openapi: 3.0.0
info:
title: Auth0 Authentication actions tenants API
description: Auth0 Authentication API. Endpoints for authentication and authorization using OpenID Connect, OAuth 2.0, SAML, WS-Federation, and Passwordless flows.
version: 1.0.0
servers:
- url: '{auth0_domain}'
description: The Authentication API is served over HTTPS.
variables:
auth0_domain:
description: Auth0 domain
default: https://demo.us.auth0.com
tags:
- name: tenants
paths:
/tenants/settings:
get:
summary: Get Tenant Settings
description: Retrieve tenant settings. A list of fields to include or exclude may also be specified.
tags:
- tenants
parameters:
- name: fields
in: query
description: Comma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
schema:
type: string
pattern: ^((allowed_logout_urls)|(change_password)|(default_token_quota)|(error_page)|(flags)|(friendly_name)|(picture_url)|(support_email)|(support_url)|(session_lifetime)|(default_audience)|(default_directory)|(device_flow)|(idle_session_lifetime)|(ephemeral_session_lifetime)|(idle_ephemeral_session_lifetime)|(default_redirection_uri)|(universal_login)|(universal_login\.colors)|(universal_login\.passwordless)|(enabled_locales)|(session_cookie)|(sessions)|(oidc_logout)|(allow_organization_name_in_authentication_api)|(mtls)|(customize_mfa_in_postlogin_action)|(skip_non_verifiable_callback_uri_confirmation_prompt)|(resource_parameter_profile)|(enable_ai_guide)|(client_id_metadata_document_supported)|(phone_consolidated_experience))(,((allowed_logout_urls)|(change_password)|(default_token_quota)|(error_page)|(flags)|(friendly_name)|(picture_url)|(support_email)|(support_url)|(session_lifetime)|(default_audience)|(default_directory)|(device_flow)|(idle_session_lifetime)|(ephemeral_session_lifetime)|(idle_ephemeral_session_lifetime)|(default_redirection_uri)|(universal_login)|(universal_login\.colors)|(universal_login\.passwordless)|(enabled_locales)|(session_cookie)|(sessions)|(oidc_logout)|(allow_organization_name_in_authentication_api)|(mtls)|(customize_mfa_in_postlogin_action)|(skip_non_verifiable_callback_uri_confirmation_prompt)|(resource_parameter_profile)|(enable_ai_guide)|(client_id_metadata_document_supported)|(phone_consolidated_experience)))*$
- name: include_fields
in: query
description: Whether specified fields are to be included (true) or excluded (false).
schema:
type: boolean
responses:
'200':
description: Tenant settings successfully retrieved.
content:
application/json:
schema:
$ref: '#/components/schemas/GetTenantSettingsResponseContent'
'400':
description: Invalid request query string. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation.
'403':
description: The specified client cannot perform the requested operation.
x-description-1: 'Insufficient scope; expected any of: read:tenant_settings.'
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: tenant_settings_route
x-release-lifecycle: GA
x-operation-name: get
x-operation-request-parameters-name: GetTenantSettingsRequestParameters
x-operation-group:
- tenants
- settings
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- read:tenant_settings
patch:
summary: Update Tenant Settings
description: Update settings for a tenant.
tags:
- tenants
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateTenantSettingsRequestContent'
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/UpdateTenantSettingsRequestContent'
responses:
'200':
description: Tenant settings successfully updated.
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateTenantSettingsResponseContent'
'400':
description: Invalid request body. The message will vary depending on the cause.
'401':
description: Invalid token.
x-description-1: Client is not global.
x-description-2: Invalid signature received for JSON Web Token validation.
'403':
description: 'Insufficient scope; expected any of: update:tenant_settings.'
