openapi: 3.0.0 info: title: Multi-Apps Overview Account Invitations MFA API description: Frontegg’s Multi-Apps feature simplifies and streamlines application management, delivering a seamless user experience. This section includes all necessary endpoints for managing applications and copying application settings across environments. All endpoints are categorized as **Management Endpoints**, requiring environment-level authorization and providing full control over entitlement resources. version: '1.0' x-metadata: note: Trigger publish artifacts job, remove this x-metadata after publishing servers: - url: https://api.frontegg.com/applications description: EU Region - url: https://api.us.frontegg.com/applications description: US Region - url: https://api.ca.frontegg.com/applications description: CA Region - url: https://api.au.frontegg.com/applications description: AU Region - url: https://{domain}.frontegg.com/applications description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx tags: - name: MFA x-displayName: MFA paths: /resources/auth/v1/user/mfa/recover: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_recoverMfa summary: Recover MFA description: 'Recover multi-factor authentication (MFA) for a non-logged-in user. This endpoint verifies a user''s identity using a backup recovery code, typically generated by the user''s MFA authenticator app during initial setup. Use this when a user cannot access their MFA device and needs to authenticate with their recovery code.' parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/RecoverMfaDto' responses: '200': description: '' tags: - MFA security: - bearer: [] /resources/users/v1/mfa/disable: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: UsersMfaControllerV1_disableAuthAppMfa summary: Disable Authenticator App MFA description: 'Disable MFA enrollment for a logged-in user within a specific account (tenant). This endpoint disables multi-factor authentication for a user, using the `mfaToken` obtained from the user''s authenticator app. Use this endpoint to programmatically disable MFA when managing authentication settings at the account (tenant) level.' deprecated: true parameters: - name: frontegg-user-id in: header description: The user ID identifier required: true schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DisableMFAAuthAppRequest' responses: '200': description: '' tags: - MFA security: - bearer: [] /resources/users/v1/mfa/authenticator/{deviceId}/disable/verify: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: UsersMfaControllerV1_disableAuthenticatorMfa summary: Disable Authenticator App MFA description: 'Disable multi-factor authentication (MFA) enrollment for a logged-in user within a specific account (tenant). This endpoint removes MFA for a user, typically used in administrative contexts where a backend system or admin manages user security settings. The request must include the `mfaToken`, which is the time-based one-time password (TOTP) generated by the user''s authenticator app. Use this endpoint to programmatically disable MFA for a specific user within an account (tenant).' parameters: - name: deviceId required: true in: path schema: type: string - name: frontegg-user-id in: header description: The user ID identifier required: true schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DisableMFAAuthAppRequest' responses: '200': description: '' tags: - MFA security: - bearer: [] /resources/users/v1/mfa/sms/{deviceId}/disable: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: UsersMfaControllerV1_preDisableSMSMfa summary: Pre-disable SMS MFA parameters: - name: deviceId required: true in: path schema: type: string - name: frontegg-user-id in: header description: The user ID identifier required: true schema: type: string - name: frontegg-tenant-id in: header description: The account (tenant) ID identifier required: true schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/RequestDisableMFARequest' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/RequestDisableMFASMSResponse' tags: - MFA description: 'Initiate the process of disabling SMS-based multi-factor authentication (MFA) for a specific device. Provide the target `deviceId` in the request path to mark the SMS MFA device for pre-disablement. This action prepares the device for subsequent steps required to complete the removal. Use this route as part of the MFA management flow for disabling SMS-based MFA on a per-device basis.' security: - bearer: [] /resources/users/v1/mfa/sms/{deviceId}/disable/verify: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: UsersMfaControllerV1_disableSMSMfa