> For the complete documentation index, see [llms.txt](/docs/llms.txt) # SAML v2 | FusionAuth Docs Learn about the APIs for creating, retrieving, updating and deleting SAML v2 identity providers. # SAML v2 Available since version `1.6.0` SAML v2 identity providers connect to external SAML v2 login systems. This type of login will optionally provide a Login with ... button on FusionAuth's login page. This button is customizable by using different properties of the identity provider. Optionally, this identity provider can define one or more domains it is associated with. This is useful for allowing employees to log in with their corporate credentials. As long as the company has an identity solution that provides SAML v2, you can leverage this feature. This is referred to as a **Domain Based Identity Provider**. If you enable domains for an identity provider, the Login with ... button will not be displayed. Instead, only the `email` form field will be displayed initially on the FusionAuth login page. Once the user types in their email address, FusionAuth will determine if the user is logging in locally or if they should be redirected to this identity provider. This is determined by extracting the domain from their email address and comparing it to the domains associated with the identity provider. FusionAuth will locate the user's email address in the SAML assertion which will be used to create or lookup the existing user. Additional claims from the SAML response can be used to reconcile the User to FusionAuth by using a SAML v2 Reconcile Lambda. Unless you assign a reconcile lambda to this provider, on the `email` address will be used from the available assertions returned by the SAML v2 identity provider. ## Integration Details[#](#integration-details) The following values will likely be required by your SAML v2 Identity Provider in order to trust FusionAuth as a relying party. These values are autogenerated and viewable within the UI after creating the Identity Provider. They can be viewed by navigating to Settings -> Identity Providers -> SAMLv2 -> View . `` is the URL for your FusionAuth instance, something like `https://login.piedpiper.com`. `` is the Id of the Identity Provider, and will be a valid UUID. `` is the id of the application that is the target of the login, and will be a valid UUID. For an SP-initiated configuration: **Callback URL (ACS):** `/samlv2/acs` For an IdP-initiated configuration (per application): **Callback URL (ACS):** `/samlv2/acs//` **Issuer:** `/samlv2/sp/` **Metadata URL:** `/samlv2/sp/metadata/` Note: To receive a refresh token when completing the OAuth2 workflow when using an IdP initiated login, ensure you request the `offline_access` scope. To request a scope, add the following query parameter to your configured ACS in your IdP, `?scope=offline_access`. When logging into the FusionAuth admin UI, this step is optional as the `offline_access` scope will be implicitly added. ## Create a SAML v2 Identity Provider[#](#create-a-saml-v2-identity-provider) ### Request[#](#request) Create a SAML v2 Identity Provider using a randomly generated Id POST/api/identity-provider OpenAPI Spec Create a SAML v2 Identity Provider with the provided unique id POST/api/identity-provider/{identityProviderId} OpenAPI Spec The **type** property in the request JSON indicates you are managing a SAML v2 identity provider. #### Request Parameters[#](#request-parameters) `identityProviderId`UUIDoptionalDefaults to secure random UUIDImmutable The Id to use for the new Identity Provider. If an id is not provided, a secure random UUID is generated. #### Request Body[#](#request-body) `identityProvider.applicationConfiguration`Mapoptional The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].buttonImageURL`Stringoptional This is an optional Application specific override for the top level **buttonImageURL**. `identityProvider.applicationConfiguration[applicationId].buttonText`Stringoptional This is an optional Application specific override for the top level **buttonText**. `identityProvider.applicationConfiguration[applicationId].createRegistration`BooleanoptionalDefaults to true Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`BooleanoptionalDefaults to false Determines if this identity provider is enabled for the Application specified by the `applicationId` key. `identityProvider.assertionConfiguration.destination.alternates`ArrayoptionalAvailable since 1.43.0 The array of URLs that FusionAuth will accept as SAML login destinations if the **identityProvider.assertionConfiguration.destination.policy** setting is `AllowAlternates`. `identityProvider.assertionConfiguration.destination.policy`StringoptionalDefaults