailTemplateId": "e6c74b53-d43d-471e-ae7e-906456d0f341",
"matchMode": "High",
"onLogin": "Off"
},
"maxLength": 256,
"minLength": 8,
"rememberPreviousPasswords": {
"count": 2,
"enabled": true
},
"requireMixedCase": true,
"requireNonAlpha": true,
"requireNumber": true,
"validateOnLogin": false
},
"rateLimitConfiguration": {
"failedLogin": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"forgotPassword": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"sendEmailVerification": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"sendRegistrationVerification": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"sendPasswordless": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
},
"sendTwoFactor": {
"enabled": false,
"limit": 5,
"timePeriodInSeconds": 60
}
},
"registrationConfiguration": {},
"scimServerConfiguration": {
"clientEntityTypeId": "d9ed49f7-1106-4b20-acdb-5cbda76ae77e",
"enabled": true,
"serverEntityTypeId": "919e0ac5-1cf0-4fcf-a8fc-29d77a0d1d8f",
"schemas": {}
},
"ssoConfiguration": {
"deviceTrustTimeToLiveInSeconds": 31536000
},
"state": "Active",
"themeId": "c6ad3fac-6f32-4db7-91a4-061ff035e871",
"userDeletePolicy": {
"unverified": {
"enabled": true,
"enabledInstant": 1698772159415,
"numberOfDaysToRetain": 30
}
},
"usernameConfiguration": {
"unique": {
"enabled": false,
"numberOfDigits": 5,
"separator": "#",
"strategy": "OnCollision"
}
},
"webAuthnConfiguration": {
"enabled": true,
"bootstrapWorkflow": {
"authenticatorAttachmentPreference": "crossPlatform",
"enabled": true,
"userVerificationRequirement": "required"
},
"debug": false,
"reauthenticationWorkflow": {
"authenticatorAttachmentPreference": "platform",
"enabled": true,
"userVerificationRequirement": "required"
},
"relyingPartyId": "piedpiper.com",
"relyingPartyName": "Pied Piper"
}
}
}
Response Body
tenants
Arraytenants[x].accessControlConfiguration.uiIPAccessControlListId
UUIDAvailable since 1.30.0The Id of the IP Access Control List limiting access to this all applications in this tenant.
tenants[x].captchaConfiguration.captchaMethod
StringAvailable since 1.30.0The type of captcha method to use.
tenants[x].captchaConfiguration.enabled
BooleanAvailable since 1.30.0Whether captcha configuration is enabled.
tenants[x].captchaConfiguration.secretKey
StringAvailable since 1.30.0The secret key for this captcha method.
tenants[x].captchaConfiguration.siteKey
StringAvailable since 1.30.0The site key for this captcha method.
tenants[x].captchaConfiguration.threshold
FloatAvailable since 1.30.0The numeric threshold which separates a passing score from a failing one. This value only applies if using either the Google v3 or HCaptcha Enterprise method, otherwise this value is ignored.
tenants[x].configured
BooleanIndicates the tenant has been configured. It is always true
, except for default tenant when the setup wizard has not been completed, in which case it is false
.
tenants[x].connectorPolicies
ArrayAvailable since 1.18.0A list of Connector policies. Users will be authenticated against Connectors in order. Each Connector can be included in this list at most once and must exist.
tenants[x].connectorPolicies[x].connectorId
UUIDAvailable since 1.18.0The identifier of the Connector to which this policy refers.
tenants[x].connectorPolicies[x].domains
StringAvailable since 1.18.0An list of email domains to which this connector should apply.
A value of ["*"]
indicates this connector applies to all users.
tenants[x].connectorPolicies[x].migrate
BooleanAvailable since 1.18.0If true, the user’s data will be migrated to FusionAuth at first successful authentication; subsequent authentications will occur against the FusionAuth datastore. If false, the Connector’s source will be treated as authoritative.
tenants[x].data
ObjectAn object that can hold any information about the Tenant that should be persisted.
tenants[x].emailConfiguration.additionalHeaders
Array<Object>Available since 1.32.0The additional SMTP headers to be added to each outgoing email. Each SMTP header consists of a name and a value.
tenants[x].emailConfiguration.debug
BooleanDefaults to falseAvailable since 1.37.0Determines if debug should be enabled to create an event log to assist in debugging SMTP errors.
tenants[x].emailConfiguration.defaultFromEmail
StringAvailable since 1.16.0The default email address that emails will be sent from when a from address is not provided on an individual email template. This is the address part email address (i.e. Jared Dunn jared@piedpiper.com
).
tenants[x].emailConfiguration.defaultFromName
StringAvailable since 1.16.0The default From Name used in sending emails when a from name is not provided on an individual email template. This is the display name part of the email address ( i.e. Jared Dunn jared@piedpiper.com
).
tenants[x].emailConfiguration.emailVerificationEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template used to send emails to users to verify that their email address is valid.
tenants[x].emailConfiguration.emailUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when their email address is updated.
tenants[x].emailConfiguration.emailVerifiedEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template used to notify a user that their email address has been verified.
tenants[x].emailConfiguration.forgotPasswordEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template that is used when a user is sent a forgot password email.
tenants[x].emailConfiguration.host
StringDefaults to localhostAvailable since 1.8.0The host name of the SMTP server that FusionAuth will use.
Prior to version 1.28.0
this value was required.
tenants[x].emailConfiguration.implicitEmailVerificationAllowed
Defaults to trueAvailable since 1.32.0When set to true, this allows email to be verified as a result of completing a similar email based workflow such as change password. When set to false, the user must explicitly complete the email verification workflow even if the user has already completed a similar email workflow such as change password.
tenants[x].emailConfiguration.loginIdInUseOnCreateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when another user attempts to create an account with their login Id.
tenants[x].emailConfiguration.loginIdInUseOnUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when another user attempts to update an existing account to use their login Id.
tenants[x].emailConfiguration.loginNewDeviceEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when they log in on a new device.
tenants[x].emailConfiguration.loginSuspiciousEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a suspicious login occurs.
tenants[x].emailConfiguration.password
StringAvailable since 1.8.0An optional password FusionAuth will use to authenticate with the SMTP server.
tenants[x].emailConfiguration.passwordlessEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Passwordless Email Template, sent to users when they start a passwordless login.
tenants[x].emailConfiguration.passwordResetSuccessEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when they have completed a ‘forgot password’ workflow and their password has been reset.
tenants[x].emailConfiguration.passwordUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when their password has been updated.
tenants[x].emailConfiguration.port
IntegerDefaults to 25Available since 1.8.0The port of the SMTP server that FusionAuth will use.
Prior to version 1.28.0
this value was required.
tenants[x].emailConfiguration.properties
StringAvailable since 1.8.0Custom SMTP configuration properties that may be necessary in some cases. This can contain any Java mail property. It will override anything FusionAuth sets by default.
The following property has a default value:
mail.smtp.ssl.protocols
has a default value ofTLSv1 TLSv1.1 TLSv1.2
.
Since version 1.44.0
, the following two properties have default values:
mail.smtp.timeout
has a default value of2000
.mail.smtp.connectiontimeout
has a default value of2000
.
Here’s an example value which overrides these properties; in this case setting both timeout defaults to 5 seconds.
mail.smtp.timeout=5000\nmail.smtp.connectiontimeout=5000
tenants[x].emailConfiguration.security
StringDefaults to NONEAvailable since 1.8.0The type of security protocol FusionAuth will use when connecting to the SMTP server. The possible values are:
NONE
- no security will be used. All communications will be sent plaintext.SSL
- SSL will be used to connect to the SMTP server. This protocol is not recommended unless it is the only one your SMTP server supports.TLS
- TLS will be used to connect to the SMTP server. This is the preferred protocol for all SMTP servers.
tenants[x].emailConfiguration.setPasswordEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password.
tenants[x].emailConfiguration.twoFactorMethodAddEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a MFA method has been added to their account.
tenants[x].emailConfiguration.twoFactorMethodRemoveEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a MFA method has been removed from their account.
tenants[x].emailConfiguration.unverified.allowEmailChangeWhenGated
BooleanDefaults to falseAvailable since 1.27.0When this value is set to true
, the user is allowed to change their email address when they are gated because they haven’t verified their email address.
tenants[x].emailConfiguration.unverified.behavior
StringDefaults to AllowAvailable since 1.27.0The desired behavior during login for a user that does not have a verified email. The possible values are:
Allow
- the user will be allowed to complete login.Gated
- verification is required before a user can complete login. The use of this value will require a paid plan.
tenants[x].emailConfiguration.username
StringAvailable since 1.8.0An optional username FusionAuth will to authenticate with the SMTP server.
tenants[x].emailConfiguration.verificationEmailTemplateId
UUIDThe Id of the Email Template used to send emails to users to verify that their email address is valid. If either the verifyEmail
or verifyEmailWhenChanged
fields are true
, this field is required.
tenants[x].emailConfiguration.verificationStrategy
StringAvailable since 1.27.0The process by which the user will verify their email address. The possible values are:
ClickableLink
- send the user a code with a clickable link.FormField
- send the user a short code intended to be manually entered into a form field. This is only available when tenants[x].emailConfiguration.unverified.behavior has theGated
value.
tenants[x].emailConfiguration.verifyEmail
BooleanDefaults to falseWhether the user’s email addresses are verified when the registers with your application.
tenants[x].emailConfiguration.verifyEmailWhenChanged
BooleanDefaults to falseWhether the user’s email addresses are verified when the user changes them.
tenants[x].eventConfiguration.events
ObjectAvailable since 1.8.0A mapping of the configuration for each event type that FusionAuth sends. The event types that are the keys into this Object are:
audit-log.create
- When an audit log is created Available since 1.30.0event-log.create
- When an event log is created Available since 1.30.0jwt.public-key.update
- When a JWT RSA Public / Private keypair may have been changedjwt.refresh
- When an access token is refreshed using a refresh token Available since 1.16.0jwt.refresh-token.revoke
- When a JWT Refresh Token is revokedkickstart.success
- When kickstart has successfully completed Available since 1.30.0user.action
- When a user action is triggereduser.bulk.create
- When multiple users are created in bulk (i.e. during an import)user.create
- When a user is createduser.create.complete
- When a user create transaction has completed Available since 1.30.0user.deactivate
- When a user is deactivateduser.delete
- When a user is deleteduser.delete.complete
- When a user delete transaction has completed Available since 1.30.0user.email.update
- When a user updates their email address Available since 1.30.0user.email.verified
- When a user verifies their email address Available since 1.8.0user.identity-provider.link
- When a link is created from a user to an Identity Provider Available since 1.36.0user.identity-provider.unlink
- When an existing Identity Provider link is removed from a User Available since 1.36.0user.loginId.duplicate.create
- When a request to create a user with a login Id (email or username) which is already in use has been received Available since 1.30.0Note: An Enterprise plan is required to utilize the
user.loginId.duplicate.create
event .user.loginId.duplicate.update
- When a request to update a user and change their login Id (email or username) to one that is already in use has been received Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.loginId.duplicate.update
event .user.login.failed
- When a user fails a login request Available since 1.6.0user.login.new-device
- When a user begins a login request with a new device Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.login.new-device
event .user.login.success
- When a user completes a login request Available since 1.6.0user.login.suspicious
- When a user logs in and is considered to be a potential threat (requires an activated Enterprise license) Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.login.suspicious
event .user.password.breach
- When Reactor detects a user is using a potentially breached password (requires an activated license) Available since 1.15.0
Note: A paid plan is required to utilize the
user.password.breach
event .user.password.reset.send
- When a forgot password email has been sent to a user Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.send
event.user.password.reset.start
- When the process to reset a user password has started Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.start
event.user.password.reset.success
- When a user has successfully reset their password Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.success
event.user.password.update
- When a user has updated their password Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.update
event.user.reactivate
- When a user is reactivateduser.registration.create
- When a user registration is created Available since 1.6.0user.registration.create.complete
- When a user registration create transaction has completed Available since 1.30.0user.registration.delete
- When a user registration is deleted Available since 1.6.0user.registration.delete.complete
- When a user registration delete transaction has completed Available since 1.30.0user.registration.update
- When a user registration is updated Available since 1.6.0user.registration.update.complete
- When a user registration update transaction has completed Available since 1.30.0user.registration.verified
- When a user completes registration verification Available since 1.8.0user.two-factor.method.add
- When a user has added a two-factor method Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.two-factor.method.add
event.user.two-factor.method.remove
- When a user has removed a two-factor method Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.two-factor.method.remove
event.user.update
- When a user is updateduser.update.complete
- When a user update transaction has completed Available since 1.30.0
tenants[x].eventConfiguration.events[type].enabled
BooleanAvailable since 1.8.0Whether or not FusionAuth should send these types of events to any configured Webhooks.
tenants[x].eventConfiguration.events[type].transactionType
StringAvailable since 1.8.0The transaction type that FusionAuth uses when sending these types of events to any configured Webhooks. The transaction types are:
None
- No Webhooks are required to succeed for the FusionAuth transaction to be committed.Any
- Only a single Webhook is required to succeed for the FusionAuth transaction to be committed.SimpleMajority
- A simple majority (50% or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.SuperMajority
- A super majority (2/3 or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.AbsoluteMajority
- Every Webhook must succeed for the FusionAuth transaction to be committed.
tenants[x].externalIdentifierConfiguration.authorizationGrantIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until an OAuth authorization code is no longer valid to be exchanged for an access token. This is essentially the time allowed between the start of an Authorization request during the Authorization code grant and when you request an access token using this authorization code on the Token endpoint.