summary: Disable SMS MFA parameters: - name: deviceId required: true in: path schema: type: string - name: frontegg-user-id in: header description: The user ID identifier required: true schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DisableMFASMSRequest' responses: '200': description: '' tags: - MFA description: 'Complete the process of disabling SMS-based multi-factor authentication (MFA) for a specific device. This step finalizes MFA deactivation for the given `deviceId` after a prior pre-disable action. The request must include: - `otcToken`: The one-time challenge token obtained during the pre-disable step. - `code`: The SMS verification code received by the user. Use this endpoint as the second step in the SMS MFA removal flow to verify the user''s identity and confirm the disable action.' security: - bearer: [] /resources/auth/v1/user/mfa/verify: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_verifyAuthenticatorMfaCode summary: Verify MFA Using Code From Authenticator App description: 'Verify a multi-factor authentication (MFA) code generated by an authenticator app during the authentication process. This endpoint completes the MFA step by validating the provided code. The request must include: - `value`: The MFA service name (e.g., `authenticator`), as configured in your Authentication Settings. - `mfaToken`: The time-based one-time password (TOTP) generated by the user''s authenticator app. Use this endpoint to verify the user''s MFA code during an authentication challenge, typically after the primary login step.' deprecated: true parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyMFAAuthAppRequest' responses: '201': description: '' tags: - MFA security: - bearer: [] /resources/auth/v1/user/mfa/emailcode: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_preVerifyEmailOtcMfa summary: Request Verify MFA Using Email Code parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AuthRequestVerifyMfaRequest' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/RequestVerifyMFAEmailResponse' tags: - MFA description: 'Verify multi-factor authentication (MFA) using a code sent to the user''s email. This endpoint completes the email-based MFA verification step. The request must include: - `mfaToken`: The token provided after the user initiates MFA via email. Use this endpoint to confirm the email-based MFA challenge and finalize the login or authentication process.' security: - bearer: [] /resources/auth/v1/user/mfa/emailcode/verify: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_verifyEmailOtcMfa summary: Verify MFA Using Email Code parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyMFAEmailOTCRequest' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/AuthenticationResponseDto' tags: - MFA description: 'Verify a multi-factor authentication (MFA) challenge using a code sent to the user''s email address. This endpoint finalizes the email-based MFA verification and completes the authentication process. The request must include: - `otcToken`: One-time challenge token received during the email MFA initiation. - `code`: The MFA code sent to the user''s email. - `mfaToken`: Token returned from the original MFA setup or step-up authentication request. - `rememberDevice` (optional): If set to `true`, the device will be remembered to reduce MFA prompts on future logins from the same client. Use this endpoint to confirm the MFA challenge and optionally remember the current device for future sessions.' security: - bearer: [] /resources/auth/v1/user/mfa/authenticator/enroll: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_preEnrollAuthenticatorMfa summary: Pre Enroll MFA Using Authenticator App parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AuthRequestEnrollMFARequest' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/RequestEnrollAuthenticatorAppMfaResponse' tags: - MFA description: 'Initiate enrollment in multi-factor authentication (MFA) using an authenticator app (e.g., Google Authenticator, Authy). This endpoint begins the MFA setup process and returns the necessary data for configuring an authenticator app, such as a QR code or secret key. The request must include: - `mfaToken`: A token received from the initial authentication flow that authorizes the MFA setup. Use this endpoint to generate the configuration required for linking an authenticator app before completing verification.' security: - bearer: [] /resources/auth/v1/user/mfa/authenticator/enroll/verify: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_enrollAuthenticatorMfa summary: Enroll MFA Using Authenticator App parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyEnrollMFAAuthAppRequest' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/AuthenticationResponseDto' tags: - MFA description: 'Complete enrollment in multi-factor authentication (MFA) using an authenticator app. This endpoint verifies the MFA setup by validating the time-based one-time password (TOTP) generated by the authenticator app. The request must include: - `token`: The 6-digit TOTP code generated by the authenticator app. - `mfaToken`: Token from the initial MFA enrollment initiation. - `rememberDevice` (optional): If set to `true`, the device will be remembered and may skip MFA on future logins from the same browser or device. Use this endpoint to finalize MFA enrollment and activate the authenticator app for the user''s account.' security: - bearer: [] /resources/auth/v1/user/mfa/authenticator/{deviceId}/verify: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_verifyAuthenticatorMfa summary: Verify MFA Using Authenticator App description: 'Verify multi-factor authentication (MFA) during the authentication process. This endpoint is typically used after a primary login attempt when MFA is enabled for the user or account (tenant). The request must include: - `value`: The MFA service name (e.g., `authenticator`, `email`, `sms`) configured under Authentication Settings. - `mfaToken`: The token or code provided by the user''s MFA method (e.g., code from an authenticator app). Use this endpoint to complete the MFA verification step as part of the overall login flow.' parameters: - name: deviceId required: true in: path schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyMFAAuthAppRequest' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/AuthenticationResponseDto' tags: - MFA security: - bearer: [] /resources/auth/v1/user/mfa/sms/enroll: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_preEnrollSmsMfa summary: Pre-enroll MFA Using Sms parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/RequestEnrollMFASMSRequest' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/RequestEnrollMFASMSResponse' tags: - MFA description: 'Initiate multi-factor authentication (MFA) enrollment using SMS. This endpoint begins the SMS-based MFA setup by sending a verification code to the provided phone number. The request must include: - `phoneNumber`: The user''s mobile phone number in international format. It must match the format defined in your organization''s phone number validation pattern (`phoneNumberRegexp`). Use this endpoint as the first step in enabling SMS-based MFA for a user.' security: - bearer: [] /resources/auth/v1/user/mfa/sms/enroll/verify: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_enrollSmsMfa summary: Enroll MFA Using Sms parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyEnrollMFASMSRequest' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/AuthenticationResponseDto' tags: - MFA description: 'Complete enrollment in multi-factor authentication (MFA) using SMS. This endpoint finalizes the SMS-based MFA setup for the user by verifying the code sent to their phone number. The request must include: - `otcToken`: Token received from the initial SMS MFA enrollment step. - `code`: The numeric code sent via SMS to the user''s registered phone number. Use this endpoint to verify the user''s phone number and activate SMS-based MFA on their account.' security: - bearer: [] /resources/auth/v1/user/mfa/sms/{deviceId}: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_preVerifySmsMfa summary: Request to Verify MFA Using Sms parameters: - name: deviceId required: true in: path schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AuthRequestVerifyMfaRequest' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/RequestVerifyMFASMSResponse' tags: - MFA description: 'Verify multi-factor authentication (MFA) using an SMS-based device. This endpoint confirms the SMS MFA challenge as part of the authentication or step-up verification process for a specific registered device. Path parameters: - `deviceId`: The unique identifier of the SMS MFA device being verified. Request body must include: - `mfaToken`: Token provided during the authentication or challenge flow. Use this endpoint to complete SMS-based MFA verification for the specified device.' security: - bearer: [] /resources/auth/v1/user/mfa/sms/{deviceId}/verify: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_verifySmsMfa summary: Verify MFA Using Sms parameters: - name: deviceId required: true in: path schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyMFASMSRequest' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/AuthenticationResponseDto' tags: - MFA description: 'Verify a multi-factor authentication (MFA) challenge using an SMS code for a specific registered device. This endpoint finalizes the MFA step by validating the SMS code and may mark the device as trusted if specified. Path parameters: - `deviceId`: The unique identifier of the SMS MFA device being verified. Request body must include: - `otcToken`: Token received from the SMS MFA challenge initiation. - `code`: The verification code sent to the user''s phone via SMS. - `mfaToken`: MFA token issued during the initial login or step-up challenge. - `rememberDevice` (optional): Set to `true` to remember the device and reduce future MFA prompts on this device. Use this endpoint to complete SMS-based MFA verification and optionally trust the device for future logins.' security: - bearer: [] /resources/auth/v1/user/mfa/webauthn/enroll: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_preEnrollWebauthnMfa summary: Pre Enroll MFA Using WebAuthN parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AuthRequestEnrollMFARequest' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/RequestEnrollMFAWebAuthnResponse' tags: - MFA description: 'Initiate multi-factor authentication (MFA) enrollment using WebAuthn (e.g., security keys, biometrics). This endpoint begins the WebAuthn MFA setup by returning a browser-based challenge needed to link a trusted device, such as a biometric reader or hardware security key. The request must include: - `mfaToken`: Token issued during the authentication flow to authorize MFA setup. Use this endpoint as the first step when enrolling a user in WebAuthn-based MFA.' security: - bearer: [] /resources/auth/v1/user/mfa/webauthn/enroll/verify: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_enrollWebauthnMfa summary: Enroll MFA Using WebAuthN parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyEnrollMFAWebAuthnRequest' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/AuthenticationResponseDto' tags: - MFA description: "Complete enrollment in multi-factor authentication (MFA) using WebAuthn.\n\nThis endpoint verifies and registers a WebAuthn device, such as a biometric sensor (Platform) or hardware security key (CrossPlatform), finalizing the setup after the initial challenge.\n\nThe request must include:\n- `deviceType`: Type of device being enrolled. Accepts `Platform` (e.g., fingerprint scanner) or `CrossPlatform` (e.g., USB security key).\n- `webauthnToken`: Token received during the WebAuthn pre-enrollment step.\n- `options`: WebAuthn attestation data collected from the client.\n - `id`: Device identifier.\n - `response`: WebAuthn attestation response.\n - `clientDataJSON`: Base64-encoded client data from the browser.\n - `attestationObject`: Base64-encoded attestation object from the authenticator.\n - `deviceType` (optional): May repeat the selected device type.\n- `mfaToken`: Token used to authorize MFA enrollment.\n- `rememberDevice` (optional): Set to `true` to remember the device and reduce MFA prompts on future logins.\n\nUse this endpoint to complete WebAuthn-based MFA enrollment and register the user's trusted device." security: - bearer: [] /resources/auth/v1/user/mfa/webauthn/{deviceId}: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_preVerifyWebauthnMfa summary: Request Verify MFA Using WebAuthN parameters: - name: deviceId required: true in: path schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AuthRequestVerifyMfaRequest' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/RequestVerifyMFAWebAuthnResponse' tags: - MFA description: 'Verify a multi-factor authentication (MFA) challenge using a registered WebAuthn device. This endpoint completes WebAuthn-based MFA verification, typically following primary authentication when WebAuthn is required as a second factor. Path parameters: - `deviceId`: The unique identifier of the WebAuthn device to be verified. Request body must include: - `mfaToken`: Token issued during the login or step-up authentication flow. Use this endpoint to validate a WebAuthn device and complete the MFA step during authentication.' security: - bearer: [] /resources/auth/v1/user/mfa/webauthn/{deviceId}/verify: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: AuthenticationMFAControllerV1_verifyWebauthnMfa summary: Verify MFA Using Webauthn parameters: - name: deviceId required: true in: path schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyMFAWebAuthnRequest' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/AuthenticationResponseDto' tags: - MFA description: "Verify a multi-factor authentication (MFA) challenge using a WebAuthn device.