to EnabledAvailable since 1.43.0 The policy to use when performing a destination assertion on the SAML login request. The possible values are: * `Enabled` - Verifies the Destination attribute in the SAML response is equal to the expected Destination which is the FusionAuth ACS (Assertion Consumer Service) URL. This is the default and the recommended setting. * `Disabled` - Do not validate the Destination attribute. This is not recommended, please use with caution. * `AllowAlternates` - Verifies the Destination attribute is either the expected FusionAuth ACS, or one of the configured alternate values. This option is intended to assist with migrations from third-party IdPs and should be used with caution. `identityProvider.assertionDecryptionConfiguration.enabled`BooleanoptionalDefaults to falseAvailable since 1.55.1 Determines if FusionAuth requires encrypted assertions in SAML responses from the identity provider. When `true`, SAML responses from the identity provider containing unencrypted assertions will be rejected by FusionAuth. `identityProvider.assertionDecryptionConfiguration.keyTransportDecryptionKeyId`UUIDoptionalAvailable since 1.55.1 The Id of the key stored in Key Master that is used to decrypt the symmetric key on the SAML response sent to FusionAuth from the identity provider. The selected Key must contain an RSA private key. Required when **identityProvider.assertionDecryptionConfiguration.enabled** is `true`. `identityProvider.buttonImageURL`Stringoptional The top-level button image (URL) to use on the FusionAuth login page for this Identity Provider. `identityProvider.buttonText`Stringrequired The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.attributeMappings`MapoptionalAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and must begin with `user.` or `registration.`. Each value is the source expression in the identity provider response payload. A dot-notated value such as `email` or `id_token.given_name` is converted to a JSON Pointer. A value that starts with `/` is treated as a JSON Pointer as-is. This property cannot be used with `identityProvider.lambdaConfiguration.reconcileId`. This property is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. This property defaults to an empty map. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored. Mappings to `user.password` do not set a password. `identityProvider.debug`BooleanoptionalDefaults to falseAvailable since 1.7.3 Determines if debug is enabled for this provider. When enabled, an Event Log is created each time this provider is invoked to reconcile a login. This is useful for debugging purposes, but is not intended to be left on during production. It should be enabled during integration or if you are experiencing an issue with this identity provider. `identityProvider.domains`Arrayoptional This is an optional list of domains that this SAML v2 provider should be used for. This converts the FusionAuth login form to a domain-based login form. This type of form first asks the user for their email. FusionAuth then uses their email to determine if an identity provider should be used. If an identity provider should be used, the browser is redirected to the login URL of that identity provider. Otherwise, the password field is revealed on the form so that the user can login using FusionAuth. `identityProvider.emailClaim`Stringoptional The name of the email claim (attribute in the `Assertion` element) in the SAML response that FusionAuth uses to uniquely identity the user. Required when **identityProvider.useNameIdForEmail** is `false`. `identityProvider.enabled`BooleanoptionalDefaults to false Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.idpEndpoint`Stringrequired The SAML v2 login page of the identity provider. Must be a valid URL. `identityProvider.idpInitiatedConfiguration.enabled`BooleanoptionalDefaults to falseAvailable since 1.43.0 Determines if FusionAuth will accept IdP initiated login requests from this SAMLv2 Identity Provider. A valid license is required to use this feature. In general FusionAuth does not recommend you utilize this type of login due to the inherent risks of accepting an unsolicited authentication response from a third-party identity provider. In a service provider initiated login, the SAML Authentication Response is returned to the service provider (FusionAuth) in response to an authentication request. This means FusionAuth can validate certain parameters and only accept a response for a request that FusionAuth initiated. In contrast, during an identity provider initiated login, the third-party identity provider sends FusionAuth a SAML Authentication Response indicating a user has been