Value must be greater than 0 and less than or equal to 600.
tenants[x].externalIdentifierConfiguration.changePasswordIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the change password Id.
If the changePasswordIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the changePasswordIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.changePasswordIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the change password Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.changePasswordIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a change password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.deviceCodeTimeToLiveInSeconds
IntegerAvailable since 1.11.0The time in seconds until a device code Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.deviceUserCodeIdGenerator.length
IntegerAvailable since 1.11.0The length of the secure generator used for generating the device code Id.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.deviceUserCodeIdGenerator.type
StringAvailable since 1.11.0The type of the secure generator used for generating the device code Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.emailVerificationIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the the email verification Id.
If the emailVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.emailVerificationIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the email verification Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.emailVerificationIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until an email verification Id is no longer valid and cannot be used by the Verify Email API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.emailVerificationOneTimeCodeGenerator.length
IntegerAvailable since 1.27.0The length of the secure generator used for generating the email verification one time code.
If the emailVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.emailVerificationOneTimeCodeGenerator.type
StringAvailable since 1.27.0The type of the secure generator used for generating the email verification one time code. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.externalAuthenticationIdTimeToLiveInSeconds
IntegerAvailable since 1.12.0The time in seconds until an external authentication Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.loginIntentTimeToLiveInSeconds
IntegerAvailable since 1.53.0The time in seconds until a Login Timeout identifier is no longer valid to complete post-authentication steps in the OAuth workflow. Must be greater than 0.
tenants[x].externalIdentifierConfiguration.oneTimePasswordTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a One Time Password is no longer valid and cannot be used by the Login API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.passwordlessLoginGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the passwordless login.
If the passwordlessLoginGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the passwordlessLoginGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.passwordlessLoginGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the passwordless login. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.passwordlessLoginTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a passwordless code is no longer valid and cannot be used by the Passwordless API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.pendingAccountLinkTimeToLiveInSeconds
IntegerAvailable since 1.28.0The number of seconds before the pending account link identifier is no longer valid to complete an account link request.
tenants[x].externalIdentifierConfiguration.registrationVerificationIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the registration verification Id.
If the registrationVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.registrationVerificationIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the registration verification Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.registrationVerificationIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a registration verification Id is no longer valid and cannot be used by the Verify Registration API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.registrationVerificationOneTimeCodeGenerator.length
IntegerAvailable since 1.27.0The length of the secure generator used for generating the registration verification one time code.
If the registrationVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.registrationVerificationOneTimeCodeGenerator.type
StringAvailable since 1.27.0The type of the secure generator used for generating the registration verification one time code. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.rememberOAuthScopeConsentChoiceTimeToLiveInSeconds
IntegerAvailable since 1.50.0The time in seconds until remembered OAuth scope consent choices are no longer valid, and the User will be prompted to consent to requested OAuth scopes even if they have not changed. Applies only when application.oauthConfiguration.consentMode is set to RememberDecision
. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.samlv2AuthNRequestIdTimeToLiveInSeconds
IntegerAvailable since 1.19.0The time in seconds that a SAML AuthN request Id returned by the Start SAML v2 Login Request API will be eligible to be used to complete a SAML v2 Login request.
tenants[x].externalIdentifierConfiguration.setupPasswordIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the setup password Id.
If the setupPasswordIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the setupPasswordIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.setupPasswordIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the setup password Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.setupPasswordIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a setup password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.trustTokenTimeToLiveInSeconds
IntegerAvailable since 1.33.0The number of seconds before the Trust Token is no longer valid to complete a request that requires trust. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.twoFactorIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a two factor Id is no longer valid and cannot be used by the Two Factor Login API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.twoFactorOneTimeCodeIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the the two factor one time code Id.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.twoFactorOneTimeCodeIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the two factor code Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.twoFactorOneTimeCodeIdTimeToLiveInSeconds
IntegerAvailable since 1.26.0The number of seconds before the Two-Factor One Time Code used to enable or disable a two-factor method is no longer valid. Must be greater than 0.
tenants[x].externalIdentifierConfiguration.twoFactorTrustIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until an issued Two Factor trust Id is no longer valid and the User will be required to complete Two Factor authentication during the next authentication attempt. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.webAuthnAuthenticationChallengeTimeToLiveInSeconds
IntegerAvailable since 1.41.0The time in seconds until a WebAuthn authentication challenge is no longer valid and the User will be required to restart the WebAuthn authentication ceremony by creating a new challenge. This value also controls the timeout for the client-side WebAuthn navigator.credentials.get
API call. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.webAuthnRegistrationChallengeTimeToLiveInSeconds
IntegerAvailable since 1.41.0The time in seconds until a WebAuthn registration challenge is no longer valid and the User will be required to restart the WebAuthn registration ceremony by creating a new challenge. This value also controls the timeout for the client-side WebAuthn navigator.credentials.create
API call. Value must be greater than 0.
tenant.failedAuthenticationConfiguration.actionCancelPolicy.onPasswordReset
BooleanAvailable since 1.42.0Indicates whether you want the user to be able to self-service unlock their account prior to the action duration by completing a password reset workflow.
tenants[x].failedAuthenticationConfiguration.actionDuration
LongAvailable since 1.8.0The duration of the User Action. This value along with the actionDurationUnit
will be used to set the duration of the User Action. Value must be greater than 0.
tenants[x].failedAuthenticationConfiguration.actionDurationUnit
StringAvailable since 1.8.0The unit of time associated with a duration. The possible values are:
MINUTES
HOURS
DAYS
WEEKS
MONTHS
YEARS
tenant.failedAuthenticationConfiguration.emailUser
StringAvailable since 1.42.0Indicates you would like to email the user when the user’s account is locked due to this action being taken. This requires the User Action specified by the tenant.failedAuthenticationConfiguration.userActionId to also be configured for email. If the User Action is not configured to be able to email the user, this configuration will be ignored. See userEmailingEnabled on the User Action.
tenants[x].failedAuthenticationConfiguration.resetCountInSeconds
IntegerAvailable since 1.8.0The length of time in seconds before the failed authentication count will be reset. Value must be greater than 0.
For example, if tooManyAttempts
is set to 5
and you fail to authenticate 4
times in a row, waiting for the duration specified here will cause your fifth attempt to start back at 1
.
tenants[x].failedAuthenticationConfiguration.tooManyAttempts
IntegerAvailable since 1.8.0The number of failed attempts considered to be too many. Once this threshold is reached the specified User Action will be applied to the user for the duration specified. Value must be greater than 0.
tenants[x].failedAuthenticationConfiguration.userActionId
UUIDAvailable since 1.8.0The Id of the User Action that is applied when the threshold is reached for too many failed authentication attempts.
tenants[x].familyConfiguration.allowChildRegistrations
BooleanAvailable since 1.8.0Whether to allow child registrations.
tenants[x].familyConfiguration.confirmChildEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use when confirming a child.
tenants[x].familyConfiguration.deleteOrphanedAccounts
BooleanAvailable since 1.8.0Indicates that child users without parental verification will be permanently deleted after tenants[x].familyConfiguration.deleteOrphanedAccountsDays days.
tenants[x].familyConfiguration.deleteOrphanedAccountsDays
IntegerAvailable since 1.8.0The number of days from creation child users will be retained before being deleted for not completing parental verification. Value must be greater than 0.
tenants[x].familyConfiguration.enabled
BooleanAvailable since 1.8.0Whether family configuration is enabled.
tenants[x].familyConfiguration.familyRequestEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use when a family request is made.
tenants[x].familyConfiguration.maximumChildAge
IntegerAvailable since 1.8.0The maximum age of a child. Value must be greater than 0.
tenants[x].familyConfiguration.minimumOwnerAge
IntegerAvailable since 1.8.0The minimum age to be an owner. Value must be greater than 0.
tenants[x].familyConfiguration.parentEmailRequired
BooleanAvailable since 1.8.0Whether a parent email is required.
tenants[x].familyConfiguration.parentRegistrationEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use for parent registration.
tenants[x].formConfiguration.adminUserFormId
UUIDAvailable since 1.20.0The unique Id of the form to use for the Add and Edit User form when used in the FusionAuth admin UI.
tenants[x].httpSessionMaxInactiveInterval
IntegerAvailable since 1.8.0Time in seconds until an inactive session will be invalidated. Used when creating a new session in the FusionAuth OAuth frontend.
tenants[x].id
UUIDThe unique identifier for this Tenant.
tenants[x].insertInstant
LongThe instant that the Tenant was added to the FusionAuth database.
tenants[x].issuer
StringAvailable since 1.8.0The named issuer used to sign tokens, this is generally your public fully qualified domain.
tenants[x].jwtConfiguration.accessTokenKeyId
UUIDAvailable since 1.8.0The unique id of the signing key used to sign the access token.
tenants[x].jwtConfiguration.idTokenKeyId
UUIDAvailable since 1.8.0The unique id of the signing key used to sign the Id token.
tenants[x].jwtConfiguration.refreshTokenExpirationPolicy
StringAvailable since 1.17.0The Refresh Token expiration policy.