\n\nThis endpoint completes MFA verification using a previously registered WebAuthn device such as a biometric sensor or hardware security key.\n\nPath parameters:\n- `deviceId`: The unique identifier of the registered WebAuthn device to be verified.\n\nRequest body must include:\n- `webauthnToken`: Token received from the server to initiate the WebAuthn challenge.\n- `options`: WebAuthn authentication response returned by the browser.\n - `id`: The credential ID of the WebAuthn device.\n - `response`: Object containing attestation data from the authenticator.\n - `clientDataJSON`: Base64-encoded client data.\n - `authenticatorData`: Base64-encoded data from the authenticator.\n - `signature`: Signature from the authenticator, proving user presence.\n - `userHandle`: The user's handle used during registration.\n - `recaptchaToken` (optional): Token to verify human interaction, if reCAPTCHA is enabled.\n - `invitationToken` (optional): Used when completing an MFA challenge as part of an invitation flow.\n- `mfaToken`: Token issued during the initial authentication step.\n- `rememberDevice` (optional): If set to `true`, this device will be remembered for future logins to reduce MFA prompts.\n\nUse this endpoint to complete WebAuthn-based MFA verification and confirm the user's identity using a secure hardware or platform authenticator." security: - bearer: [] /resources/configurations/v1/mfa-policy/allow-remember-device: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx get: operationId: SecurityPolicyController_checkIfAllowToRememberDevice summary: Check if Remember Device Allowed description: 'Check whether the ''remember device'' feature is allowed for MFA verification. This endpoint returns whether device remembering is enabled globally or for a specific account (tenant), based on the request context. Query parameters: - `mfaToken`: Token generated from the authenticator app or MFA challenge step. Use this endpoint to determine whether the user should be prompted with the option to remember their device during MFA verification.' parameters: - name: frontegg-tenant-id in: header description: The account (tenant) ID identifier required: false schema: type: string - name: mfaToken required: true in: query description: MFA token from the response body of the first factor authentication schema: type: string responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/CheckAllowRememberResponse' tags: - MFA security: - bearer: [] /resources/users/v1/mfa/enroll: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: UsersMfaControllerV1_enrollAuthAppMfa summary: Enroll Authenticator App MFA description: 'Enroll a logged-in user in multi-factor authentication (MFA) for a specific account (tenant). This endpoint initiates MFA enrollment on behalf of a user within a specific account (tenant) context. Use this route to programmatically trigger MFA enrollment, typically as part of an administrative or backend workflow.' deprecated: true parameters: - name: frontegg-user-id in: header description: The user ID identifier required: true schema: type: string responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/RequestEnrollAuthenticatorAppMfaResponse' tags: - MFA security: - bearer: [] /resources/users/v1/mfa/authenticator/enroll: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: UsersMfaControllerV1_enrollAuthenticatorMfa summary: Enroll Authenticator App MFA description: 'Enroll a logged-in user in multi-factor authentication (MFA) for a specific account (tenant). This endpoint initiates MFA enrollment on behalf of a user within a specific account (tenant) context. Use this route to programmatically trigger MFA enrollment, typically as part of an administrative or backend workflow.' parameters: - name: frontegg-user-id in: header description: The user ID identifier required: true schema: type: string responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/RequestEnrollAuthenticatorAppMfaResponse' tags: - MFA security: - bearer: [] /resources/users/v1/mfa/enroll/verify: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: UsersMfaControllerV1_verifyAuthAppMfaEnrollment summary: Verify Authenticator App MFA Enrollment description: 'Verify multi-factor authentication (MFA) enrollment using a QR code for a specific user. This endpoint completes MFA setup after the user scans a QR code with their authenticator app (e.g., Google Authenticator, Authy). Request body must include: - `mfaToken`: The time-based one-time password (TOTP) generated by the user''s authenticator app