'429':
description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
operationId: patch_settings
x-release-lifecycle: GA
x-operation-name: update
x-operation-group:
- tenants
- settings
security:
- bearerAuth: []
- oAuth2ClientCredentials:
- update:tenant_settings
components:
schemas:
TenantOIDCLogoutSettings:
type: object
description: Settings related to OIDC RP-initiated Logout
additionalProperties: false
properties:
rp_logout_end_session_endpoint_discovery:
type: boolean
description: Enable the end_session_endpoint URL in the .well-known discovery configuration
default: true
SessionCookieSchema:
type:
- object
- 'null'
description: Session cookie configuration
additionalProperties: false
required:
- mode
properties:
mode:
$ref: '#/components/schemas/SessionCookieModeEnum'
TenantSettingsResourceParameterProfile:
type: string
description: Profile that determines how the identity of the protected resource (i.e., API) can be specified in the OAuth endpoints when access is being requested. When set to audience (default), the audience parameter is used to specify the resource server. When set to compatibility, the audience parameter is still checked first, but if it not provided, then the resource parameter can be used to specify the resource server.
default: audience
enum:
- audience
- compatibility
x-release-lifecycle: GA
TenantSettingsFlags:
type: object
description: Flags used to change the behavior of this tenant.
additionalProperties: false
properties:
change_pwd_flow_v1:
type: boolean
description: Whether to use the older v1 change password flow (true, not recommended except for backward compatibility) or the newer safer flow (false, recommended).
default: false
enable_apis_section:
type: boolean
description: Whether the APIs section is enabled (true) or disabled (false).
default: false
disable_impersonation:
type: boolean
description: Whether the impersonation functionality has been disabled (true) or not (false). Read-only.
default: false
enable_client_connections:
type: boolean
description: Whether all current connections should be enabled when a new client (application) is created (true, default) or not (false).
default: true
enable_pipeline2:
type: boolean
description: Whether advanced API Authorization scenarios are enabled (true) or disabled (false).
default: true
allow_legacy_delegation_grant_types:
type: boolean
description: If enabled, clients are able to add legacy delegation grants.
allow_legacy_ro_grant_types:
type: boolean
description: If enabled, clients are able to add legacy RO grants.
allow_legacy_tokeninfo_endpoint:
type: boolean
description: Whether the legacy `/tokeninfo` endpoint is enabled for your account (true) or unavailable (false).
enable_legacy_profile:
type: boolean
description: Whether ID tokens and the userinfo endpoint includes a complete user profile (true) or only OpenID Connect claims (false).
enable_idtoken_api2:
type: boolean
description: Whether ID tokens can be used to authorize some types of requests to API v2 (true) not not (false).
enable_public_signup_user_exists_error:
type: boolean
description: Whether the public sign up process shows a user_exists error (true) or a generic error (false) if the user already exists.
enable_sso:
type: boolean
description: Whether users are prompted to confirm log in before SSO redirection (false) or are not prompted (true).
allow_changing_enable_sso:
type: boolean
description: Whether the `enable_sso` setting can be changed (true) or not (false).
disable_clickjack_protection_headers:
type: boolean
description: Whether classic Universal Login prompts include additional security headers to prevent clickjacking (true) or no safeguard (false).
no_disclose_enterprise_connections:
type: boolean
description: Do not Publish Enterprise Connections Information with IdP domains on the lock configuration file.
enforce_client_authentication_on_passwordless_start:
type: boolean
description: Enforce client authentication for passwordless start.
enable_adfs_waad_email_verification:
type: boolean
description: Enables the email verification flow during login for Azure AD and ADFS connections
revoke_refresh_token_grant:
type: boolean
description: Delete underlying grant when a Refresh Token is revoked via the Authentication API.
dashboard_log_streams_next:
type: boolean
description: Enables beta access to log streaming changes
dashboard_insights_view:
type: boolean
description: Enables new insights activity page view
disable_fields_map_fix:
type: boolean
description: Disables SAML fields map fix for bad mappings with repeated attributes
mfa_show_factor_list_on_enrollment:
type: boolean
description: Used to allow users to pick what factor to enroll of the available MFA factors.
