openapi: 3.1.0
info:
  title: ThingsBoard Admin admin-controller two-factor-auth-controller API
  description: 'ThingsBoard Admin API — subset of the ThingsBoard REST API (open-source IoT platform). Covers: Admin, Audit Log, Event, Usage Info, Queue, Queue Stats, Mail Config Template, Qr Code Settings, Job.'
  version: 4.3.0.3DEMO
  contact:
    name: ThingsBoard team
    url: https://thingsboard.io
    email: info@thingsboard.io
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://demo.thingsboard.io
  description: ThingsBoard Live Demo
- url: http://localhost:8080
  description: Local ThingsBoard server
tags:
- name: two-factor-auth-controller
  description: Two Factor Auth
paths:
  /api/auth/2fa/verification/send:
    post:
      tags:
      - two-factor-auth-controller
      summary: Request 2FA Verification Code (requestTwoFaVerificationCode)
      description: 'Request 2FA verification code.


        To make a request to this endpoint, you need an access token with the scope of PRE_VERIFICATION_TOKEN, which is issued on username/password auth if 2FA is enabled.


        The API method is rate limited (using rate limit config from TwoFactorAuthSettings). Will return a Bad Request error if provider is not configured for usage, and Too Many Requests error if rate limits are exceeded.'
      operationId: requestTwoFaVerificationCode
      parameters:
      - name: providerType
        in: query
        required: true
        schema:
          type: string
          enum:
          - TOTP
          - SMS
          - EMAIL
          - BACKUP_CODE
      responses:
        '200':
          description: OK
  /api/auth/2fa/verification/check:
    post:
      tags:
      - two-factor-auth-controller
      summary: Check 2FA Verification Code (checkTwoFaVerificationCode)
      description: 'Checks 2FA verification code, and if it is correct the method returns a regular access and refresh token pair.


        The API method is rate limited (using rate limit config from TwoFactorAuthSettings), and also will block a user after X unsuccessful verification attempts if such behavior is configured (in TwoFactorAuthSettings).


        Will return a Bad Request error if provider is not configured for usage, and Too Many Requests error if rate limits are exceeded.'
      operationId: checkTwoFaVerificationCode
      parameters:
      - name: providerType
        in: query
        required: true
        schema:
          type: string
          enum:
          - TOTP
          - SMS
          - EMAIL
          - BACKUP_CODE
      - name: verificationCode
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JwtPair'
  /api/auth/2fa/login:
    post:
      tags:
      - two-factor-auth-controller
      summary: Get Regular Token Pair After Successfully Configuring 2FA
      description: Checks 2FA is configured, returning token pair on success.
      operationId: authenticateByTwoFaConfigurationToken
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JwtPair'
  /api/auth/2fa/providers:
    get:
      tags:
      - two-factor-auth-controller
      summary: Get Available 2FA Providers (getAvailableTwoFaProviders)
      description: "Get the list of 2FA provider infos available for user to use. Example:\n```\n[\n  {\n    \"type\": \"EMAIL\",\n    \"default\": true,\n    \"contact\": \"ab*****ko@gmail.com\"\n  },\n  {\n    \"type\": \"TOTP\",\n    \"default\": false,\n    \"contact\": null\n  },\n  {\n    \"type\": \"SMS\",\n    \"default\": false,\n    \"contact\": \"+38********12\"\n  }\n]\n```"
      operationId: getAvailableTwoFaProviders
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/TwoFaProviderInfo'
components:
  schemas:
    TwoFaProviderInfo:
      type: object
      properties:
        type:
          type: string
          enum:
          - TOTP
          - SMS
          - EMAIL
          - BACKUP_CODE
        isDefault:
          type: boolean
          writeOnly: true
        contact:
          type: string
        minVerificationCodeSendPeriod:
          type: integer
          format: int32
        default:
          type: boolean
    JwtPair:
      type: object
      description: JWT Pair
      properties:
        token:
          type: string
          description: The JWT Access Token. Used to perform API calls.
          example: AAB254FF67D..
        refreshToken:
          type: string
          description: The JWT Refresh Token. Used to get new JWT Access Token if old one has expired.
          example: AAB254FF67D..
        scope:
          type: string
          enum:
          - SYS_ADMIN
          - TENANT_ADMIN
          - CUSTOMER_USER
          - REFRESH_TOKEN
          - PRE_VERIFICATION_TOKEN
          - MFA_CONFIGURATION_TOKEN
  securitySchemes:
    HTTP login form:
      type: http
      description: Enter Username / Password
      scheme: loginPassword
      bearerFormat: /api/auth/login|X-Authorization
    API key form:
      type: apiKey
      description: 'Enter the API key value with ''ApiKey'' prefix in format: **ApiKey <your_api_key_value>**


        Example: **ApiKey tb_5te51SkLRYpjGrujUGwqkjFvooWBlQpVe2An2Dr3w13wjfxDW**


        <br>**NOTE**: Use only ONE authentication method at a time. If both are authorized, JWT auth takes the priority.<br>

        '
      name: X-Authorization
      in: header