Breached password detection is a critical component of secure applications.    Read the white paper

FusionAuth logo
FusionAuth logo
  • Features
    FusionAuth Reactor

    FusionAuth Reactor is a powerful suite of features developed to extend FusionAuth's core functionality.

    • Flexible Architecture   Flexible Architecture
    • Auth the Way You Want It   Auth the Way You Want It
    • Security & Compliance   Security & Compliance
    • Ultimate Password Control   Ultimate Password Control
    • Customizable User Experience   Customizable User Experience
    • Advanced Registration Forms   Advanced Registration Forms
    • Built for Devs   Built for Devs
    • User Management & Reporting   User Management & Reporting
    • Scalability   Scalability
    • Breached Password Detection   Breached Password Detection
    • Connectors   Connectors
    • FusionAuth Reactor   FusionAuth Reactor
  • Pricing
  • Docs
  • Downloads
  • Resources
    FusionAuth Resources
    • Upgrade from SaaS
    • Upgrade from Open Source
    • Upgrade from Home Grown
    • Blog   Blog
    • Forum   Forum
    • Community & Support   Community & Support
    • Customer & Partners   Customers & Partners
    • Video & Podcasts   Videos & Podcasts
    • Tech Guides   Getting Started
  • Expert Advice
    Expert Advice for Developers

    Learn everything you need to know about authentication, authorization, identity, and access management from our team of industry experts.

    • Authentication   Authentication
    • CIAM   CIAM
    • Identity Basics   Identity Basics
    • OAuth   OAuth
    • Security   Security
    • Tokens   Tokens
    • Dev Tools   Dev Tools
  • Account
Navigate to...
  • Welcome
  • Getting Started
  • 5-Minute Setup Guide
  • Reactor
  • Core Concepts
    • Overview
    • Users
    • Roles
    • Groups
    • Registrations
    • Applications
    • Tenants
    • Identity Providers
    • Authentication and Authorization
    • Integration Points
    • Roadmap
  • Installation Guide
    • Overview
    • System Requirements
    • Server Layout
    • Cluster
    • Docker
    • Fast Path
    • Kickstart™
    • Homebrew
    • Packages
    • Database
    • FusionAuth App
    • FusionAuth Search
    • Securing
    • Upgrading
  • APIs
    • Overview
    • Authentication
    • Errors
    • Actioning Users
    • Applications
    • Audit Logs
    • Connectors
      • Overview
      • Generic
      • LDAP
    • Consent
    • Emails
    • Event Logs
    • Families
    • Forms
    • Form Fields
    • Groups
    • Identity Providers
      • Overview
      • Apple
      • Facebook
      • Google
      • HYPR
      • LinkedIn
      • Twitter
      • OpenID Connect
      • SAML v2
      • External JWT
    • Integrations
    • JWT
    • Keys
    • Lambdas
    • Login
    • Passwordless
    • Registrations
    • Reports
    • System
    • Tenants
    • Themes
    • Two Factor
    • Users
    • User Actions
    • User Action Reasons
    • User Comments
    • Webhooks
  • Client Libraries
    • Overview
    • Dart
    • Go
    • Java
    • JavaScript
    • .NET Core
    • Node
    • PHP
    • Python
    • Ruby
    • Typescript
  • Themes
    • Overview
    • Localization
    • Examples
  • Email & Templates
    • Overview
    • Configure Email
    • Email Templates
  • Events & Webhooks
    • Overview
    • Events
    • Writing a Webhook
    • Securing Webhooks
  • Example Apps
    • Overview
    • Go
    • Java
    • JavaScript
    • .NET Core
    • PHP
    • Python
    • Ruby
  • Lambdas
    • Overview
    • Apple Reconcile
    • External JWT Reconcile
    • Facebook Reconcile
    • Google Reconcile
    • HYPR Reconcile
    • JWT Populate
    • LDAP Connector Reconcile
    • LinkedIn Reconcile
    • OpenID Connect Reconcile
    • SAML v2 Populate
    • SAML v2 Reconcile
    • Twitter Reconcile
  • Identity Providers
    • Overview
    • Apple
    • Facebook
    • Google
    • HYPR
    • LinkedIn
    • Twitter
    • OpenID Connect
      • Overview
      • Azure AD
      • Github
      • Discord
    • SAML v2
      • Overview
      • ADFS
    • External JWT
      • Overview
      • Example
  • Connectors
    • Overview
    • Generic Connector
    • LDAP Connector
    • FusionAuth Connector
  • Integrations
    • Overview
    • CleanSpeak
    • Kafka
    • Twilio
  • OpenID Connect & OAuth 2.0
    • Overview
    • Endpoints
    • Tokens
  • SAML v2 IdP
    • Overview
    • Google
    • Zendesk
  • Plugins
    • Writing a Plugin
    • Password Encryptors
  • Guides
    • Overview
    • Advanced Registration Forms
    • Breached Password Detection
    • Migration
    • Passwordless
    • Securing Your APIs
    • Silent Mode
  • Tutorials
    • Overview
    • Setup Wizard & First Login
    • Register/Login a User
    • Migrate Users
    • JSON Web Tokens
    • Authentication Tokens
    • Start and Stop FusionAuth
    • Switch Search Engines
    • User Account Lockout
    • Two Factor
  • Reference
    • CORS
    • Configuration
    • Data Types
    • Known Limitations
    • Password Encryptors
  • Release Notes
  • Troubleshooting