The possible values are:
Fixed
- the expiration is calculated from the time the token is issued.SlidingWindow
- the expiration is calculated from the last time the token was used.SlidingWindowWithMaximumLifetime
- the expiration is calculated from the last time the token was used, or until the maximumTimeToLiveInMinutes is reached. Available since 1.46.0
tenants[x].jwtConfiguration.refreshTokenRevocationPolicy.onLoginPrevented
BooleanAvailable since 1.17.0When enabled, all refresh tokens will be revoked when a user action, such as locking an account based on a number of failed login attempts, prevents user login.
tenants[x].jwtConfiguration.refreshTokenRevocationPolicy.onMultiFactorEnable
BooleanAvailable since 1.42.0When enabled, all refresh tokens will be revoked when a user enables multi-factor authentication for the first time. This policy will not be applied when adding subsequent multi-factor methods to the user.
tenants[x].jwtConfiguration.refreshTokenRevocationPolicy.onPasswordChanged
BooleanAvailable since 1.17.0When enabled, all refresh tokens will be revoked when a user changes their password.
tenants[x].jwtConfiguration.refreshTokenSlidingWindowConfiguration.maximumTimeToLiveInMinutes
IntegerAvailable since 1.46.0The maximum lifetime of a refresh token when using a refreshTokenExpirationPolicy of SlidingWindowWithMaximumLifetime
.
tenants[x].jwtConfiguration.refreshTokenTimeToLiveInMinutes
IntegerAvailable since 1.8.0The length of time in minutes a Refresh Token is valid from the time it was issued. Value must be greater than 0.
tenants[x].jwtConfiguration.refreshTokenUsagePolicy
StringAvailable since 1.17.0The refresh token usage policy. The following are valid values:
-
Reusable
- the token does not change after it was issued. -
OneTimeUse
- the token value will be changed each time the token is used to refresh a JWT. The client must store the new value after each usage.tenants[x].jwtConfiguration.timeToLiveInSeconds
IntegerAvailable since 1.8.0The length of time in seconds this JWT is valid from the time it was issued. Value must be greater than 0.
tenants[x].lambdaConfiguration.loginValidationId
UUIDAvailable since 1.53.0The Id of the lambda that will be invoked at the end of a successful login request in order to extend custom validation of a login request.
tenants[x].lambdaConfiguration.scimEnterpriseUserRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Request Lambda that will be used to convert the SCIM Enterprise User request to a FusionAuth User.
tenants[x].lambdaConfiguration.scimEnterpriseUserResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth Enterprise User to a SCIM Server response.
tenants[x].lambdaConfiguration.scimGroupRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM Group Request Lambda that will be used to convert the SCIM Group request to a FusionAuth Group.
tenants[x].lambdaConfiguration.scimGroupResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM GroupResponse Lambda that will be used to convert a FusionAuth Group to a SCIM Server response.
tenants[x].lambdaConfiguration.scimUserRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Request Lambda that will be used to convert the SCIM User request to a FusionAuth User.
tenants[x].lambdaConfiguration.scimUserResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth User to a SCIM Server response.
tenants[x].lastUpdateInstant
LongThe instant that the Tenant was last updated in the FusionAuth database.
tenants[x].loginConfiguration.requireAuthentication
BooleanAvailable since 1.26.0Indicates whether to require an API key for the Login API when an
applicationId
is not provided. When anapplicationId
is provided to the Login API call, the application configuration will take precedence.tenants[x].logoutURL
StringAvailable since 1.8.0The logout redirect URL when sending the user’s browser to the
/oauth2/logout
URI of the FusionAuth Front End. This value is only used when a logout URL is not defined in your Application.tenants[x].maximumPasswordAge.days
IntegerAvailable since 1.8.0The password maximum age in days. The number of days after which FusionAuth will require a user to change their password. Required when tenant.maximumPasswordAge.enabled is set to
true
.tenants[x].maximumPasswordAge.enabled
BooleanAvailable since 1.8.0Indicates that the maximum password age is enabled and being enforced.
tenants[x].minimumPasswordAge.seconds
IntegerAvailable since 1.8.0The password minimum age in seconds. When enabled FusionAuth will not allow a password to be changed until it reaches this minimum age. Required when tenant.minimumPasswordAge.enabled is set to
true
.tenants[x].minimumPasswordAge.enabled
BooleanAvailable since 1.8.0Indicates that the minimum password age is enabled and being enforced.
tenants[x].multiFactorConfiguration.authenticator.algorithm
StringAvailable since 1.26.0The algorithm used by the TOTP authenticator. This value is
HmacSHA1
and read only.tenants[x].multiFactorConfiguration.authenticator.codeLength
IntegerAvailable since 1.26.0The length of the code generated by the TOTP. This value is
6
and read only.tenants[x].multiFactorConfiguration.authenticator.enabled
BooleanAvailable since 1.26.0When enabled, users may utilize an authenticator application to complete a multi-factor authentication request. This method uses TOTP (Time-Based One-Time Password) as defined in RFC 6238 and often uses an native mobile app such as Google Authenticator.
tenants[x].multiFactorConfiguration.authenticator.timeStep
IntegerAvailable since 1.26.0The time-step size in seconds. This value is
30
and read only.tenants[x].multiFactorConfiguration.email.enabled
BooleanAvailable since 1.26.0When enabled, users may utilize an email address to complete a two-factor authentication request.
tenants[x].multiFactorConfiguration.email.templateId
UUIDAvailable since 1.26.0The Id of the email template that is used when notifying a user to complete a two-factor authentication request.
tenants[x].multiFactorConfiguration.sms.enabled
BooleanAvailable since 1.26.0When enabled, users may utilize a mobile phone number to complete a two-factor authentication request.
tenants[x].multiFactorConfiguration.sms.messengerId
UUIDAvailable since 1.26.0The messenger that is used to deliver a SMS two-factor authentication request.
tenants[x].multiFactorConfiguration.sms.templateId
UUIDAvailable since 1.26.0The Id of the SMS template that is used when notifying a user to complete a two-factor authentication request.
tenants[x].name
StringThe unique name of the Tenant.
tenants[x].oauthConfiguration.clientCredentialsAccessTokenPopulateLambdaId
UUIDAvailable since 1.26.0The Id of a lambda that will be called to populate the JWT during a client credentials grant.
tenants[x].passwordEncryptionConfiguration.encryptionScheme
StringAvailable since 1.8.0The default method for encrypting the User’s password. The following encryptors are provided with FusionAuth:
- salted-md5
- salted-sha256
- salted-hmac-sha256
- salted-pbkdf2-hmac-sha256
- salted-pbkdf2-hmac-sha256-512 available since 1.34.0
- salted-pbkdf2-hmac-sha512-512 available since 1.43.0
- bcrypt
- phpass-md5 available since 1.45.0
- phpass-sha512 available since 1.45.0
tenants[x].passwordEncryptionConfiguration.encryptionSchemeFactor
IntegerAvailable since 1.8.0The factor used by the password encryption scheme. If not provided, the
PasswordEncryptor
provides a default value. Generally this will be used as an iteration count to generate the hash. The actual use of this value is up to thePasswordEncryptor
implementation.tenants[x].passwordEncryptionConfiguration.modifyEncryptionSchemeOnLogin
BooleanAvailable since 1.8.0When enabled a user’s hash configuration will be modified to match these configured settings. This can be useful to increase a password hash strength over time or upgrade imported users to a more secure encryption scheme after an initial import.
Beginning in version
1.42.0
when this configuration is enabled, in addition to re-hashing on login, the password will be re-hashed on password change as well.tenants[x].passwordValidationRules.breachDetection.enabled
BooleanAvailable since 1.15.0Whether to enable Reactor breach detection. Requires an activated license.
tenants[x].passwordValidationRules.breachDetection.matchMode
StringAvailable since 1.15.0The level of severity where Reactor will consider a breach. The following are valid values:
High
Only requires a password match, this is the most secure and is recommendedMedium
Exact match on username, email address or email sub-addressLow
Exact match on an email or username, or the password is a common breached value
tenants[x].passwordValidationRules.breachDetection.notifyUserEmailTemplateId
UUIDAvailable since 1.15.0The Id of the email template to use when notifying a user of a breached password.
tenants[x].passwordValidationRules.breachDetection.onLogin
StringAvailable since 1.15.0The behavior when detecting breaches at time of user login. The following are valid values:
Off
Do not perform breach detection at loginRecordOnly
Only record the result, take no actionNotifyUser
Notify the end user via emailRequireChange
Require immediate password change
tenants[x].passwordValidationRules.maxLength
IntegerAvailable since 1.8.0The maximum length of a password when a new user is created or a user requests a password change.
tenants[x].passwordValidationRules.minLength
IntegerAvailable since 1.8.0The minimum length of a password when a new user is created or a user requests a password change.
tenants[x].passwordValidationRules.rememberPreviousPasswords.count
IntegerAvailable since 1.8.0The number of previous passwords to remember. Value must be greater than 0.
tenants[x].passwordValidationRules.rememberPreviousPasswords.enabled
BooleanAvailable since 1.8.0Whether to prevent a user from using any of their previous passwords.
tenants[x].passwordValidationRules.requireMixedCase
BooleanAvailable since 1.8.0Whether to force the user to use at least one uppercase and one lowercase character.
tenants[x].passwordValidationRules.requireNonAlpha
BooleanAvailable since 1.8.0Whether to force the user to use at least one non-alphanumeric character.
tenants[x].passwordValidationRules.requireNumber
BooleanAvailable since 1.8.0Whether to force the user to use at least one number.
tenants[x].passwordValidationRules.validateOnLogin
BooleanAvailable since 1.15.0When enabled the user’s password will be validated during login. If the password does not meet the currently configured validation rules the user will be required to change their password.
tenants[x].rateLimitConfiguration.failedLogin.limit
IntegerAvailable since 1.30.0The number of times a user can fail to login within the configured timePeriodInSeconds duration. If a Failed authentication action has been configured then it will take precedence.
tenants[x].rateLimitConfiguration.failedLogin.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can fail login before being rate limited.
tenants[x].rateLimitConfiguration.forgotPassword.limit
IntegerAvailable since 1.30.0The number of times a user can request a forgot password email within the configured timePeriodInSeconds duration.
tenants[x].rateLimitConfiguration.forgotPassword.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a forgot password email before being rate limited.
tenants[x].rateLimitConfiguration.sendEmailVerification.limit
IntegerAvailable since 1.30.0The number of times a user can request a verification email within the configured timePeriodInSeconds duration.
tenants[x].rateLimitConfiguration.sendEmailVerification.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a verification email before being rate limited.
tenants[x].rateLimitConfiguration.sendPasswordless.limit
IntegerAvailable since 1.30.0The number of times a user can request a passwordless login email within the configured timePeriodInSeconds duration.
tenants[x].rateLimitConfiguration.sendPasswordless.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a passwordless login email before being rate limited.
tenants[x].rateLimitConfiguration.sendRegistrationVerification.limit
IntegerAvailable since 1.30.0The number of times a user can request a registration verification email within the configured timePeriodInSeconds duration.
tenants[x].rateLimitConfiguration.sendRegistrationVerification.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a registration verification email before being rate limited.
tenants[x].rateLimitConfiguration.sendTwoFactor.limit
IntegerAvailable since 1.30.0The number of times a user can request a two-factor code by email or SMS within the configured timePeriodInSeconds duration.
tenants[x].rateLimitConfiguration.sendTwoFactor.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a two-factor code by email or SMS before being rate limited.
tenants[x].registrationConfiguration.blockedDomains
Array<String>Available since 1.30.0A list of unique domains that are not allowed to register when self service is enabled.
tenants[x].scimServerConfiguration.clientEntityTypeId
UUIDAvailable since 1.36.0The Entity Type that will be used to represent SCIM Clients for this tenant.
tenants[x].scimServerConfiguration.enabled
BooleanAvailable since 1.36.0Whether or not this tenant has the SCIM endpoints enabled.
tenants[x].scimServerConfiguration.schemas
MapAvailable since 1.36.0JSON formatted as a SCIM Schemas endpoint response. Because the SCIM lambdas may modify the JSON response, ensure the Schema’s response matches that generated by the response lambdas. More about Schema definitions.
tenants[x].scimServerConfiguration.serverEntityTypeId
UUIDAvailable since 1.36.0The Entity Type that will be used to represent SCIM Servers for this tenant.
tenants[x].ssoConfiguration.deviceTrustTimeToLiveInSeconds
IntegerAvailable since 1.30.2The number of seconds before a trusted device is reset. When reset, a user is forced to complete captcha during login and complete two factor authentication if applicable.
tenants[x].state
StringAvailable since 1.22.0The current state of the tenant. The following are valid values:
Active
- The tenant is active.PendingDelete
- A delete request has been requested and is being processed.
tenants[x].themeId
UUIDAvailable since 1.8.0The unique Id of the theme to be used to style the login page and other end user templates.
tenants[x].userDeletePolicy.unverified.enabled
BooleanAvailable since 1.13.0Indicates that users without a verified email address will be permanently deleted after tenants[x].userDeletePolicy.unverified.numberOfDaysToRetain days.
tenants[x].userDeletePolicy.unverified.enabledInstant
LongAvailable since 1.48.0The instant that this policy was enabled.