remove_alg_from_jwks:
type: boolean
description: Removes alg property from jwks .well-known endpoint
improved_signup_bot_detection_in_classic:
type: boolean
description: Improves bot detection during signup in classic universal login
genai_trial:
type: boolean
description: This tenant signed up for the Auth4GenAI trail
enable_dynamic_client_registration:
type: boolean
description: Whether third-party developers can dynamically register applications for your APIs (true) or not (false). This flag enables dynamic client registration.
default: false
disable_management_api_sms_obfuscation:
type: boolean
description: If true, SMS phone numbers will not be obfuscated in Management API GET calls.
default: true
trust_azure_adfs_email_verified_connection_property:
type: boolean
description: Changes email_verified behavior for Azure AD/ADFS connections when enabled. Sets email_verified to false otherwise.
default: false
custom_domains_provisioning:
type: boolean
description: If true, custom domains feature will be enabled for tenant.
default: false
TenantSettingsErrorPage:
type:
- object
- 'null'
description: Error page customization.
additionalProperties: false
properties:
html:
type: string
description: Custom Error HTML (Liquid syntax is supported).
default: ''
show_log_link:
type: boolean
description: Whether to show the link to log as part of the default error page (true, default) or not to show the link (false).
default: false
url:
type: string
description: URL to redirect to when an error occurs instead of showing the default error page.
default: https://mycompany.org/error
format: absolute-uri-or-empty
TenantSettingsSessions:
type:
- object
- 'null'
description: Sessions related settings for tenant
additionalProperties: false
properties:
oidc_logout_prompt_enabled:
type: boolean
description: Whether to bypass prompting logic (false) when performing OIDC Logout
default: true
UpdateTenantSettingsRequestContent:
type: object
additionalProperties: false
minProperties: 1
properties:
change_password:
$ref: '#/components/schemas/TenantSettingsPasswordPage'
device_flow:
$ref: '#/components/schemas/TenantSettingsDeviceFlow'
description: Device Flow configuration.
guardian_mfa_page:
$ref: '#/components/schemas/TenantSettingsGuardianPage'
default_audience:
type: string
description: Default audience for API Authorization.
default: ''
default_directory:
type: string
description: 'Name of connection used for password grants at the `/token` endpoint. The following connection types are supported: LDAP, AD, Database Connections, Passwordless, Windows Azure Active Directory, ADFS.'
default: ''
error_page:
$ref: '#/components/schemas/TenantSettingsErrorPage'
default_token_quota:
$ref: '#/components/schemas/DefaultTokenQuota'
x-release-lifecycle: EA
flags:
$ref: '#/components/schemas/TenantSettingsFlags'
friendly_name:
type: string
description: Friendly name for this tenant.
default: My Company
picture_url:
type: string
description: 'URL of logo to be shown for this tenant (recommended size: 150x150)'
default: https://mycompany.org/logo.png
format: absolute-uri-or-empty
support_email:
type: string
description: End-user support email.
default: support@mycompany.org
format: email-or-empty
support_url:
type: string
description: End-user support url.
default: https://mycompany.org/support
format: absolute-uri-or-empty
allowed_logout_urls:
type: array
description: URLs that are valid to redirect to after logout from Auth0.
items:
type: string
format: url-with-placeholders
session_lifetime:
type: integer
description: Number of hours a session will stay valid.
default: 168
minimum: 1
idle_session_lifetime:
type: integer
description: Number of hours for which a session can be inactive before the user must log in again.
default: 72
minimum: 1
ephemeral_session_lifetime:
type: integer
description: Number of hours an ephemeral (non-persistent) session will stay valid.
default: 72
minimum: 1
idle_ephemeral_session_lifetime:
type: integer
description: Number of hours for which an ephemeral (non-persistent) session can be inactive before the user must log in again.