after scanning the QR code. Use this endpoint to confirm that the user has successfully linked their authenticator app and to activate MFA for their account.' deprecated: true parameters: - name: frontegg-user-id in: header description: The user ID identifier required: true schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyEnrollMFAUserAuthAppRequest' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/VerifyEnrollMFAResponse' tags: - MFA security: - bearer: [] /resources/users/v1/mfa/authenticator/enroll/verify: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: UsersMfaControllerV1_verifyAuthenticatorMfaEnrollment summary: Verify Authenticator App MFA Enrollment description: 'Verify multi-factor authentication (MFA) enrollment using a QR code for a specific user within an account (tenant). This endpoint completes MFA enrollment after the user scans a QR code with an authenticator app (e.g., Google Authenticator, Authy). Request body must include: - `mfaToken`: The time-based one-time password (TOTP) generated by the authenticator app after scanning the QR code. Use this endpoint to confirm that the user has successfully registered their authenticator app and to activate MFA for their account.' parameters: - name: frontegg-user-id in: header description: The user ID identifier required: true schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyEnrollMFAUserAuthAppRequest' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/VerifyEnrollMFAResponse' tags: - MFA security: - bearer: [] /resources/users/v1/mfa/sms/enroll: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: UsersMfaControllerV1_preEnrollSmsMfa summary: Enroll SMS MFA parameters: - name: frontegg-user-id in: header description: The user ID identifier required: true schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/RequestEnrollMFASMSRequest' responses: '200': description: '' tags: - MFA description: 'Enroll a user in SMS-based multi-factor authentication (MFA). This endpoint initiates SMS MFA enrollment by sending a verification code to the user''s phone number. Request body must include: - `phoneNumber`: The user''s mobile number in international format. Must match the validation pattern defined by `phoneNumberRegexp`. Use this endpoint to begin the SMS MFA setup process for a specific user. The next step is to verify the SMS code to complete enrollment.' security: - bearer: [] /resources/users/v1/mfa/sms/enroll/verify: servers: - url: https://api.frontegg.com/identity description: EU Region - url: https://api.us.frontegg.com/identity description: US Region - url: https://api.ca.frontegg.com/identity description: CA Region - url: https://api.au.frontegg.com/identity description: AU Region - url: https://{domain}.frontegg.com/identity description: Frontegg sub-domain for use with user tokens variables: domain: default: app-xxx post: operationId: UsersMfaControllerV1_enrollSmsMfa summary: Verify MFA Enrollment parameters: - name: frontegg-user-id in: header description: The user ID identifier required: true schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VerifyEnrollMFASMSRequest' responses: '200': description: '' tags: - MFA description: 'Complete SMS-based multi-factor authentication (MFA) enrollment for a user. This endpoint finalizes SMS MFA setup by verifying the code sent to the user''s phone. Request body must include: - `otcToken`: One-time challenge token received from the initial enrollment step. - `code`: The verification code sent to the user''s phone via SMS. Use this endpoint to verify the user''s phone number and activate SMS-based MFA for their account.' security: - bearer: [] components: schemas: AuthRequestVerifyMfaRequest: type: object properties: mfaToken: type: string required: - mfaToken AuthenticateUserWebAuthNDto: type: object properties: id: type: string response: $ref: '#/components/schemas/WebAuthNResponse' recaptchaToken: type: string invitationToken: type: string required: - id - response VerifyMFAAuthAppRequest: type: object properties: value: type: string mfaToken: type: string rememberDevice: type: boolean required: - value - mfaToken UserMFAAuthenticatorAppResponse: type: object properties: id: type: string required: - id VerifyEnrollMFASMSRequest: type: object properties: otcToken: type: string code: type: string required: - otcToken - code VerifyMFAEmailOTCRequest: type: object properties: otcToken: type: string code: type: string mfaToken: type: string rememberDevice: type: boolean required: - otcToken - code - mfaToken UserMFAPhoneDeviceResponse: type: object properties: id: type: string phoneNumber: type: string