Users created before this time will not be eligible to be deleted. This means that you can safely enable this feature and the policy will only be enforced for users created after this policy was enabled. If you would like to delete users created prior to this policy being enabled that have an unverified email address, you can use the User Search API or User Bulk Delete API to search on the
insertInstant
andverified
fields to identify users that you would like to delete.For example, the following query string will return users that were created at least 7 days ago that have not verified their email address.
insertInstant:<now-7d AND verified:false
Please note that prior to version
1.48.0
, when enabling this policy all user’s with an unverified email were eligible for deletion.tenants[x].userDeletePolicy.unverified.numberOfDaysToRetain
IntegerAvailable since 1.13.0The number of days from creation users will be retained before being deleted for not completing email verification. Value must be greater than 0.
tenants[x].usernameConfiguration.unique.enabled
BooleanAvailable since 1.27.0When
true
, FusionAuth will handle username collisions by generating a random suffix. Users with colliding usernames will be able to use the same one, but in the admin and API interfaces, a unique username will be displayed.tenants[x].usernameConfiguration.unique.numberOfDigits
IntegerAvailable since 1.27.0The maximum number of digits to use when building a unique suffix for a username. A number will be randomly selected and will be 1 or more digits up to this configured value in length. For example, if this value is
5
, the suffix will be a number between00001
and99999
, inclusive.tenants[x].usernameConfiguration.unique.separator
StringAvailable since 1.27.0A single character to use as a separator from the requested username and a unique suffix that is added when a duplicate username is detected. This value can be a single non alphanumeric ASCII character.
tenants[x].usernameConfiguration.unique.strategy
StringAvailable since 1.29.0This strategy instructions FusionAuth when to append a unique suffix to the username. The possible values are:
Always
- Always append a unique suffix even when the requested username is not in use.OnCollision
- Only append a unique suffix when the requested username is in use.
tenants[x].webAuthnConfiguration.bootstrapWorkflow.authenticatorAttachmentPreference
StringAvailable since 1.41.0The authenticator attachment requirement for WebAuthn passkey registration when using the bootstrap workflow. The possible values are:
any
- An authenticator with any attachment modality will be allowed during registration.crossPlatform
- Only authenticators with thecross-platform
attachment modality will be allowed during registration. These are also referred to as “roaming” authenticators.platform
- Only authenticators with theplatform
attachment modality will be allowed during registration.
tenants[x].webAuthnConfiguration.bootstrapWorkflow.enabled
BooleanAvailable since 1.41.0Whether the WebAuthn bootstrap workflow is enabled.
tenants[x].webAuthnConfiguration.bootstrapWorkflow.userVerificationRequirement
StringAvailable since 1.41.0The user verification requirement for WebAuthn passkey registration and authentication when using the bootstrap workflow. The possible values are:
discouraged
- If possible, do not require user verification during registration and authentication.preferred
- Prefer authenticators that support user verification during registration and authentication but allow others.required
- Only authenticators that support user verification will be allowed.
tenants[x].webAuthnConfiguration.debug
BooleanAvailable since 1.41.0Whether debug event log output is enabled for WebAuthn.
tenants[x].webAuthnConfiguration.enabled
BooleanAvailable since 1.41.0Whether WebAuthn configuration is enabled.
tenants[x].webAuthnConfiguration.reauthenticationWorkflow.authenticatorAttachmentPreference
StringAvailable since 1.41.0The authenticator attachment requirement for WebAuthn passkey registration when using the reauthentication workflow. The possible values are:
any
- An authenticator with any attachment modality will be allowed during registration.crossPlatform
- Only authenticators with thecross-platform
attachment modality will be allowed during registration. These are also referred to as “roaming” authenticators.platform
- Only authenticators with theplatform
attachment modality will be allowed during registration.
tenants[x].webAuthnConfiguration.reauthenticationWorkflow.enabled
BooleanAvailable since 1.41.0Whether the WebAuthn reauthentication workflow is enabled.
tenants[x].webAuthnConfiguration.reauthenticationWorkflow.userVerificationRequirement
StringAvailable since 1.41.0The user verification requirement for WebAuthn passkey registration and authentication when using the reauthentication workflow. The possible values are:
discouraged
- If possible, do not require user verification during registration and authentication.preferred
- Prefer authenticators that support user verification during registration and authentication but allow others.required
- Only authenticators that support user verification will be allowed.
tenants[x].webAuthnConfiguration.relyingPartyId
StringAvailable since 1.41.0The Relying Party Id the tenant will use in WebAuthn ceremonies. Passkeys can only be used to authenticate on sites using the same Relying Party Id they were registered with.
The default value is
null
, which instructs the WebAuthn JavaScript API to use the browser origin.tenants[x].webAuthnConfiguration.relyingPartyName
StringAvailable since 1.41.0The Relying Party name the tenant will use in WebAuthn ceremonies. This value is used only for display and may be shown by browser or OS dialogs during WebAuthn ceremonies.
If no value is configured, the tenant.issuer value will be used.
Example Response JSON for all the Tenants
{
"tenants": [
{
"accessControlConfiguration": {
"uiIPAccessControlListId": "11d49de7-69f6-46fc-8270-0b3aa626327a"
},
"configured": true,
"captchaConfiguration": {
"captchaMethod": "GoogleRecaptchaV3",
"enabled": false,
"threshold": 0.5
},
"connectorPolicies": [
{
"connectorId": "e3306678-a53a-4964-9040-1c96f36dda72",
"domains": [
"*"
],
"migrate": false
},
{
"connectorId": "27f22280-7e55-4d1c-b9f8-239bf9cc1a5e",
"domains": [
"*"
],
"migrate": true
}
],
"data": {
"description": "No more secrets, Marty."
},
"emailConfiguration": {
"additionalHeaders": [
{
"name": "X-SES-CONFIGURATION-SET",
"value": "example_configuration_set_name"
}
],
"defaultFromEmail": "jared@piedpiper.com",
"defaultFromName": "Jared Dunn",
"emailUpdateEmailTemplateId": "ec3045c7-97d8-47f8-8725-61b93deacf5d",
"emailVerifiedEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
"forgotPasswordEmailTemplateId": "49aba1de-0225-45d7-a2b1-f9fe46b0242c",
"host": "smtp.sendgrid.net",
"implicitEmailVerificationAllowed": true,
"loginIdInUseOnCreateEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginIdInUseOnUpdateEmailTemplateId": "2c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginNewDeviceEmailTemplateId": "3c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginSuspiciousEmailTemplateId": "4c3045c7-97d8-47f8-8725-61b93deacf5d",
"password": "password",
"passwordlessEmailTemplateId": "a917e23a-da58-4cda-be01-90f542f8c343",
"passwordResetSuccessEmailTemplateId": "5c3045c7-97d8-47f8-8725-61b93deacf5d",
"passwordUpdateEmailTemplateId": "6c3045c7-97d8-47f8-8725-61b93deacf5d",
"port": 587,
"properties": {
"key": "value"
},
"security": "TLS",
"setPasswordEmailTemplateId": "a9aba13e-0125-4fd7-a2b1-aaa146b02423",
"twoFactorMethodAddEmailTemplateId": "7c3045c7-97d8-47f8-8725-61b93deacf5d",
"twoFactorMethodRemoveEmailTemplateId": "8c3045c7-97d8-47f8-8725-61b93deacf5d",
"unverified": {
"allowEmailChangeWhenGated": false,
"behavior": "Allow"
},
"username": "username",
"verificationEmailTemplateId": "8da42c09-461c-45f3-b931-6e9f63b87ab5",
"verificationStrategy": "FormField",
"verifyEmail": true,
"verifyEmailWhenChanged": true
},
"eventConfiguration": {
"events": {
"user.delete": {
"enabled": true,
"transactionType": "None"
},
"user.create": {
"enabled": true,
"transactionType": "None"
},
"user.update": {
"enabled": true,
"transactionType": "None"
},
"user.deactivate": {
"enabled": true,
"transactionType": "None"
},
"user.bulk.create": {
"enabled": true,
"transactionType": "None"
},
"user.reactivate": {
"enabled": true,
"transactionType": "None"
},
"jwt.refresh": {
"enabled": true,
"transactionType": "None"
},
"jwt.refresh-token.revoke": {
"enabled": true,
"transactionType": "None"
},
"jwt.public-key.update": {
"enabled": true,
"transactionType": "None"
},
"user.login.success": {
"enabled": true,
"transactionType": "None"
},
"user.login.failed": {
"enabled": true,
"transactionType": "None"
},
"user.password.breach": {
"enabled": true,
"transactionType": "None"
},
"user.registration.create": {
"enabled": true,
"transactionType": "None"
},
"user.registration.update": {
"enabled": true,
"transactionType": "None"
},
"user.registration.delete": {
"enabled": true,
"transactionType": "None"
},
"user.registration.verified": {
"enabled": true,
"transactionType": "None"
},
"user.email.verified": {
"enabled": true,
"transactionType": "None"
}
}
},
"externalIdentifierConfiguration": {
"authorizationGrantIdTimeToLiveInSeconds": 30,
"changePasswordIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"changePasswordIdTimeToLiveInSeconds": 600,
"deviceCodeTimeToLiveInSeconds": 1800,
"deviceUserCodeIdGenerator": {
"length": 6,
"type": "randomAlphaNumeric"
},
"emailVerificationIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"emailVerificationIdTimeToLiveInSeconds": 86400,
"emailVerificationOneTimeCodeGenerator": {
"length": 6,
"type": "randomAlphaNumeric"
},
"externalAuthenticationIdTimeToLiveInSeconds": 300,
"loginIntentTimeToLiveInSeconds": 1800,
"oneTimePasswordTimeToLiveInSeconds": 60,
"passwordlessLoginGenerator": {
"length": 32,
"type": "randomBytes"
},
"passwordlessLoginTimeToLiveInSeconds": 180,
"pendingAccountLinkTimeToLiveInSeconds": 3600,
"registrationVerificationIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"registrationVerificationIdTimeToLiveInSeconds": 86400,
"registrationVerificationOneTimeCodeGenerator": {
"length": 6,
"type": "randomAlphaNumeric"
},
"rememberOAuthScopeConsentChoiceTimeToLiveInSeconds": 2592000,
"samlv2AuthNRequestIdTimeToLiveInSeconds": 300,
"setupPasswordIdGenerator": {
"length": 32,
"type": "randomBytes"
},
"setupPasswordIdTimeToLiveInSeconds": 86400,
"twoFactorIdTimeToLiveInSeconds": 300,
"twoFactorOneTimeCodeIdGenerator": {
"length": 6,
"type": "randomDigits"
},
"twoFactorOneTimeCodeIdTimeToLiveInSeconds": 60,
"twoFactorTrustIdTimeToLiveInSeconds": 2592000,
"webAuthnAuthenticationChallengeTimeToLiveInSeconds": 180,
"webAuthnRegistrationChallengeTimeToLiveInSeconds": 180
},
"failedAuthenticationConfiguration": {
"actionCancelPolicy": {
"onPasswordReset": false
},
"actionDuration": 3,
"actionDurationUnit": "MINUTES",
"emailUser": false,
"resetCountInSeconds": 60,
"tooManyAttempts": 5,
"userActionId": "16cfc707-268c-4c5b-8989-f71f3ee156d4"
},
"familyConfiguration": {
"allowChildRegistrations": true,
"confirmChildEmailTemplateId": "87654321-4321-8765-ba09-ba0987654321",
"deleteOrphanedAccounts": false,
"deleteOrphanedAccountsDays": 30,
"enabled": true,
"familyRequestEmailTemplateId": "57462514-a73b-cd76-0001-b8a65cd61230",
"maximumChildAge": 12,
"minimumOwnerAge": 21,
"parentEmailRequired": false,
"parentRegistrationEmailTemplateId": "12345678-1234-5678-90ab-1234567890ab"
},
"formConfiguration": {
"adminUserFormId": "e92751a5-25f4-4bca-ad91-66cdf67725d2"
},
"httpSessionMaxInactiveInterval": 3600,
"id": "32306536-3036-6431-3865-646430303332",
"insertInstant": 1572469040579,
"issuer": "https://example.com",
"jwtConfiguration": {
"accessTokenKeyId": "025233ca-d4f3-2aa4-eca9-7e4200e9b472",
"enabled": true,
"idTokenKeyId": "092dbedc-30af-4149-9c61-b578f2c72f59",
"refreshTokenExpirationPolicy": "Fixed",
"refreshTokenRevocationPolicy": {
"onLoginPrevented": true,
"onMultiFactorEnable": true,
"onPasswordChanged": true
},
"refreshTokenTimeToLiveInMinutes": 43200,
"refreshTokenUsagePolicy": "Reusable",
"timeToLiveInSeconds": 3600
},
"lambdaConfiguration": {
"loginValidationId": "c0dd79db-38dd-424b-b77a-4dccaad71052",
"scimEnterpriseUserRequestConverterId": "c2e70f8d-19bb-4df7-848a-33a9a1e26b84",
"scimEnterpriseUserResponseConverterId": "44fc9553-8a2e-408f-8aa2-fa65b70b55e2",
"scimGroupRequestConverterId": "66d65de0-1819-42f8-86ed-7daaa4e155dc",
"scimGroupResponseConverterId": "79812ede-432f-4375-9b43-23c0fe996fef",