default: 24
minimum: 1
sandbox_version:
type: string
description: Selected sandbox version for the extensibility environment
default: '22'
maxLength: 8
legacy_sandbox_version:
type: string
description: Selected legacy sandbox version for the extensibility environment
maxLength: 8
default_redirection_uri:
type: string
description: The default absolute redirection uri, must be https
format: absolute-https-uri-or-empty
enabled_locales:
type: array
description: Supported locales for the user interface
minItems: 1
items:
$ref: '#/components/schemas/TenantSettingsSupportedLocalesEnum'
session_cookie:
$ref: '#/components/schemas/SessionCookieSchema'
sessions:
$ref: '#/components/schemas/TenantSettingsSessions'
oidc_logout:
$ref: '#/components/schemas/TenantOIDCLogoutSettings'
customize_mfa_in_postlogin_action:
type:
- boolean
- 'null'
description: Whether to enable flexible factors for MFA in the PostLogin action
default: false
allow_organization_name_in_authentication_api:
type:
- boolean
- 'null'
description: Whether to accept an organization name instead of an ID on auth endpoints
default: false
acr_values_supported:
type:
- array
- 'null'
description: Supported ACR values
minItems: 0
items:
type: string
format: acr
mtls:
$ref: '#/components/schemas/TenantSettingsMTLS'
pushed_authorization_requests_supported:
type:
- boolean
- 'null'
description: Enables the use of Pushed Authorization Requests
default: false
authorization_response_iss_parameter_supported:
type:
- boolean
- 'null'
description: Supports iss parameter in authorization responses
default: false
skip_non_verifiable_callback_uri_confirmation_prompt:
type:
- boolean
- 'null'
description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).
If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.
See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
resource_parameter_profile:
$ref: '#/components/schemas/TenantSettingsResourceParameterProfile'
x-release-lifecycle: GA
client_id_metadata_document_supported:
type: boolean
description: Whether the authorization server supports retrieving client metadata from a client_id URL.
default: false
x-release-lifecycle: EA
enable_ai_guide:
type: boolean
description: Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant.
phone_consolidated_experience:
type: boolean
description: Whether Phone Consolidated Experience is enabled for this tenant.
dynamic_client_registration_security_mode:
$ref: '#/components/schemas/TenantSettingsDynamicClientRegistrationSecurityMode'
x-release-lifecycle: GA
SessionCookieModeEnum:
type: string
description: Behavior of the session cookie
default: persistent
enum:
- persistent
- non-persistent
TokenQuotaConfiguration:
type: object
additionalProperties: true
required:
- client_credentials
properties:
client_credentials:
$ref: '#/components/schemas/TokenQuotaClientCredentials'
UpdateTenantSettingsResponseContent:
type: object
additionalProperties: false
properties:
change_password:
$ref: '#/components/schemas/TenantSettingsPasswordPage'
guardian_mfa_page:
$ref: '#/components/schemas/TenantSettingsGuardianPage'
default_audience:
type: string
description: Default audience for API authorization.
default: ''
default_directory:
type: string
description: 'Name of connection used for password grants at the `/token`endpoint. The following connection types are supported: LDAP, AD, Database Connections, Passwordless, Windows Azure Active Directory, ADFS.'
default: ''
error_page:
$ref: '#/components/schemas/TenantSettingsErrorPage'
device_flow:
$ref: '#/components/schemas/TenantSettingsDeviceFlow'
default_token_quota:
$ref: '#/components/schemas/DefaultTokenQuota'
x-release-lifecycle: EA
flags:
$ref: '#/components/schemas/TenantSettingsFlags'
friendly_name:
type: string
description: Friendly name for this tenant.
default: My Company
picture_url:
type: string
description: 'URL of logo to be shown for this tenant (recommended size: 150x150)'
default: https://mycompany.org/logo.png
format: absolute-uri-or-empty
support_email:
type: string
description: End-user support email address.
default: support@mycompany.org
format: email-or-empty
support_url:
type: string
description: End-user support URL.
default: https://mycompany.org/support
format: absolute-uri-or-empty
allowed_logout_urls:
type: array
description: URLs that are valid to redirect to after logout from Auth0.