authenticated without any context. The problem is that FusionAuth did not initiate this so it is unexpected, and this limits what can be verified and requires FusionAuth to allow a cross site request from this third party. If you must enable this feature to support a legacy integration or because the user experience is of the highest concern, then you may proceed. `identityProvider.idpInitiatedConfiguration.issuer`StringoptionalAvailable since 1.43.0 The EntityId (unique identifier) of the SAML v2 identity provider. This value should be provided to you. Required when **identityProvider.idpInitiatedConfiguration.enabled** is `true`. `identityProvider.keyId`UUIDrequired The Id of the key stored in Key Master that is used to verify the SAML response sent back to FusionAuth from the identity provider. This key must be a verification only key or certificate (meaning that it only has a public key component). `identityProvider.lambdaConfiguration.reconcileId`UUIDoptional The Id of a SAML reconcile lambda that is applied when the identity provider sends back a successful SAML response. The specified Lambda Id must be of type `SAMLv2Reconcile`. `identityProvider.linkingStrategy`StringoptionalDefaults to LinkByEmailAvailable since 1.28.0 The linking strategy to use when creating the link between the SAML v2 Identity Provider and the user. Available since 1.65.0 You can **only** change this value when the identity provider is **disabled**. To change the linking strategy for an identity provider that is already enabled, disable the provider, change the value, and then re-enable the provider. The possible values are: * `CreatePendingLink` - Do not automatically link, instead return a pending link identifier that can be used to link to an existing user. * `Disabled` - Disables linking automatically. You must use the API to create links. Available since 1.37.0 * `LinkAnonymously` - Always create a link based upon the unique Id returned by the identify provider. A username or email is not required and will not be used to link the user. A reconcile lambda will not be used in this configuration. * `LinkByEmail` - Link to an existing user based upon email. A user will be created with the email returned by the identity provider if one does not already exist. * `LinkByEmailForExistingUser` - Only link to an existing user based upon email. A user will not be created if one does not already exist with email returned by the identity provider. * `LinkByUsername` - Link to an existing user based upon username. A user will be created with the username returned by the identity provider if one does not already exist. * `LinkByUsernameForExistingUser` - Only link to an existing user based upon username. A user will not be created if one does not already exist with username returned by the identity provider. `identityProvider.loginHintConfiguration.enabled`BooleanoptionalDefaults to trueAvailable since 1.43.0 When enabled and HTTP-Redirect bindings are used, FusionAuth will provide the username or email address when available to the IdP as a login hint using the configured parameter name set by the **identityProvider.loginHintConfiguration.parameterName** to initiate the AuthN request. `identityProvider.loginHintConfiguration.parameterName`StringoptionalDefaults to login\_hintAvailable since 1.43.0 The name of the parameter used to pass the username or email as login hint to the IDP when enabled, and HTTP redirect bindings are used to initiate the AuthN request. Required when **identityProvider.loginHintConfiguration.enabled** is `true`. `identityProvider.name`Stringrequired The name of this SAML v2 identity provider. This is only used for display purposes. Must be unique across all identity providers. `identityProvider.nameIdFormat`Stringrequired The Name Id is used to facilitate communication about a user between a Service Provider (SP) and Identity Provider (IdP). The SP can specify the preferred format in the AuthN request regarding a user. The identity Provider will attempt to honor this format in the AuthN response. When this parameter is omitted a default value of `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` will be used. `identityProvider.postRequest`BooleanoptionalAvailable since 1.20.0 When `true` the authentication request will use the HTTP POST binding with the identity provider instead of the default Redirect binding which uses the HTTP GET method. `identityProvider.requestSigningKeyId`UUIDoptionalAvailable since 1.20.0 The key pair Id to use to sign the SAML request. Required when **identityProvider.signRequest** is `true`. `identityProvider.signRequest`BooleanoptionalAvailable since 1.20.0 When `true` authentication requests sent to the identity provider will be signed. `identityProvider.source`StringoptionalDefaults to SystemAvailable since 1.65.0 The source of this Identity Provider. The maximum length is `191` characters. This value is only used on create. If provided on update, it is ignored and the existing value is preserved. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDoptionalAvailable since 1.62.0 The unique Id of the Tenant. Providing a value creates an identity provider scoped to the specified tenant, otherwise a global identity provider is created. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. Global identity providers can be used with any tenant. This value is read-only once the identity provider is created. `identityProvider.type`Stringrequired This field must be set to `SAMLv2`. `identityProvider.uniqueIdClaim`Stringoptional The name of the unique claim in the SAML response that FusionAuth uses to uniquely link the user. If this is not set, the `emailClaim` will be used when linking user. `identityProvider.useNameIdForEmail`Booleanoptional Whether or not FusionAuth will use the **NameID** element value as the email address of the user for reconciliation processing. If this is set to `false`, then the **emailClaim** property must be set. `identityProvider.usernameClaim`Stringoptional The name of the claim in the SAML response that FusionAuth uses to identity the username. If this is not set, the **NameId** value will be used to link a user. This property is required when **identityProvider.linkingStrategy** is set to `LinkByUsername` or `LinkByUsernameForExistingUser` `identityProvider.xmlSignatureC14nMethod`StringoptionalAvailable since 1.20.0 The XML signature canonicalization method used when digesting and signing the SAML request. Required when **identityProvider.signRequest** and **identityProvider.postRequest** are `true`. The possible values are: * `exclusive`: The URI for this method is `http://www.w3.org/2001/10/xml-exc-c14n#` * `exclusive_with_comments`: The URI for this method is `http://www.w3.org/2001/10/xml-exc-c14n#WithComments` * `inclusive`: The URI for this method is `http://www.w3.org/TR/2001/REC-xml-c14n-20010315` * `inclusive_with_comments`: The URI for this method is `http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments` *Example SAML v2 Request JSON* ``` { "identityProvider": { "applicationConfiguration": { "2c73b816-f48c-4c36-964b-40589a9ae629": { "buttonText": "Login with SAML (app text)", "createRegistration": true, "enabled": true } }, "assertionConfiguration": { "destination": { "alternates": [], "policy": "Enabled" } }, "assertionDecryptionConfiguration": { "enabled": true, "keyTransportDecryptionKeyId": "ce0ca33d-3555-4b89-9777-0ef1276f7b26" }, "buttonText": "Login with SAML", "debug": false, "emailClaim": "email", "enabled": true, "idpEndpoint": "https://www.example.com/login", "idpInitiatedConfiguration": { "enabled": false, "issuer": "https://www.example.com" }, "keyId": "a60f46c9-5d8e-48af-ac23-dbaa00579c57", "lambdaConfiguration": { "reconcileId": "0bf07e2d-08fa-4d56-8f63-9f9d40ee7fd5" }, "linkingStrategy": "LinkByEmail", "loginHintConfiguration": { "enabled": true, "parameterName": "login_hint" }, "name": "My SAML provider", "nameIdFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent", "postRequest": true, "requestSigningKeyId": "3168129b-91fa-46f4-9676-947f5509fdce", "signRequest": true, "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "SAMLv2", "xmlSignatureC14nMethod": "exclusive", "uniqueIdClaim": "userId", "useNameIdForEmail": true, "usernameClaim": "username" } } ``` ### Response[#](#response) *Response Codes* | Code | Description | | --- | --- | | 200 | The request was successful. The response will contain a JSON body. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. | | 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](/docs/apis/authentication). | | 409 | A conflict was encountered processing this request. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | #### Response Body[#](#response-body) `identityProvider.applicationConfiguration`Map The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].buttonImageURL`String This is an optional Application specific override for the top level button image URL. `identityProvider.applicationConfiguration[applicationId].buttonText`String This is an optional Application specific override for the top level button text. `identityProvider.applicationConfiguration[applicationId].createRegistration`Boolean Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`Boolean Determines if this identity provider is enabled for the Application specified by the applicationId