"scimUserRequestConverterId": "8a51d7a1-5e3e-442a-b96a-0c31379bb3d4",
"scimUserResponseConverterId": "c8720843-dc4f-4e6c-b6ca-500e9c44695f"
},
"lastUpdateInstant": 1595361143101,
"loginConfiguration": {
"requireAuthentication": true
},
"logoutURL": "http://example.com/logout",
"maximumPasswordAge": {
"days": 180,
"enabled": false
},
"minimumPasswordAge": {
"enabled": false,
"seconds": 30
},
"multiFactorConfiguration": {
"authenticator": {
"algorithm": "HmacSHA1",
"codeLength": 6,
"enabled": true,
"timeStep": 30
},
"email": {
"enabled": true,
"templateId": "d312fb71-d7d8-4b75-a497-6096a07220b3"
},
"loginPolicy": "Enabled",
"sms": {
"enabled": true,
"messengerId": "0a4bae38-ffef-4c33-b74c-1d50c796f600",
"templateId": "f35e04e6-72ec-4f52-b552-29cf950a4ed6"
}
},
"name": "Playtronics Co.",
"oauthConfiguration": {
"clientCredentialsAccessTokenPopulateLambdaId": "46e120c1-4c22-473f-95b4-e2c187cd20c2"
},
"passwordEncryptionConfiguration": {
"encryptionScheme": "salted-pbkdf2-hmac-sha256",
"encryptionSchemeFactor": 24000,
"modifyEncryptionSchemeOnLogin": false
},
"passwordValidationRules": {
"breachDetection": {
"enabled": true,
"notifyUserEmailTemplateId": "e6c74b53-d43d-471e-ae7e-906456d0f341",
"matchMode": "High",
"onLogin": "Off"
},
"maxLength": 256,
"minLength": 8,
"rememberPreviousPasswords": {
"count": 2,
"enabled": true
},
"requireMixedCase": true,
"requireNonAlpha": true,
"requireNumber": true,
"validateOnLogin": false
},
"scimServerConfiguration": {
"clientEntityTypeId": "d9ed49f7-1106-4b20-acdb-5cbda76ae77e",
"enabled": true,
"serverEntityTypeId": "919e0ac5-1cf0-4fcf-a8fc-29d77a0d1d8f",
"schemas": {}
},
"ssoConfiguration": {
"deviceTrustTimeToLiveInSeconds": 31536000
},
"state": "Active",
"themeId": "c6ad3fac-6f32-4db7-91a4-061ff035e871",
"userDeletePolicy": {
"unverified": {
"enabled": true,
"enabledInstant": 1698772159415,
"numberOfDaysToRetain": 30
}
},
"usernameConfiguration": {
"unique": {
"enabled": false,
"numberOfDigits": 5,
"separator": "#",
"strategy": "OnCollision"
}
},
"webAuthnConfiguration": {
"enabled": true,
"bootstrapWorkflow": {
"authenticatorAttachmentPreference": "crossPlatform",
"enabled": true,
"userVerificationRequirement": "required"
},
"debug": false,
"reauthenticationWorkflow": {
"authenticatorAttachmentPreference": "platform",
"enabled": true,
"userVerificationRequirement": "required"
},
"relyingPartyId": "piedpiper.com",
"relyingPartyName": "Pied Piper"
}
}
]
}
Search for Tenants
This API has been available since 1.45.0
This API is used to search for Tenants and may be called using the GET
or POST
HTTP methods. Examples of each are provided below. The POST
method is provided to allow for a richer request object without worrying about exceeding the maximum length of a URL. Calling this API with either the GET
or POST
HTTP method will provide the same search results given the same query parameters.
Note: API key authentication must be made using a global API key. The request may not contain the X-FusionAuth-TenantId
request header. Requests made using an API key scoped to a specific tenant, or containing the X-FusionAuth-TenantId
request header will fail with a 401
status code.
Request
Request Parameters
name
StringThe case-insensitive string to search for in the Tenant name. This can contain wildcards using the asterisk character (*
). If no wildcards are present, this parameter value will be interpreted as *value*
.
numberOfResults
IntegerDefaults to 25The number of results to return from the search.
orderBy
StringDefaults to name ASCThe database field to order the search results as well as an order direction.
The possible values are:
id
- the unique Id of the TenantinsertInstant
- the instant when the Tenant was createdname
- the Tenant name
The order direction is optional. Possible values of the order direction are ASC
or DESC
. If omitted, the default sort order is ASC
.
For example, to order the results by the insert instant in a descending order, use insertInstant DESC
.
startRow
IntegerDefaults to 0The offset into the total results. In order to paginate the results, increment this value by the numberOfResults for subsequent requests.
For example, if the total search results are greater than the page size designated by numberOfResults , set this value to 25
to retrieve results 26-50
, assuming the default page size.
When calling the API using a POST
request you will send the search criteria in a JSON request body.
Request Body
search.name
StringThe case-insensitive string to search for in the Tenant name. This can contain wildcards using the asterisk character (*
). If no wildcards are present, this parameter value will be interpreted as *value*
.
search.numberOfResults
IntegerDefaults to 25The number of results to return from the search.
search.orderBy
StringDefaults to name ASCThe database field to order the search results as well as an order direction.
The possible values are:
id
- the unique Id of the TenantinsertInstant
- the instant when the Tenant was createdname
- the Tenant name
The order direction is optional. Possible values of the order direction are ASC
or DESC
. If omitted, the default sort order is ASC
.
For example, to order the results by the insert instant in a descending order, use insertInstant DESC
.
search.startRow
IntegerDefaults to 0The offset into the total results. In order to paginate the results, increment this value by the numberOfResults for subsequent requests.
For example, if the total search results are greater than the page size designated by numberOfResults , set this value to 25
to retrieve results 26-50
, assuming the default page size.
Example JSON Request
{
"search": {
"name": "Playtronics",
"numberOfResults": 10,
"orderBy": "insertInstant",
"startRow": 0
}
}
Response
The response for this API contains the Tenants matching the search criteria in paginated format.
Response CodesCode | Description |
---|---|
200 | The request was successful. The response will contain a JSON body. |
400 | The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. |
401 | You did not supply a valid Authorization header. The header was omitted, your API key was not valid, your API key is scoped to a single tenant, or the request contains a `X-FusionAuth-TenantId` header. The response will be empty. See <a href='/docs/apis/authentication'>Authentication</a>. |
500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. |
Response Body
tenants
Arraytenants[x].accessControlConfiguration.uiIPAccessControlListId
UUIDAvailable since 1.30.0The Id of the IP Access Control List limiting access to this all applications in this tenant.
tenants[x].captchaConfiguration.captchaMethod
StringAvailable since 1.30.0The type of captcha method to use.
tenants[x].captchaConfiguration.enabled
BooleanAvailable since 1.30.0Whether captcha configuration is enabled.
tenants[x].captchaConfiguration.secretKey
StringAvailable since 1.30.0The secret key for this captcha method.
tenants[x].captchaConfiguration.siteKey
StringAvailable since 1.30.0The site key for this captcha method.
tenants[x].captchaConfiguration.threshold
FloatAvailable since 1.30.0The numeric threshold which separates a passing score from a failing one. This value only applies if using either the Google v3 or HCaptcha Enterprise method, otherwise this value is ignored.
tenants[x].configured
BooleanIndicates the tenant has been configured. It is always true
, except for default tenant when the setup wizard has not been completed, in which case it is false
.
tenants[x].connectorPolicies
ArrayAvailable since 1.18.0A list of Connector policies. Users will be authenticated against Connectors in order. Each Connector can be included in this list at most once and must exist.
tenants[x].connectorPolicies[x].connectorId
UUIDAvailable since 1.18.0The identifier of the Connector to which this policy refers.
tenants[x].connectorPolicies[x].domains
StringAvailable since 1.18.0An list of email domains to which this connector should apply.
A value of ["*"]
indicates this connector applies to all users.
tenants[x].connectorPolicies[x].migrate
BooleanAvailable since 1.18.0If true, the user’s data will be migrated to FusionAuth at first successful authentication; subsequent authentications will occur against the FusionAuth datastore. If false, the Connector’s source will be treated as authoritative.
tenants[x].data
ObjectAn object that can hold any information about the Tenant that should be persisted.
tenants[x].emailConfiguration.additionalHeaders
Array<Object>Available since 1.32.0The additional SMTP headers to be added to each outgoing email. Each SMTP header consists of a name and a value.
tenants[x].emailConfiguration.debug
BooleanDefaults to falseAvailable since 1.37.0Determines if debug should be enabled to create an event log to assist in debugging SMTP errors.
tenants[x].emailConfiguration.defaultFromEmail
StringAvailable since 1.16.0The default email address that emails will be sent from when a from address is not provided on an individual email template. This is the address part email address (i.e. Jared Dunn jared@piedpiper.com
).
tenants[x].emailConfiguration.defaultFromName
StringAvailable since 1.16.0The default From Name used in sending emails when a from name is not provided on an individual email template. This is the display name part of the email address ( i.e. Jared Dunn jared@piedpiper.com
).
tenants[x].emailConfiguration.emailVerificationEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template used to send emails to users to verify that their email address is valid.
tenants[x].emailConfiguration.emailUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when their email address is updated.
tenants[x].emailConfiguration.emailVerifiedEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template used to notify a user that their email address has been verified.
tenants[x].emailConfiguration.forgotPasswordEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template that is used when a user is sent a forgot password email.
tenants[x].emailConfiguration.host
StringDefaults to localhostAvailable since 1.8.0The host name of the SMTP server that FusionAuth will use.
Prior to version 1.28.0
this value was required.
tenants[x].emailConfiguration.implicitEmailVerificationAllowed
Defaults to trueAvailable since 1.32.0When set to true, this allows email to be verified as a result of completing a similar email based workflow such as change password. When set to false, the user must explicitly complete the email verification workflow even if the user has already completed a similar email workflow such as change password.
tenants[x].emailConfiguration.loginIdInUseOnCreateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when another user attempts to create an account with their login Id.
tenants[x].emailConfiguration.loginIdInUseOnUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when another user attempts to update an existing account to use their login Id.
tenants[x].emailConfiguration.loginNewDeviceEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when they log in on a new device.
tenants[x].emailConfiguration.loginSuspiciousEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a suspicious login occurs.
tenants[x].emailConfiguration.password
StringAvailable since 1.8.0An optional password FusionAuth will use to authenticate with the SMTP server.
tenants[x].emailConfiguration.passwordlessEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Passwordless Email Template, sent to users when they start a passwordless login.
tenants[x].emailConfiguration.passwordResetSuccessEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when they have completed a ‘forgot password’ workflow and their password has been reset.
tenants[x].emailConfiguration.passwordUpdateEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when their password has been updated.
tenants[x].emailConfiguration.port
IntegerDefaults to 25Available since 1.8.0The port of the SMTP server that FusionAuth will use.
Prior to version 1.28.0
this value was required.
tenants[x].emailConfiguration.properties
StringAvailable since 1.8.0Custom SMTP configuration properties that may be necessary in some cases. This can contain any Java mail property. It will override anything FusionAuth sets by default.
The following property has a default value:
mail.smtp.ssl.protocols
has a default value ofTLSv1 TLSv1.1 TLSv1.2
.
Since version 1.44.0
, the following two properties have default values:
mail.smtp.timeout
has a default value of2000
.mail.smtp.connectiontimeout
has a default value of2000
.