Two Factor APIs

Overview

  • Enable Two Factor

  • Disable Two Factor

  • Send a Two Factor Code

  • Generate a Secret

Enable Two Factor

This API is used to enable Two Factor authentication for a single User. To use this API the User must provide a valid Two Factor verification code.

To enable using TextMessage delivery, you may use the Two Factor Send API to deliver a code to the User, the User will then provide this code as input.

Request

Enable Two Factor Authentication

URI

POST /api/user/two-factor/{userId}

Request Parameters

userId [UUID] Required

The Id of the User to enable Two Factor authentication.

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Enable Two Factor Authentication

URI

POST /api/user/two-factor

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Body

code [String] Required

A valid Two Factor verification code. This value should be provided by the User to verify they are able to produce codes using an application or receive them using their mobile phone.

delivery [String] Required

The User’s preferred delivery for verification codes during a two factor login request.

The possible values are:

  • None

  • TextMessage

    When using TextMessage the User will also need a valid mobilePhone. The User’s mobile phone is not validated during this request. Because the code is provided on this request it is assumed the User has been able to receive a code on their mobile phone when setting the delivery to TextMessage.

secret [String] Optional

A base64 encoded secret.

You may optionally use the secret value returned by the Two Factor Secret API instead of generating this value yourself. This value is a secure random byte array that is Base-64 encoded.

If you omit this field, then secretBase32Encoded is required.

secretBase32Encoded [String] Optional

A base32 encoded secret.

You may optionally use the secretBase32Encoded value returned by the Two Factor Secret API instead of generating this value yourself. This value is a secure random byte array that is Base-32 encoded.

If you omit this field, then secret is required.

Example Request JSON
{
  "code": "435612",
  "delivery": "None",
  "secret": "8MJJfCY4ERBtotvenSc3"
}

Response

Table 1. Response Codes
Code Description

200

The request was successful. Two Factor has been enabled for the User.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

404

The User does not exist. The response will be empty.

421

The code request parameter is not valid. The response will be empty.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Disable Two Factor

This API is used to disable Two Factor authentication for a single User. To use this API the User must provide a valid Two Factor verification code.

If the User has configured TextMessage delivery, you may use the Two Factor Send API to deliver a code to the User, the User will then provide this code as input.

Request

Disable Two Factor Authentication

URI

DELETE /api/user/two-factor/{userId}?code={code}

Request Parameters

userId [UUID] Required

The Id of the User to enable Two Factor authentication.

code [String] Required

The time based one time use password, also called a Two Factor verification code.

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Disable Two Factor Authentication

URI

DELETE /api/user/two-factor?code={code}

Request Parameters

code [String] Required

The time based one time use password, also called a Two Factor verification code.