key. `identityProvider.assertionConfiguration.destination.alternates`ArrayAvailable since 1.43.0 The array of URLs that FusionAuth will accept as SAML login destinations if the **identityProvider.assertionConfiguration.destination.policy** setting is `AllowAlternates`. `identityProvider.assertionConfiguration.destination.policy`StringAvailable since 1.43.0 The policy to use when performing a destination assertion on the SAML login request. The possible values are: * `Enabled` - Verifies the Destination attribute in the SAML response is equal to the expected Destination which is the FusionAuth ACS (Assertion Consumer Service) URL. This is the default and the recommended setting. * `Disabled` - Do not validate the Destination attribute. This is not recommended, please use with caution. * `AllowAlternates` - Verifies the Destination attribute is either the expected FusionAuth ACS, or one of the configured alternate values. This option is intended to assist with migrations from third-party IdPs and should be used with caution. `identityProvider.assertionDecryptionConfiguration.enabled`BooleanAvailable since 1.55.1 Determines if FusionAuth requires encrypted assertions in SAML responses from the identity provider. When `true`, SAML responses from the identity provider containing unencrypted assertions will be rejected by FusionAuth. `identityProvider.assertionDecryptionConfiguration.keyTransportDecryptionKeyId`UUIDAvailable since 1.55.1 The Id of the key stored in Key Master that is used to decrypt the symmetric key on the SAML response sent back to FusionAuth from the identity provider. The selected Key must contain an RSA private key. `identityProvider.buttonImageURL`String The top-level button image (URL) to use on the FusionAuth login page for this Identity Provider. `identityProvider.buttonText`String The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.attributeMappings`MapAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and begins with `user.` or `registration.`. Each value is the source expression from the identity provider response payload. This configuration is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored at runtime. Mappings to `user.password` do not set a password. `identityProvider.debug`Boolean Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created. `identityProvider.domains`Array This is an optional list of domains that this SAML v2 provider should be used for. This converts the FusionAuth login form to a domain-based login form. This type of form first asks the user for their email. FusionAuth then uses their email to determine if an identity provider should be used. If an identity provider should be used, the browser is redirected to the login URL of that identity provider. Otherwise, the password field is revealed on the form so that the user can login using FusionAuth. `identityProvider.emailClaim`String The name of the email claim (attribute in the `Assertion` element) in the SAML response that FusionAuth uses to uniquely identity the user. `identityProvider.enabled`Boolean Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.id`UUID The Id of the provider. `identityProvider.idpEndpoint`String The SAML v2 login page of the identity provider. `identityProvider.idpInitiatedConfiguration.enabled`BooleanAvailable since 1.43.0 Determines if FusionAuth will accept IDP-initiated login requests from this SAMLv2 Identity Provider. A valid license is required to use this feature. `identityProvider.idpInitiatedConfiguration.issuer`StringAvailable since 1.43.0 The EntityId (unique identifier) of the SAML v2 identity provider. This value should be provided to you. `identityProvider.insertInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was added to the FusionAuth database. `identityProvider.lastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was updated in the FusionAuth database. `identityProvider.keyId`UUID The Id of the key stored in KeyMaster that is used to verify the SAML response sent back to FusionAuth from the identity provider. This key must be a verification only key or certificate (meaning that it only has a public key component). `identityProvider.lambdaConfiguration.reconcileId` The Id of a SAML reconcile lambda that is applied when the identity provider sends back a successful SAML response. `identityProvider.linkingStrategy`StringoptionalDefaults to LinkByEmailAvailable since 1.28.0 The linking strategy to use when creating the link between the SAML v2 Identity Provider and the user. The possible values are: * `CreatePendingLink` - Create pending link. * `Disabled` - Disables linking automatically. Available since 1.37.0 * `LinkAnonymously` - Anonymous Link. * `LinkByEmail` - Link on