Here’s an example value which overrides these properties; in this case setting both timeout defaults to 5 seconds.
mail.smtp.timeout=5000\nmail.smtp.connectiontimeout=5000
tenants[x].emailConfiguration.security
StringDefaults to NONEAvailable since 1.8.0The type of security protocol FusionAuth will use when connecting to the SMTP server. The possible values are:
NONE
- no security will be used. All communications will be sent plaintext.SSL
- SSL will be used to connect to the SMTP server. This protocol is not recommended unless it is the only one your SMTP server supports.TLS
- TLS will be used to connect to the SMTP server. This is the preferred protocol for all SMTP servers.
tenants[x].emailConfiguration.setPasswordEmailTemplateId
UUIDAvailable since 1.19.0The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password.
tenants[x].emailConfiguration.twoFactorMethodAddEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a MFA method has been added to their account.
tenants[x].emailConfiguration.twoFactorMethodRemoveEmailTemplateId
UUIDAvailable since 1.30.0The Id of the Email Template used to send emails to users when a MFA method has been removed from their account.
tenants[x].emailConfiguration.unverified.allowEmailChangeWhenGated
BooleanDefaults to falseAvailable since 1.27.0When this value is set to true
, the user is allowed to change their email address when they are gated because they haven’t verified their email address.
tenants[x].emailConfiguration.unverified.behavior
StringDefaults to AllowAvailable since 1.27.0The desired behavior during login for a user that does not have a verified email. The possible values are:
Allow
- the user will be allowed to complete login.Gated
- verification is required before a user can complete login. The use of this value will require a paid plan.
tenants[x].emailConfiguration.username
StringAvailable since 1.8.0An optional username FusionAuth will to authenticate with the SMTP server.
tenants[x].emailConfiguration.verificationEmailTemplateId
UUIDThe Id of the Email Template used to send emails to users to verify that their email address is valid. If either the verifyEmail
or verifyEmailWhenChanged
fields are true
, this field is required.
tenants[x].emailConfiguration.verificationStrategy
StringAvailable since 1.27.0The process by which the user will verify their email address. The possible values are:
ClickableLink
- send the user a code with a clickable link.FormField
- send the user a short code intended to be manually entered into a form field. This is only available when tenants[x].emailConfiguration.unverified.behavior has theGated
value.
tenants[x].emailConfiguration.verifyEmail
BooleanDefaults to falseWhether the user’s email addresses are verified when the registers with your application.
tenants[x].emailConfiguration.verifyEmailWhenChanged
BooleanDefaults to falseWhether the user’s email addresses are verified when the user changes them.
tenants[x].eventConfiguration.events
ObjectAvailable since 1.8.0A mapping of the configuration for each event type that FusionAuth sends. The event types that are the keys into this Object are:
audit-log.create
- When an audit log is created Available since 1.30.0event-log.create
- When an event log is created Available since 1.30.0jwt.public-key.update
- When a JWT RSA Public / Private keypair may have been changedjwt.refresh
- When an access token is refreshed using a refresh token Available since 1.16.0jwt.refresh-token.revoke
- When a JWT Refresh Token is revokedkickstart.success
- When kickstart has successfully completed Available since 1.30.0user.action
- When a user action is triggereduser.bulk.create
- When multiple users are created in bulk (i.e. during an import)user.create
- When a user is createduser.create.complete
- When a user create transaction has completed Available since 1.30.0user.deactivate
- When a user is deactivateduser.delete
- When a user is deleteduser.delete.complete
- When a user delete transaction has completed Available since 1.30.0user.email.update
- When a user updates their email address Available since 1.30.0user.email.verified
- When a user verifies their email address Available since 1.8.0user.identity-provider.link
- When a link is created from a user to an Identity Provider Available since 1.36.0user.identity-provider.unlink
- When an existing Identity Provider link is removed from a User Available since 1.36.0user.loginId.duplicate.create
- When a request to create a user with a login Id (email or username) which is already in use has been received Available since 1.30.0Note: An Enterprise plan is required to utilize the
user.loginId.duplicate.create
event .user.loginId.duplicate.update
- When a request to update a user and change their login Id (email or username) to one that is already in use has been received Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.loginId.duplicate.update
event .user.login.failed
- When a user fails a login request Available since 1.6.0user.login.new-device
- When a user begins a login request with a new device Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.login.new-device
event .user.login.success
- When a user completes a login request Available since 1.6.0user.login.suspicious
- When a user logs in and is considered to be a potential threat (requires an activated Enterprise license) Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.login.suspicious
event .user.password.breach
- When Reactor detects a user is using a potentially breached password (requires an activated license) Available since 1.15.0
Note: A paid plan is required to utilize the
user.password.breach
event .user.password.reset.send
- When a forgot password email has been sent to a user Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.send
event.user.password.reset.start
- When the process to reset a user password has started Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.start
event.user.password.reset.success
- When a user has successfully reset their password Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.reset.success
event.user.password.update
- When a user has updated their password Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.password.update
event.user.reactivate
- When a user is reactivateduser.registration.create
- When a user registration is created Available since 1.6.0user.registration.create.complete
- When a user registration create transaction has completed Available since 1.30.0user.registration.delete
- When a user registration is deleted Available since 1.6.0user.registration.delete.complete
- When a user registration delete transaction has completed Available since 1.30.0user.registration.update
- When a user registration is updated Available since 1.6.0user.registration.update.complete
- When a user registration update transaction has completed Available since 1.30.0user.registration.verified
- When a user completes registration verification Available since 1.8.0user.two-factor.method.add
- When a user has added a two-factor method Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.two-factor.method.add
event.user.two-factor.method.remove
- When a user has removed a two-factor method Available since 1.30.0
Note: An Enterprise plan is required to utilize the
user.two-factor.method.remove
event.user.update
- When a user is updateduser.update.complete
- When a user update transaction has completed Available since 1.30.0
tenants[x].eventConfiguration.events[type].enabled
BooleanAvailable since 1.8.0Whether or not FusionAuth should send these types of events to any configured Webhooks.
tenants[x].eventConfiguration.events[type].transactionType
StringAvailable since 1.8.0The transaction type that FusionAuth uses when sending these types of events to any configured Webhooks. The transaction types are:
None
- No Webhooks are required to succeed for the FusionAuth transaction to be committed.Any
- Only a single Webhook is required to succeed for the FusionAuth transaction to be committed.SimpleMajority
- A simple majority (50% or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.SuperMajority
- A super majority (2/3 or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.AbsoluteMajority
- Every Webhook must succeed for the FusionAuth transaction to be committed.
tenants[x].externalIdentifierConfiguration.authorizationGrantIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until an OAuth authorization code is no longer valid to be exchanged for an access token. This is essentially the time allowed between the start of an Authorization request during the Authorization code grant and when you request an access token using this authorization code on the Token endpoint.
Value must be greater than 0 and less than or equal to 600.
tenants[x].externalIdentifierConfiguration.changePasswordIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the change password Id.
If the changePasswordIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the changePasswordIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.changePasswordIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the change password Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.changePasswordIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a change password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.deviceCodeTimeToLiveInSeconds
IntegerAvailable since 1.11.0The time in seconds until a device code Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.deviceUserCodeIdGenerator.length
IntegerAvailable since 1.11.0The length of the secure generator used for generating the device code Id.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.deviceUserCodeIdGenerator.type
StringAvailable since 1.11.0The type of the secure generator used for generating the device code Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.emailVerificationIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the the email verification Id.
If the emailVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.emailVerificationIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the email verification Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.emailVerificationIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until an email verification Id is no longer valid and cannot be used by the Verify Email API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.emailVerificationOneTimeCodeGenerator.length
IntegerAvailable since 1.27.0The length of the secure generator used for generating the email verification one time code.
If the emailVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.emailVerificationOneTimeCodeGenerator.type
StringAvailable since 1.27.0The type of the secure generator used for generating the email verification one time code. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.externalAuthenticationIdTimeToLiveInSeconds
IntegerAvailable since 1.12.0The time in seconds until an external authentication Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.loginIntentTimeToLiveInSeconds
IntegerAvailable since 1.53.0The time in seconds until a Login Timeout identifier is no longer valid to complete post-authentication steps in the OAuth workflow. Must be greater than 0.
tenants[x].externalIdentifierConfiguration.oneTimePasswordTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a One Time Password is no longer valid and cannot be used by the Login API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.passwordlessLoginGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the passwordless login.
If the passwordlessLoginGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the passwordlessLoginGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.passwordlessLoginGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the passwordless login. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.passwordlessLoginTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a passwordless code is no longer valid and cannot be used by the Passwordless API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.pendingAccountLinkTimeToLiveInSeconds
IntegerAvailable since 1.28.0The number of seconds before the pending account link identifier is no longer valid to complete an account link request.
tenants[x].externalIdentifierConfiguration.registrationVerificationIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the registration verification Id.
If the registrationVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.registrationVerificationIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the registration verification Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.registrationVerificationIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a registration verification Id is no longer valid and cannot be used by the Verify Registration API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.registrationVerificationOneTimeCodeGenerator.length
IntegerAvailable since 1.27.0The length of the secure generator used for generating the registration verification one time code.
If the registrationVerificationIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.registrationVerificationOneTimeCodeGenerator.type
StringAvailable since 1.27.0The type of the secure generator used for generating the registration verification one time code. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.rememberOAuthScopeConsentChoiceTimeToLiveInSeconds
IntegerAvailable since 1.50.0The time in seconds until remembered OAuth scope consent choices are no longer valid, and the User will be prompted to consent to requested OAuth scopes even if they have not changed. Applies only when application.oauthConfiguration.consentMode is set to RememberDecision
. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.samlv2AuthNRequestIdTimeToLiveInSeconds
IntegerAvailable since 1.19.0The time in seconds that a SAML AuthN request Id returned by the Start SAML v2 Login Request API will be eligible to be used to complete a SAML v2 Login request.
tenants[x].externalIdentifierConfiguration.setupPasswordIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the setup password Id.
If the setupPasswordIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the setupPasswordIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.setupPasswordIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the setup password Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.setupPasswordIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a setup password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.trustTokenTimeToLiveInSeconds
IntegerAvailable since 1.33.0The number of seconds before the Trust Token is no longer valid to complete a request that requires trust. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.twoFactorIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until a two factor Id is no longer valid and cannot be used by the Two Factor Login API. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.twoFactorOneTimeCodeIdGenerator.length
IntegerAvailable since 1.8.0The length of the secure generator used for generating the the two factor one time code Id.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlpha
then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlphaNumeric
then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomBytes
then the length must be greater or equal to 16 and less than or equal to 128.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomDigits
then the length must be greater or equal to 4 and less than or equal to 12.
tenants[x].externalIdentifierConfiguration.twoFactorOneTimeCodeIdGenerator.type
StringAvailable since 1.8.0The type of the secure generator used for generating the two factor code Id. Possible values are:
randomAlpha
randomAlphaNumeric
randomBytes
randomDigits
tenants[x].externalIdentifierConfiguration.twoFactorOneTimeCodeIdTimeToLiveInSeconds
IntegerAvailable since 1.26.0The number of seconds before the Two-Factor One Time Code used to enable or disable a two-factor method is no longer valid. Must be greater than 0.
tenants[x].externalIdentifierConfiguration.twoFactorTrustIdTimeToLiveInSeconds
IntegerAvailable since 1.8.0The time in seconds until an issued Two Factor trust Id is no longer valid and the User will be required to complete Two Factor authentication during the next authentication attempt. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.webAuthnAuthenticationChallengeTimeToLiveInSeconds
IntegerAvailable since 1.41.0The time in seconds until a WebAuthn authentication challenge is no longer valid and the User will be required to restart the WebAuthn authentication ceremony by creating a new challenge. This value also controls the timeout for the client-side WebAuthn navigator.credentials.get
API call. Value must be greater than 0.
tenants[x].externalIdentifierConfiguration.webAuthnRegistrationChallengeTimeToLiveInSeconds
IntegerAvailable since 1.41.0The time in seconds until a WebAuthn registration challenge is no longer valid and the User will be required to restart the WebAuthn registration ceremony by creating a new challenge. This value also controls the timeout for the client-side WebAuthn navigator.credentials.create
API call. Value must be greater than 0.
tenant.failedAuthenticationConfiguration.actionCancelPolicy.onPasswordReset
BooleanAvailable since 1.42.0Indicates whether you want the user to be able to self-service unlock their account prior to the action duration by completing a password reset workflow.
tenants[x].failedAuthenticationConfiguration.actionDuration
LongAvailable since 1.8.0The duration of the User Action. This value along with the actionDurationUnit
will be used to set the duration of the User Action. Value must be greater than 0.
tenants[x].failedAuthenticationConfiguration.actionDurationUnit
StringAvailable since 1.8.0The unit of time associated with a duration. The possible values are:
MINUTES
HOURS
DAYS
WEEKS
MONTHS
YEARS
tenant.failedAuthenticationConfiguration.emailUser
StringAvailable since 1.42.0Indicates you would like to email the user when the user’s account is locked due to this action being taken. This requires the User Action specified by the tenant.failedAuthenticationConfiguration.userActionId to also be configured for email. If the User Action is not configured to be able to email the user, this configuration will be ignored. See userEmailingEnabled on the User Action.
tenants[x].failedAuthenticationConfiguration.resetCountInSeconds
IntegerAvailable since 1.8.0The length of time in seconds before the failed authentication count will be reset. Value must be greater than 0.