items:
type: string
format: url
session_lifetime:
type: number
description: Number of hours a session will stay valid.
default: 168
idle_session_lifetime:
type: number
description: Number of hours for which a session can be inactive before the user must log in again.
default: 72
ephemeral_session_lifetime:
type: number
description: Number of hours an ephemeral (non-persistent) session will stay valid.
default: 72
minimum: 1
idle_ephemeral_session_lifetime:
type: number
description: Number of hours for which an ephemeral (non-persistent) session can be inactive before the user must log in again.
default: 24
minimum: 1
sandbox_version:
type: string
description: Selected sandbox version for the extensibility environment.
default: '22'
legacy_sandbox_version:
type: string
description: Selected sandbox version for rules and hooks extensibility.
default: ''
sandbox_versions_available:
type: array
description: Available sandbox versions for the extensibility environment.
items:
type: string
default_redirection_uri:
type: string
description: The default absolute redirection uri, must be https
enabled_locales:
type: array
description: Supported locales for the user interface.
items:
$ref: '#/components/schemas/SupportedLocales'
session_cookie:
$ref: '#/components/schemas/SessionCookieSchema'
sessions:
$ref: '#/components/schemas/TenantSettingsSessions'
oidc_logout:
$ref: '#/components/schemas/TenantOIDCLogoutSettings'
allow_organization_name_in_authentication_api:
type: boolean
description: Whether to accept an organization name instead of an ID on auth endpoints
default: false
customize_mfa_in_postlogin_action:
type: boolean
description: Whether to enable flexible factors for MFA in the PostLogin action
default: false
acr_values_supported:
type:
- array
- 'null'
description: Supported ACR values
minItems: 0
items:
type: string
format: acr
mtls:
$ref: '#/components/schemas/TenantSettingsMTLS'
pushed_authorization_requests_supported:
type: boolean
description: Enables the use of Pushed Authorization Requests
default: false
authorization_response_iss_parameter_supported:
type:
- boolean
- 'null'
description: Supports iss parameter in authorization responses
default: false
skip_non_verifiable_callback_uri_confirmation_prompt:
type:
- boolean
- 'null'
description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).
If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.
See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
resource_parameter_profile:
$ref: '#/components/schemas/TenantSettingsResourceParameterProfile'
x-release-lifecycle: GA
client_id_metadata_document_supported:
type: boolean
description: Whether the authorization server supports retrieving client metadata from a client_id URL.
default: false
x-release-lifecycle: EA
phone_consolidated_experience:
type: boolean
description: Whether Phone Consolidated Experience is enabled for this tenant.
enable_ai_guide:
type: boolean
description: Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant.
dynamic_client_registration_security_mode:
$ref: '#/components/schemas/TenantSettingsDynamicClientRegistrationSecurityMode'
x-release-lifecycle: GA
SupportedLocales:
type: string
enum:
- am
- ar
- ar-EG
- ar-SA
- az
- bg
- bn
- bs
- ca-ES
- cnr
- cs
- cy
- da
- de
- el
- en
- en-CA
- es
- es-419
- es-AR
- es-MX
- et
- eu-ES
- fa
- fi
- fr
- fr-CA
- fr-FR
- gl-ES
- gu
- he
- hi
- hr
- hu
- hy
- id
- is
- it
- ja
- ka
- kk
- kn
- ko
- lt
- lv
- mk
- ml
- mn
- mr
- ms
- my
- nb
- nl
- nn
- 'no'
- pa
- pl
- pt
- pt-BR
- pt-PT
- ro
- ru
- sk
- sl
- so
- sq
- sr
- sv
- sw
- ta
- te
- th
- tl
- tr
- uk
- ur
- vi
- zgh
- zh-CN
- zh-HK
- zh-MO
- zh-TW
DefaultTokenQuota:
type:
- object
- 'null'
description: Token Quota configuration, to configure quotas for token issuance for clients and organizations. Applied to all clients and organizations unless overridden in individual client or organization settings.