email. Create the user if they do not exist. * `LinkByEmailForExistingUser` - Link on email. Do not create the user if they do not exist. * `LinkByUsername` - Link on username. Create the user if they do not exist. * `LinkByUsernameForExistingUser` - Link on username. Do not create the user if they do not exist. `identityProvider.loginHintConfiguration.enabled`BooleanAvailable since 1.43.0 When enabled and HTTP-Redirect bindings are used, FusionAuth will provide the username or email address when available to the IdP as a login hint using the configured parameter name set by the **identityProvider.loginHintConfiguration.parameterName** to initiate the AuthN request. `identityProvider.loginHintConfiguration.parameterName`StringAvailable since 1.43.0 The name of the parameter used to pass the username or email as login hint to the IDP when enabled, and HTTP redirect bindings are used to initiate the AuthN request. `identityProvider.name`String The name of this SAML v2 identity provider. This is only used for display purposes. `identityProvider.nameIdFormat`String The Name Id is used to facilitate communication about a user between a Service Provider (SP) and Identity Provider (IdP). The SP can specify the preferred format in the AuthN request regarding a user. The identity Provider will attempt to honor this format in the AuthN response. `identityProvider.postRequest`BooleanAvailable since 1.20.0 When `true` the authentication request will use the HTTP POST binding with the identity provider instead of the default Redirect binding which uses the HTTP GET method. `identityProvider.requestSigningKeyId`UUIDAvailable since 1.20.0 The key pair Id to use to sign the SAML request. `identityProvider.signRequest`BooleanAvailable since 1.20.0 When `true` authentication requests sent to the identity provider will be signed. `identityProvider.source`StringAvailable since 1.65.0 The source for this Identity Provider. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDAvailable since 1.62.0 The unique Id of the Tenant. This value is present if the identity provider is tenant-scoped. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. This value is read-only once the key is created. `identityProvider.type`String This field will be `SAMLv2`. `identityProvider.uniqueIdClaim`String The name of the unique claim in the SAML response that FusionAuth uses to uniquely link the user. If this is not set, the `emailClaim` will be used when linking user. `identityProvider.useNameIdForEmail`Boolean Whether or not FusionAuth will use the `NameID` element value as the email address of the user for reconciliation processing. `identityProvider.usernameClaim`String The name of the claim in the SAML response that FusionAuth uses to identity the username. If this is not set, the **NameId** value will be used to link a user. This property is required when **identityProvider.linkingStrategy** is set to `LinkByUsername` or `LinkByUsernameForExistingUser` `identityProvider.xmlSignatureC14nMethod`StringAvailable since 1.20.0 The XML signature canonicalization method used when digesting and signing the SAML request. The possible values are: * `exclusive`: The URI for this method is `http://www.w3.org/2001/10/xml-exc-c14n#` * `exclusive_with_comments`: The URI for this method is `http://www.w3.org/2001/10/xml-exc-c14n#WithComments` * `inclusive`: The URI for this method is `http://www.w3.org/TR/2001/REC-xml-c14n-20010315` * `inclusive_with_comments`: The URI for this method is `http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments` *Example SAML v2 Response JSON* ``` { "identityProvider": { "applicationConfiguration": { "2c73b816-f48c-4c36-964b-40589a9ae629": { "buttonText": "Login with SAML (app text)", "createRegistration": true, "enabled": true } }, "assertionConfiguration": { "destination": { "alternates": [], "policy": "Enabled" } }, "assertionDecryptionConfiguration": { "enabled": true, "keyTransportDecryptionKeyId": "ce0ca33d-3555-4b89-9777-0ef1276f7b26" }, "buttonText": "Login with SAML", "emailClaim": "email", "debug": false, "domains": [], "enabled": true, "id": "e13afb7b-77c7-4451-9c07-897d38f4fb3d", "idpEndpoint": "https://www.example.com/login", "idpInitiatedConfiguration": { "enabled": false, "issuer": "https://www.example.com" }, "insertInstant": 1595361142909, "lastUpdateInstant": 1595361143101, "keyId": "a60f46c9-5d8e-48af-ac23-dbaa00579c57", "lambdaConfiguration": { "reconcileId": "0bf07e2d-08fa-4d56-8f63-9f9d40ee7fd5" }, "linkingStrategy": "LinkByEmail", "loginHintConfiguration": { "enabled": true, "parameterName": "login_hint" }, "name": "My SAML