For example, if tooManyAttempts
is set to 5
and you fail to authenticate 4
times in a row, waiting for the duration specified here will cause your fifth attempt to start back at 1
.
tenants[x].failedAuthenticationConfiguration.tooManyAttempts
IntegerAvailable since 1.8.0The number of failed attempts considered to be too many. Once this threshold is reached the specified User Action will be applied to the user for the duration specified. Value must be greater than 0.
tenants[x].failedAuthenticationConfiguration.userActionId
UUIDAvailable since 1.8.0The Id of the User Action that is applied when the threshold is reached for too many failed authentication attempts.
tenants[x].familyConfiguration.allowChildRegistrations
BooleanAvailable since 1.8.0Whether to allow child registrations.
tenants[x].familyConfiguration.confirmChildEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use when confirming a child.
tenants[x].familyConfiguration.deleteOrphanedAccounts
BooleanAvailable since 1.8.0Indicates that child users without parental verification will be permanently deleted after tenants[x].familyConfiguration.deleteOrphanedAccountsDays days.
tenants[x].familyConfiguration.deleteOrphanedAccountsDays
IntegerAvailable since 1.8.0The number of days from creation child users will be retained before being deleted for not completing parental verification. Value must be greater than 0.
tenants[x].familyConfiguration.enabled
BooleanAvailable since 1.8.0Whether family configuration is enabled.
tenants[x].familyConfiguration.familyRequestEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use when a family request is made.
tenants[x].familyConfiguration.maximumChildAge
IntegerAvailable since 1.8.0The maximum age of a child. Value must be greater than 0.
tenants[x].familyConfiguration.minimumOwnerAge
IntegerAvailable since 1.8.0The minimum age to be an owner. Value must be greater than 0.
tenants[x].familyConfiguration.parentEmailRequired
BooleanAvailable since 1.8.0Whether a parent email is required.
tenants[x].familyConfiguration.parentRegistrationEmailTemplateId
UUIDAvailable since 1.8.0The unique Id of the email template to use for parent registration.
tenants[x].formConfiguration.adminUserFormId
UUIDAvailable since 1.20.0The unique Id of the form to use for the Add and Edit User form when used in the FusionAuth admin UI.
tenants[x].httpSessionMaxInactiveInterval
IntegerAvailable since 1.8.0Time in seconds until an inactive session will be invalidated. Used when creating a new session in the FusionAuth OAuth frontend.
tenants[x].id
UUIDThe unique identifier for this Tenant.
tenants[x].insertInstant
LongThe instant that the Tenant was added to the FusionAuth database.
tenants[x].issuer
StringAvailable since 1.8.0The named issuer used to sign tokens, this is generally your public fully qualified domain.
tenants[x].jwtConfiguration.accessTokenKeyId
UUIDAvailable since 1.8.0The unique id of the signing key used to sign the access token.
tenants[x].jwtConfiguration.idTokenKeyId
UUIDAvailable since 1.8.0The unique id of the signing key used to sign the Id token.
tenants[x].jwtConfiguration.refreshTokenExpirationPolicy
StringAvailable since 1.17.0The Refresh Token expiration policy.
The possible values are:
Fixed
- the expiration is calculated from the time the token is issued.SlidingWindow
- the expiration is calculated from the last time the token was used.SlidingWindowWithMaximumLifetime
- the expiration is calculated from the last time the token was used, or until the maximumTimeToLiveInMinutes is reached. Available since 1.46.0
tenants[x].jwtConfiguration.refreshTokenRevocationPolicy.onLoginPrevented
BooleanAvailable since 1.17.0When enabled, all refresh tokens will be revoked when a user action, such as locking an account based on a number of failed login attempts, prevents user login.
tenants[x].jwtConfiguration.refreshTokenRevocationPolicy.onMultiFactorEnable
BooleanAvailable since 1.42.0When enabled, all refresh tokens will be revoked when a user enables multi-factor authentication for the first time. This policy will not be applied when adding subsequent multi-factor methods to the user.
tenants[x].jwtConfiguration.refreshTokenRevocationPolicy.onPasswordChanged
BooleanAvailable since 1.17.0When enabled, all refresh tokens will be revoked when a user changes their password.
tenants[x].jwtConfiguration.refreshTokenSlidingWindowConfiguration.maximumTimeToLiveInMinutes
IntegerAvailable since 1.46.0The maximum lifetime of a refresh token when using a refreshTokenExpirationPolicy of SlidingWindowWithMaximumLifetime
.
tenants[x].jwtConfiguration.refreshTokenTimeToLiveInMinutes
IntegerAvailable since 1.8.0The length of time in minutes a Refresh Token is valid from the time it was issued. Value must be greater than 0.
tenants[x].jwtConfiguration.refreshTokenUsagePolicy
StringAvailable since 1.17.0The refresh token usage policy. The following are valid values:
-
Reusable
- the token does not change after it was issued. -
OneTimeUse
- the token value will be changed each time the token is used to refresh a JWT. The client must store the new value after each usage.tenants[x].jwtConfiguration.timeToLiveInSeconds
IntegerAvailable since 1.8.0The length of time in seconds this JWT is valid from the time it was issued. Value must be greater than 0.
tenants[x].lambdaConfiguration.loginValidationId
UUIDAvailable since 1.53.0The Id of the lambda that will be invoked at the end of a successful login request in order to extend custom validation of a login request.
tenants[x].lambdaConfiguration.scimEnterpriseUserRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Request Lambda that will be used to convert the SCIM Enterprise User request to a FusionAuth User.
tenants[x].lambdaConfiguration.scimEnterpriseUserResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth Enterprise User to a SCIM Server response.
tenants[x].lambdaConfiguration.scimGroupRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM Group Request Lambda that will be used to convert the SCIM Group request to a FusionAuth Group.
tenants[x].lambdaConfiguration.scimGroupResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM GroupResponse Lambda that will be used to convert a FusionAuth Group to a SCIM Server response.
tenants[x].lambdaConfiguration.scimUserRequestConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Request Lambda that will be used to convert the SCIM User request to a FusionAuth User.
tenants[x].lambdaConfiguration.scimUserResponseConverterId
UUIDAvailable since 1.36.0The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth User to a SCIM Server response.
tenants[x].lastUpdateInstant
LongThe instant that the Tenant was last updated in the FusionAuth database.
tenants[x].loginConfiguration.requireAuthentication
BooleanAvailable since 1.26.0Indicates whether to require an API key for the Login API when an
applicationId
is not provided. When anapplicationId
is provided to the Login API call, the application configuration will take precedence.tenants[x].logoutURL
StringAvailable since 1.8.0The logout redirect URL when sending the user’s browser to the
/oauth2/logout
URI of the FusionAuth Front End. This value is only used when a logout URL is not defined in your Application.tenants[x].maximumPasswordAge.days
IntegerAvailable since 1.8.0The password maximum age in days. The number of days after which FusionAuth will require a user to change their password. Required when tenant.maximumPasswordAge.enabled is set to
true
.tenants[x].maximumPasswordAge.enabled
BooleanAvailable since 1.8.0Indicates that the maximum password age is enabled and being enforced.
tenants[x].minimumPasswordAge.seconds
IntegerAvailable since 1.8.0The password minimum age in seconds. When enabled FusionAuth will not allow a password to be changed until it reaches this minimum age. Required when tenant.minimumPasswordAge.enabled is set to
true
.tenants[x].minimumPasswordAge.enabled
BooleanAvailable since 1.8.0Indicates that the minimum password age is enabled and being enforced.
tenants[x].multiFactorConfiguration.authenticator.algorithm
StringAvailable since 1.26.0The algorithm used by the TOTP authenticator. This value is
HmacSHA1
and read only.tenants[x].multiFactorConfiguration.authenticator.codeLength
IntegerAvailable since 1.26.0The length of the code generated by the TOTP. This value is
6
and read only.tenants[x].multiFactorConfiguration.authenticator.enabled
BooleanAvailable since 1.26.0When enabled, users may utilize an authenticator application to complete a multi-factor authentication request. This method uses TOTP (Time-Based One-Time Password) as defined in RFC 6238 and often uses an native mobile app such as Google Authenticator.
tenants[x].multiFactorConfiguration.authenticator.timeStep
IntegerAvailable since 1.26.0The time-step size in seconds. This value is
30
and read only.tenants[x].multiFactorConfiguration.email.enabled
BooleanAvailable since 1.26.0When enabled, users may utilize an email address to complete a two-factor authentication request.
tenants[x].multiFactorConfiguration.email.templateId
UUIDAvailable since 1.26.0The Id of the email template that is used when notifying a user to complete a two-factor authentication request.
tenants[x].multiFactorConfiguration.sms.enabled
BooleanAvailable since 1.26.0When enabled, users may utilize a mobile phone number to complete a two-factor authentication request.
tenants[x].multiFactorConfiguration.sms.messengerId
UUIDAvailable since 1.26.0The messenger that is used to deliver a SMS two-factor authentication request.
tenants[x].multiFactorConfiguration.sms.templateId
UUIDAvailable since 1.26.0The Id of the SMS template that is used when notifying a user to complete a two-factor authentication request.
tenants[x].name
StringThe unique name of the Tenant.
tenants[x].oauthConfiguration.clientCredentialsAccessTokenPopulateLambdaId
UUIDAvailable since 1.26.0The Id of a lambda that will be called to populate the JWT during a client credentials grant.
tenants[x].passwordEncryptionConfiguration.encryptionScheme
StringAvailable since 1.8.0The default method for encrypting the User’s password. The following encryptors are provided with FusionAuth:
- salted-md5
- salted-sha256
- salted-hmac-sha256
- salted-pbkdf2-hmac-sha256
- salted-pbkdf2-hmac-sha256-512 available since 1.34.0
- salted-pbkdf2-hmac-sha512-512 available since 1.43.0
- bcrypt
- phpass-md5 available since 1.45.0
- phpass-sha512 available since 1.45.0
tenants[x].passwordEncryptionConfiguration.encryptionSchemeFactor
IntegerAvailable since 1.8.0The factor used by the password encryption scheme. If not provided, the
PasswordEncryptor
provides a default value. Generally this will be used as an iteration count to generate the hash. The actual use of this value is up to thePasswordEncryptor
implementation.tenants[x].passwordEncryptionConfiguration.modifyEncryptionSchemeOnLogin
BooleanAvailable since 1.8.0When enabled a user’s hash configuration will be modified to match these configured settings. This can be useful to increase a password hash strength over time or upgrade imported users to a more secure encryption scheme after an initial import.