required: - id - phoneNumber RequestEnrollMFASMSResponse: type: object properties: {} WebAuthNClientResponse: type: object properties: clientDataJSON: type: string attestationObject: type: string required: - clientDataJSON - attestationObject DisableMFAAuthAppRequest: type: object properties: token: type: string CheckAllowRememberResponse: type: object properties: {} DisableMFASMSRequest: type: object properties: otcToken: type: string code: type: string required: - otcToken - code RequestEnrollMFASMSRequest: type: object properties: phoneNumber: type: string pattern: phoneNumberRegexp required: - phoneNumber RequestVerifyMFASMSResponse: type: object properties: {} RequestDisableMFASMSResponse: type: object properties: {} VerifyEnrollMFAAuthAppRequest: type: object properties: token: type: string mfaToken: type: string rememberDevice: type: boolean required: - token - mfaToken VerifyNewWebAuthnDeviceRequest: type: object properties: id: type: string response: $ref: '#/components/schemas/WebAuthNClientResponse' deviceType: type: string enum: - Platform - CrossPlatform required: - id - response AuthRequestEnrollMFARequest: type: object properties: mfaToken: type: string required: - mfaToken RequestEnrollMFAWebAuthnResponse: type: object properties: options: $ref: '#/components/schemas/WebAuthnCredentialCreationOptions' required: - options RequestDisableMFARequest: type: object properties: {} RecoverMfaDto: type: object properties: recoveryCode: type: string email: type: string required: - recoveryCode - email RequestVerifyMFAWebAuthnResponse: type: object properties: {} VerifyMFAWebAuthnRequest: type: object properties: webauthnToken: type: string options: $ref: '#/components/schemas/AuthenticateUserWebAuthNDto' mfaToken: type: string rememberDevice: type: boolean required: - webauthnToken - options - mfaToken UserMFADevicesResponse: type: object properties: webauthn: type: array items: $ref: '#/components/schemas/UserMFAWebAuthnDeviceResponse' phones: type: array items: $ref: '#/components/schemas/UserMFAPhoneDeviceResponse' authenticators: type: array items: $ref: '#/components/schemas/UserMFAAuthenticatorAppResponse' emails: type: array items: $ref: '#/components/schemas/UserMFAEmailCodeResponse' required: - webauthn - phones - authenticators - emails VerifyEnrollMFAUserAuthAppRequest: type: object properties: token: type: string required: - token AuthenticationResponseDto: type: object properties: tokenType: type: string default: bearer otcToken: type: string mfaRequired: type: boolean mfaToken: type: string resetPasswordToken: type: string passwordExpiresIn: type: number notificationPeriod: type: number mfaEnrolled: type: boolean mfaDevices: $ref: '#/components/schemas/UserMFADevicesResponse' mfaStrategies: type: object qrCode: type: string recoveryCode: type: string accessToken: type: string refreshToken: type: string expiresIn: type: number expires: type: string userId: type: string userEmail: type: string emailVerified: type: boolean isBreachedPassword: type: boolean required: - mfaRequired - accessToken - refreshToken - expiresIn - expires VerifyEnrollMFAWebAuthnRequest: type: object properties: deviceType: type: string enum: - Platform - CrossPlatform webauthnToken: type: string options: $ref: '#/components/schemas/VerifyNewWebAuthnDeviceRequest' mfaToken: type: string rememberDevice: type: boolean required: - deviceType - webauthnToken - options - mfaToken WebAuthNResponse: type: object properties: clientDataJSON: type: string authenticatorData: type: string signature: type: string userHandle: type: string required: - clientDataJSON - authenticatorData - signature - userHandle UserMFAEmailCodeResponse: type: object properties: email: type: string required: - email VerifyMFASMSRequest: type: object properties: otcToken: type: string code: type: string mfaToken: type: string rememberDevice: type: boolean required: - otcToken - code - mfaToken RequestEnrollAuthenticatorAppMfaResponse: type: object properties: qrCode: type: string description: QR code to be verified by authenticator app required: - qrCode RequestVerifyMFAEmailResponse: type: object properties: {} UserMFAWebAuthnDeviceResponse: type: object properties: id: type: string deviceType: type: string enum: - Platform - CrossPlatform name: type: string required: - id - deviceType - name VerifyEnrollMFAResponse: type: object properties: recoveryCode: type: string required: - recoveryCode WebAuthnCredentialCreationOptions: type: object properties: {} securitySchemes: bearer: scheme: bearer bearerFormat: JWT type: http x-tagGroups: - name: Management tags: - Applications settings