additionalProperties: false
minProperties: 1
x-release-lifecycle: EA
properties:
clients:
$ref: '#/components/schemas/TokenQuotaConfiguration'
organizations:
$ref: '#/components/schemas/TokenQuotaConfiguration'
TenantSettingsDeviceFlow:
type:
- object
- 'null'
description: Device Flow configuration
additionalProperties: false
properties:
charset:
$ref: '#/components/schemas/TenantSettingsDeviceFlowCharset'
mask:
type: string
description: Mask used to format a generated User Code into a friendly, readable format.
default: '****-****'
maxLength: 20
GetTenantSettingsResponseContent:
type: object
additionalProperties: false
properties:
change_password:
$ref: '#/components/schemas/TenantSettingsPasswordPage'
guardian_mfa_page:
$ref: '#/components/schemas/TenantSettingsGuardianPage'
default_audience:
type: string
description: Default audience for API authorization.
default: ''
default_directory:
type: string
description: 'Name of connection used for password grants at the `/token`endpoint. The following connection types are supported: LDAP, AD, Database Connections, Passwordless, Windows Azure Active Directory, ADFS.'
default: ''
error_page:
$ref: '#/components/schemas/TenantSettingsErrorPage'
device_flow:
$ref: '#/components/schemas/TenantSettingsDeviceFlow'
default_token_quota:
$ref: '#/components/schemas/DefaultTokenQuota'
x-release-lifecycle: EA
flags:
$ref: '#/components/schemas/TenantSettingsFlags'
friendly_name:
type: string
description: Friendly name for this tenant.
default: My Company
picture_url:
type: string
description: 'URL of logo to be shown for this tenant (recommended size: 150x150)'
default: https://mycompany.org/logo.png
format: absolute-uri-or-empty
support_email:
type: string
description: End-user support email address.
default: support@mycompany.org
format: email-or-empty
support_url:
type: string
description: End-user support URL.
default: https://mycompany.org/support
format: absolute-uri-or-empty
allowed_logout_urls:
type: array
description: URLs that are valid to redirect to after logout from Auth0.
items:
type: string
format: url
session_lifetime:
type: number
description: Number of hours a session will stay valid.
default: 168
idle_session_lifetime:
type: number
description: Number of hours for which a session can be inactive before the user must log in again.
default: 72
ephemeral_session_lifetime:
type: number
description: Number of hours an ephemeral (non-persistent) session will stay valid.
default: 72
minimum: 1
idle_ephemeral_session_lifetime:
type: number
description: Number of hours for which an ephemeral (non-persistent) session can be inactive before the user must log in again.
default: 24
minimum: 1
sandbox_version:
type: string
description: Selected sandbox version for the extensibility environment.
default: '22'
legacy_sandbox_version:
type: string
description: Selected sandbox version for rules and hooks extensibility.
default: ''
sandbox_versions_available:
type: array
description: Available sandbox versions for the extensibility environment.
items:
type: string
default_redirection_uri:
type: string
description: The default absolute redirection uri, must be https
enabled_locales:
type: array
description: Supported locales for the user interface.
items:
$ref: '#/components/schemas/SupportedLocales'
session_cookie:
$ref: '#/components/schemas/SessionCookieSchema'
sessions:
$ref: '#/components/schemas/TenantSettingsSessions'
oidc_logout:
$ref: '#/components/schemas/TenantOIDCLogoutSettings'
allow_organization_name_in_authentication_api:
type: boolean
description: Whether to accept an organization name instead of an ID on auth endpoints
default: false
customize_mfa_in_postlogin_action:
type: boolean
description: Whether to enable flexible factors for MFA in the PostLogin action
default: false
acr_values_supported:
type:
- array
- 'null'
description: Supported ACR values
minItems: 0
items:
type: string
format: acr
mtls:
$ref: '#/components/schemas/TenantSettingsMTLS'
pushed_authorization_requests_supported:
type: boolean
description: Enables the use of Pushed Authorization Requests
default: false
authorization_response_iss_parameter_supported:
type:
- boolean
- 'null'
description: Supports iss parameter in authorization responses
default: false
skip_non_verifiable_callback_uri_confirmation_prompt:
type:
- boolean
- 'null'
description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).