provider", "nameIdFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent", "postRequest": true, "requestSigningKeyId": "3168129b-91fa-46f4-9676-947f5509fdce", "signRequest": true, "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "SAMLv2", "xmlSignatureC14nMethod": "exclusive", "uniqueIdClaim": "userId", "useNameIdForEmail": true, "usernameClaim": "username" } } ``` ## Retrieve a SAML v2 Identity Provider[#](#retrieve-a-saml-v2-identity-provider) ### Request[#](#request-1) Retrieve an Identity Provider by Id GET/api/identity-provider/{identityProviderId} OpenAPI Spec #### Request Parameters[#](#request-parameters-1) `identityProviderId`UUIDrequired The unique Id of the SAML v2 Identity Provider to retrieve. ### Response[#](#response-1) *Response Codes* | Code | Description | | --- | --- | | 200 | The request was successful. The response will contain a JSON body. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. | | 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](/docs/apis/authentication). | | 404 | The object you requested doesn't exist. The response will be empty. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | #### Response Body[#](#response-body) `identityProvider.applicationConfiguration`Map The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].buttonImageURL`String This is an optional Application specific override for the top level button image URL. `identityProvider.applicationConfiguration[applicationId].buttonText`String This is an optional Application specific override for the top level button text. `identityProvider.applicationConfiguration[applicationId].createRegistration`Boolean Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`Boolean Determines if this identity provider is enabled for the Application specified by the applicationId key. `identityProvider.assertionConfiguration.destination.alternates`ArrayAvailable since 1.43.0 The array of URLs that FusionAuth will accept as SAML login destinations if the **identityProvider.assertionConfiguration.destination.policy** setting is `AllowAlternates`. `identityProvider.assertionConfiguration.destination.policy`StringAvailable since 1.43.0 The policy to use when performing a destination assertion on the SAML login request. The possible values are: * `Enabled` - Verifies the Destination attribute in the SAML response is equal to the expected Destination which is the FusionAuth ACS (Assertion Consumer Service) URL. This is the default and the recommended setting. * `Disabled` - Do not validate the Destination attribute. This is not recommended, please use with caution. * `AllowAlternates` - Verifies the Destination attribute is either the expected FusionAuth ACS, or one of the configured alternate values. This option is intended to assist with migrations from third-party IdPs and should be used with caution. `identityProvider.assertionDecryptionConfiguration.enabled`BooleanAvailable since 1.55.1 Determines if FusionAuth requires encrypted assertions in SAML responses from the identity provider. When `true`, SAML responses from the identity provider containing unencrypted assertions will be rejected by FusionAuth. `identityProvider.assertionDecryptionConfiguration.keyTransportDecryptionKeyId`UUIDAvailable since 1.55.1 The Id of the key stored in Key Master that is used to decrypt the symmetric key on the SAML response sent back to FusionAuth from the identity provider. The selected Key must contain an RSA private key. `identityProvider.buttonImageURL`String The top-level button image (URL) to use on the FusionAuth login page for this Identity Provider. `identityProvider.buttonText`String The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.attributeMappings`MapAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and begins with `user.` or `registration.`. Each value is the source expression from the identity provider response payload. This configuration is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored at runtime. Mappings to `user.password` do not set a password. `identityProvider.debug`Boolean Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created. `identityProvider.domains`Array This is an optional list of domains that this SAML v2 provider should be used for. This converts the FusionAuth login form to a domain-based login form. This type of form first asks the user for their email. FusionAuth then uses their email to determine if an identity provider should be used. If an identity provider should be used, the browser is redirected to the login URL of that identity provider. Otherwise, the password field is revealed on the form so that the user can login using FusionAuth. `identityProvider.emailClaim`String The name of the email claim (attribute in the `Assertion` element) in the SAML