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Response

Table 2. Response Codes
Code Description

200

The request was successful. Two Factor has been disabled for the User.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

404

The User does not exist. The response will be empty.

421

The code request parameter is not valid. The response will be empty.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Send a Two Factor Code

This API is used to send a Two Factor verification code to a User. This may be useful during Two Factor authentication if the initial code is no longer valid. It may be also used to send a code to a User to assist in enabling or disabling Two Factor authentication.

To send a code to a User that already has Two Factor enabled, it is not required they have TextMessage set as their preferred delivery. As long as the User has a mobile phone defined you may send the User a code.

This API requires that the Twilio integration is enabled and configured properly.

Request

Send a Two Factor code to an existing User by Id

URI

POST /api/two-factor/send

This request is intended to be used to send a Two Factor code to a User that already has enabled Two Factor authentication to assist in disabling Two Factor authentication. The User must already have Two Factor enabled and have a valid mobile phone for this to succeed.

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Body

userId [UUID] Required

The User Id of the User to send a Two Factor verification code. This User is expected to already have Two Factor enabled.

Example Request JSON
{
  "userId": "c075e472-a732-47d6-865a-d385a5fcb525"
}

Send a Two Factor code to a mobile phone

URI

POST /api/two-factor/send

This request is intended to be used to send a Two Factor code to a User to assist in enabling Two Factor authentication.

Request Body

mobilePhone [String] Required

A mobile phone to send the Two Factor verification code.

secret [String] Required

The Two Factor secret used to generate a Two Factor verification code to send to the provided mobile phone.

You may optionally use value provided in the secret field returned by the Two Factor Secret API instead of generating this value yourself.

Example Request JSON
{
  "mobilePhone": "555-555-5555",
  "secret": "8MJJfCY4ERBtotvenSc3"
}

Send a Two Factor code to complete Two Factor Login

URI

POST /api/two-factor/send/{twoFactorId}

This request is intended to send additional messages to the User’s mobile phone during login.

Request Parameters

twoFactorId [String] Required

The twoFactorId returned by the Login API.

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Send a Two Factor code to an authenticated User using a JWT

URI

POST /api/two-factor/send

This request is intended to be used to send a Two Factor code to a User that already has enabled Two Factor authentication to assist in disabling Two Factor authentication. When using JWT authentication the User’s Id is retrieved from the JWT. The User must already have Two Factor enabled and have a valid mobile phone for this to succeed.

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Response

Table 3. Response Codes
Code Description

200

The request was successful.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Generate a Secret

This API is used to generate a new Two Factor secret for use when enabling Two Factor authentication for a User. This is provided as a helper to assist you in enabling Two Factor authentication.

If this secret will be used with a QR code to allow the User to scan the value it will need utilize the Base32 encoded value returned in the response.

Request

Generate a Two Factor Secret

URI

GET /api/two-factor/secret

Generate a Two Factor Secret

URI

GET /api/two-factor/secret

Response

The response for this API contains the a Two Factor secret.

Table 4. Response Codes
Code Description

200

The request was successful. The response will contain a JSON body.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Response Body

secret [String]

A Base64 encoded secret that may be used to enable Two Factor authentication.

secretBase32Encoded [String]

A Base32 encoded form of the provided secret. This useful if you need to provide a QR code to the User to enable Two Factor authentication.

Example Response JSON
{
  "secret": "8MJJfCY4ERBtotvenSc3",
  "secretBase32Encoded": "HBGUUSTGINMTIRKSIJ2G65DWMVXFGYZT"
}

Quick Links

  • Download
  • Pricing
  • Enterprise Sales FAQ
  • Contact Us
  • Jobs (come work with us)
  • My Account

Resources

  • Docs
  • Blog
  • Community & Support
  • Upgrade from SaaS
  • Upgrade from Homegrown
  • Upgrade from Open Source

Everything Else

  • Privacy Policy
  • Product Privacy Policy
  • License
  • License FAQ
  • Security (contact, bug bounty, etc)
  • Technical Support

Connect with Us

logo
Subscribe for Updates
We only send dev friendly newsletters. No marketing fluff!
© 2020 FusionAuth