Beginning in version
1.42.0
when this configuration is enabled, in addition to re-hashing on login, the password will be re-hashed on password change as well.tenants[x].passwordValidationRules.breachDetection.enabled
BooleanAvailable since 1.15.0Whether to enable Reactor breach detection. Requires an activated license.
tenants[x].passwordValidationRules.breachDetection.matchMode
StringAvailable since 1.15.0The level of severity where Reactor will consider a breach. The following are valid values:
High
Only requires a password match, this is the most secure and is recommendedMedium
Exact match on username, email address or email sub-addressLow
Exact match on an email or username, or the password is a common breached value
tenants[x].passwordValidationRules.breachDetection.notifyUserEmailTemplateId
UUIDAvailable since 1.15.0The Id of the email template to use when notifying a user of a breached password.
tenants[x].passwordValidationRules.breachDetection.onLogin
StringAvailable since 1.15.0The behavior when detecting breaches at time of user login. The following are valid values:
Off
Do not perform breach detection at loginRecordOnly
Only record the result, take no actionNotifyUser
Notify the end user via emailRequireChange
Require immediate password change
tenants[x].passwordValidationRules.maxLength
IntegerAvailable since 1.8.0The maximum length of a password when a new user is created or a user requests a password change.
tenants[x].passwordValidationRules.minLength
IntegerAvailable since 1.8.0The minimum length of a password when a new user is created or a user requests a password change.
tenants[x].passwordValidationRules.rememberPreviousPasswords.count
IntegerAvailable since 1.8.0The number of previous passwords to remember. Value must be greater than 0.
tenants[x].passwordValidationRules.rememberPreviousPasswords.enabled
BooleanAvailable since 1.8.0Whether to prevent a user from using any of their previous passwords.
tenants[x].passwordValidationRules.requireMixedCase
BooleanAvailable since 1.8.0Whether to force the user to use at least one uppercase and one lowercase character.
tenants[x].passwordValidationRules.requireNonAlpha
BooleanAvailable since 1.8.0Whether to force the user to use at least one non-alphanumeric character.
tenants[x].passwordValidationRules.requireNumber
BooleanAvailable since 1.8.0Whether to force the user to use at least one number.
tenants[x].passwordValidationRules.validateOnLogin
BooleanAvailable since 1.15.0When enabled the user’s password will be validated during login. If the password does not meet the currently configured validation rules the user will be required to change their password.
tenants[x].rateLimitConfiguration.failedLogin.limit
IntegerAvailable since 1.30.0The number of times a user can fail to login within the configured timePeriodInSeconds duration. If a Failed authentication action has been configured then it will take precedence.
tenants[x].rateLimitConfiguration.failedLogin.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can fail login before being rate limited.
tenants[x].rateLimitConfiguration.forgotPassword.limit
IntegerAvailable since 1.30.0The number of times a user can request a forgot password email within the configured timePeriodInSeconds duration.
tenants[x].rateLimitConfiguration.forgotPassword.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a forgot password email before being rate limited.
tenants[x].rateLimitConfiguration.sendEmailVerification.limit
IntegerAvailable since 1.30.0The number of times a user can request a verification email within the configured timePeriodInSeconds duration.
tenants[x].rateLimitConfiguration.sendEmailVerification.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a verification email before being rate limited.
tenants[x].rateLimitConfiguration.sendPasswordless.limit
IntegerAvailable since 1.30.0The number of times a user can request a passwordless login email within the configured timePeriodInSeconds duration.
tenants[x].rateLimitConfiguration.sendPasswordless.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a passwordless login email before being rate limited.
tenants[x].rateLimitConfiguration.sendRegistrationVerification.limit
IntegerAvailable since 1.30.0The number of times a user can request a registration verification email within the configured timePeriodInSeconds duration.
tenants[x].rateLimitConfiguration.sendRegistrationVerification.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a registration verification email before being rate limited.
tenants[x].rateLimitConfiguration.sendTwoFactor.limit
IntegerAvailable since 1.30.0The number of times a user can request a two-factor code by email or SMS within the configured timePeriodInSeconds duration.
tenants[x].rateLimitConfiguration.sendTwoFactor.timePeriodInSeconds
IntegerAvailable since 1.30.0The duration for the number of times a user can request a two-factor code by email or SMS before being rate limited.
tenants[x].registrationConfiguration.blockedDomains
Array<String>Available since 1.30.0A list of unique domains that are not allowed to register when self service is enabled.
tenants[x].scimServerConfiguration.clientEntityTypeId
UUIDAvailable since 1.36.0The Entity Type that will be used to represent SCIM Clients for this tenant.
tenants[x].scimServerConfiguration.enabled
BooleanAvailable since 1.36.0Whether or not this tenant has the SCIM endpoints enabled.
tenants[x].scimServerConfiguration.schemas
MapAvailable since 1.36.0JSON formatted as a SCIM Schemas endpoint response. Because the SCIM lambdas may modify the JSON response, ensure the Schema’s response matches that generated by the response lambdas. More about Schema definitions.
tenants[x].scimServerConfiguration.serverEntityTypeId
UUIDAvailable since 1.36.0The Entity Type that will be used to represent SCIM Servers for this tenant.
tenants[x].ssoConfiguration.deviceTrustTimeToLiveInSeconds
IntegerAvailable since 1.30.2The number of seconds before a trusted device is reset. When reset, a user is forced to complete captcha during login and complete two factor authentication if applicable.
tenants[x].state
StringAvailable since 1.22.0The current state of the tenant. The following are valid values:
Active
- The tenant is active.PendingDelete
- A delete request has been requested and is being processed.
tenants[x].themeId
UUIDAvailable since 1.8.0The unique Id of the theme to be used to style the login page and other end user templates.
tenants[x].userDeletePolicy.unverified.enabled
BooleanAvailable since 1.13.0Indicates that users without a verified email address will be permanently deleted after tenants[x].userDeletePolicy.unverified.numberOfDaysToRetain days.
tenants[x].userDeletePolicy.unverified.enabledInstant
LongAvailable since 1.48.0The instant that this policy was enabled.
Users created before this time will not be eligible to be deleted. This means that you can safely enable this feature and the policy will only be enforced for users created after this policy was enabled. If you would like to delete users created prior to this policy being enabled that have an unverified email address, you can use the User Search API or User Bulk Delete API to search on the
insertInstant
andverified
fields to identify users that you would like to delete.For example, the following query string will return users that were created at least 7 days ago that have not verified their email address.
insertInstant:<now-7d AND verified:false
Please note that prior to version
1.48.0
, when enabling this policy all user’s with an unverified email were eligible for deletion.tenants[x].userDeletePolicy.unverified.numberOfDaysToRetain
IntegerAvailable since 1.13.0The number of days from creation users will be retained before being deleted for not completing email verification. Value must be greater than 0.
tenants[x].usernameConfiguration.unique.enabled
BooleanAvailable since 1.27.0When
true
, FusionAuth will handle username collisions by generating a random suffix. Users with colliding usernames will be able to use the same one, but in the admin and API interfaces, a unique username will be displayed.tenants[x].usernameConfiguration.unique.numberOfDigits
IntegerAvailable since 1.27.0The maximum number of digits to use when building a unique suffix for a username. A number will be randomly selected and will be 1 or more digits up to this configured value in length. For example, if this value is
5
, the suffix will be a number between00001
and99999
, inclusive.tenants[x].usernameConfiguration.unique.separator
StringAvailable since 1.27.0A single character to use as a separator from the requested username and a unique suffix that is added when a duplicate username is detected. This value can be a single non alphanumeric ASCII character.
tenants[x].usernameConfiguration.unique.strategy
StringAvailable since 1.29.0This strategy instructions FusionAuth when to append a unique suffix to the username. The possible values are:
Always
- Always append a unique suffix even when the requested username is not in use.OnCollision
- Only append a unique suffix when the requested username is in use.
tenants[x].webAuthnConfiguration.bootstrapWorkflow.authenticatorAttachmentPreference
StringAvailable since 1.41.0The authenticator attachment requirement for WebAuthn passkey registration when using the bootstrap workflow. The possible values are:
any
- An authenticator with any attachment modality will be allowed during registration.crossPlatform
- Only authenticators with thecross-platform
attachment modality will be allowed during registration. These are also referred to as “roaming” authenticators.platform
- Only authenticators with theplatform
attachment modality will be allowed during registration.
tenants[x].webAuthnConfiguration.bootstrapWorkflow.enabled
BooleanAvailable since 1.41.0Whether the WebAuthn bootstrap workflow is enabled.
tenants[x].webAuthnConfiguration.bootstrapWorkflow.userVerificationRequirement
StringAvailable since 1.41.0The user verification requirement for WebAuthn passkey registration and authentication when using the bootstrap workflow. The possible values are:
discouraged
- If possible, do not require user verification during registration and authentication.preferred
- Prefer authenticators that support user verification during registration and authentication but allow others.required
- Only authenticators that support user verification will be allowed.
tenants[x].webAuthnConfiguration.debug
BooleanAvailable since 1.41.0Whether debug event log output is enabled for WebAuthn.
tenants[x].webAuthnConfiguration.enabled
BooleanAvailable since 1.41.0Whether WebAuthn configuration is enabled.
tenants[x].webAuthnConfiguration.reauthenticationWorkflow.authenticatorAttachmentPreference
StringAvailable since 1.41.0The authenticator attachment requirement for WebAuthn passkey registration when using the reauthentication workflow. The possible values are:
any
- An authenticator with any attachment modality will be allowed during registration.crossPlatform
- Only authenticators with thecross-platform
attachment modality will be allowed during registration. These are also referred to as “roaming” authenticators.platform
- Only authenticators with theplatform
attachment modality will be allowed during registration.
tenants[x].webAuthnConfiguration.reauthenticationWorkflow.enabled
BooleanAvailable since 1.41.0Whether the WebAuthn reauthentication workflow is enabled.
tenants[x].webAuthnConfiguration.reauthenticationWorkflow.userVerificationRequirement
StringAvailable since 1.41.0The user verification requirement for WebAuthn passkey registration and authentication when using the reauthentication workflow. The possible values are:
discouraged
- If possible, do not require user verification during registration and authentication.preferred
- Prefer authenticators that support user verification during registration and authentication but allow others.required
- Only authenticators that support user verification will be allowed.
tenants[x].webAuthnConfiguration.relyingPartyId
StringAvailable since 1.41.0The Relying Party Id the tenant will use in WebAuthn ceremonies. Passkeys can only be used to authenticate on sites using the same Relying Party Id they were registered with.
The default value is
null
, which instructs the WebAuthn JavaScript API to use the browser origin.tenants[x].webAuthnConfiguration.relyingPartyName
StringAvailable since 1.41.0The Relying Party name the tenant will use in WebAuthn ceremonies. This value is used only for display and may be shown by browser or OS dialogs during WebAuthn ceremonies.
If no value is configured, the tenant.issuer value will be used.
total
IntegerExample Response JSON for Tenant Search
{
"tenants": [
{
"accessControlConfiguration": {
"uiIPAccessControlListId": "11d49de7-69f6-46fc-8270-0b3aa626327a"
},
"configured": true,
"captchaConfiguration": {
"captchaMethod": "GoogleRecaptchaV3",
"enabled": false,
"threshold": 0.5
},
"connectorPolicies": [
{
"connectorId": "e3306678-a53a-4964-9040-1c96f36dda72",
"domains": [
"*"
],
"migrate": false
},
{
"connectorId": "27f22280-7e55-4d1c-b9f8-239bf9cc1a5e",
"domains": [
"*"
],
"migrate": true
}
],
"data": {
"description": "No more secrets, Marty."
},
"emailConfiguration": {
"additionalHeaders": [
{
"name": "X-SES-CONFIGURATION-SET",
"value": "example_configuration_set_name"
}
],
"defaultFromEmail": "jared@piedpiper.com",
"defaultFromName": "Jared Dunn",
"emailUpdateEmailTemplateId": "ec3045c7-97d8-47f8-8725-61b93deacf5d",
"emailVerifiedEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
"forgotPasswordEmailTemplateId": "49aba1de-0225-45d7-a2b1-f9fe46b0242c",
"host": "smtp.sendgrid.net",
"implicitEmailVerificationAllowed": true,
"loginIdInUseOnCreateEmailTemplateId": "1c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginIdInUseOnUpdateEmailTemplateId": "2c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginNewDeviceEmailTemplateId": "3c3045c7-97d8-47f8-8725-61b93deacf5d",
"loginSu