If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.
See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
resource_parameter_profile:
$ref: '#/components/schemas/TenantSettingsResourceParameterProfile'
x-release-lifecycle: GA
client_id_metadata_document_supported:
type: boolean
description: Whether the authorization server supports retrieving client metadata from a client_id URL.
default: false
x-release-lifecycle: EA
phone_consolidated_experience:
type: boolean
description: Whether Phone Consolidated Experience is enabled for this tenant.
enable_ai_guide:
type: boolean
description: Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant.
dynamic_client_registration_security_mode:
$ref: '#/components/schemas/TenantSettingsDynamicClientRegistrationSecurityMode'
x-release-lifecycle: GA
TenantSettingsDeviceFlowCharset:
type: string
description: Character set used to generate a User Code. Can be `base20` or `digits`.
default: base20
enum:
- base20
- digits
TokenQuotaClientCredentials:
type: object
description: The token quota configuration
additionalProperties: false
minProperties: 1
properties:
enforce:
type: boolean
description: If enabled, the quota will be enforced and requests in excess of the quota will fail. If disabled, the quota will not be enforced, but notifications for requests exceeding the quota will be available in logs.
per_day:
type: integer
description: Maximum number of issued tokens per day
minimum: 1
maximum: 2147483647
per_hour:
type: integer
description: Maximum number of issued tokens per hour
minimum: 1
maximum: 2147483647
TenantSettingsDynamicClientRegistrationSecurityMode:
type: string
description: Sets the `third_party_security_mode` assigned to clients created via Dynamic Client Registration. `strict` applies enhanced security controls. `permissive` preserves pre-existing behavior and is only available to tenants with prior third-party client usage.
enum:
- strict
- permissive
x-release-lifecycle: GA
TenantSettingsPasswordPage:
type:
- object
- 'null'
description: Change Password page customization.
additionalProperties: false
properties:
enabled:
type: boolean
description: Whether to use the custom change password HTML (true) or the default Auth0 page (false). Default is to use the Auth0 page.
default: false
html:
type: string
description: Custom change password HTML (Liquid syntax supported).
default: ''
TenantSettingsGuardianPage:
type:
- object
- 'null'
description: Guardian page customization.
additionalProperties: false
properties:
enabled:
type: boolean
description: Whether to use the custom Guardian HTML (true) or the default Auth0 page (false, default)
default: false
html:
type: string
description: ' Custom Guardian HTML (Liquid syntax is supported).'
default: ''
TenantSettingsMTLS:
type:
- object
- 'null'
description: mTLS configuration.
additionalProperties: false
properties:
enable_endpoint_aliases:
type: boolean
description: If true, enables mTLS endpoint aliases
default: false
TenantSettingsSupportedLocalesEnum:
type: string
enum:
- am
- ar
- ar-EG
- ar-SA
- az
- bg
- bn
- bs
- ca-ES
- cnr
- cs
- cy
- da
- de
- el
- en
- en-CA
- es
- es-419
- es-AR
- es-MX
- et
- eu-ES
- fa
- fi
- fr
- fr-CA
- fr-FR
- gl-ES
- gu
- he
- hi
- hr
- hu
- hy
- id
- is
- it
- ja
- ka
- kk
- kn
- ko
- lt
- lv
- mk
- ml
- mn
- mr
- ms
- my
- nb
- nl
- nn
- 'no'
- pa
- pl
- pt
- pt-BR
- pt-PT
- ro
- ru
- sk
- sl
- so
- sq
- sr
- sv
- sw
- ta
- te
- th
- tl
- tr
- uk
- ur
- vi
- zgh
- zh-CN
- zh-HK
- zh-MO
- zh-TW