response that FusionAuth uses to uniquely identity the user. `identityProvider.enabled`Boolean Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.id`UUID The Id of the provider. `identityProvider.idpEndpoint`String The SAML v2 login page of the identity provider. `identityProvider.idpInitiatedConfiguration.enabled`BooleanAvailable since 1.43.0 Determines if FusionAuth will accept IDP-initiated login requests from this SAMLv2 Identity Provider. A valid license is required to use this feature. `identityProvider.idpInitiatedConfiguration.issuer`StringAvailable since 1.43.0 The EntityId (unique identifier) of the SAML v2 identity provider. This value should be provided to you. `identityProvider.insertInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was added to the FusionAuth database. `identityProvider.lastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was updated in the FusionAuth database. `identityProvider.keyId`UUID The Id of the key stored in KeyMaster that is used to verify the SAML response sent back to FusionAuth from the identity provider. This key must be a verification only key or certificate (meaning that it only has a public key component). `identityProvider.lambdaConfiguration.reconcileId` The Id of a SAML reconcile lambda that is applied when the identity provider sends back a successful SAML response. `identityProvider.linkingStrategy`StringoptionalDefaults to LinkByEmailAvailable since 1.28.0 The linking strategy to use when creating the link between the SAML v2 Identity Provider and the user. The possible values are: * `CreatePendingLink` - Create pending link. * `Disabled` - Disables linking automatically. Available since 1.37.0 * `LinkAnonymously` - Anonymous Link. * `LinkByEmail` - Link on email. Create the user if they do not exist. * `LinkByEmailForExistingUser` - Link on email. Do not create the user if they do not exist. * `LinkByUsername` - Link on username. Create the user if they do not exist. * `LinkByUsernameForExistingUser` - Link on username. Do not create the user if they do not exist. `identityProvider.loginHintConfiguration.enabled`BooleanAvailable since 1.43.0 When enabled and HTTP-Redirect bindings are used, FusionAuth will provide the username or email address when available to the IdP as a login hint using the configured parameter name set by the **identityProvider.loginHintConfiguration.parameterName** to initiate the AuthN request. `identityProvider.loginHintConfiguration.parameterName`StringAvailable since 1.43.0 The name of the parameter used to pass the username or email as login hint to the IDP when enabled, and HTTP redirect bindings are used to initiate the AuthN request. `identityProvider.name`String The name of this SAML v2 identity provider. This is only used for display purposes. `identityProvider.nameIdFormat`String The Name Id is used to facilitate communication about a user between a Service Provider (SP) and Identity Provider (IdP). The SP can specify the preferred format in the AuthN request regarding a user. The identity Provider will attempt to honor this format in the AuthN response. `identityProvider.postRequest`BooleanAvailable since 1.20.0 When `true` the authentication request will use the HTTP POST binding with the identity provider instead of the default Redirect binding which uses the HTTP GET method. `identityProvider.requestSigningKeyId`UUIDAvailable since 1.20.0 The key pair Id to use to sign the SAML request. `identityProvider.signRequest`BooleanAvailable since 1.20.0 When `true` authentication requests sent to the identity provider will be signed. `identityProvider.source`StringAvailable since 1.65.0 The source for this Identity Provider. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDAvailable since 1.62.0 The unique Id of the Tenant. This value is present if the identity provider is tenant-scoped. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. This value is read-only once the key is created. `identityProvider.type`String This field will be `SAMLv2`. `identityProvider.uniqueIdClaim`String The name of the unique claim in the SAML response that FusionAuth uses to uniquely link the user. If this is not set, the `emailClaim` will be used when linking user. `identityProvider.useNameIdForEmail`Boolean Whether or not FusionAuth will use the `NameID` element value as the email address of the user for reconciliation processing. `identityProvider.usernameClaim`String The name of the claim in the SAML response that FusionAuth uses to identity the username. If this is not set, the **NameId** value will be used to link a user. This property is required when **identityProvider.linkingStrategy** is set to `LinkByUsername` or `LinkByUsernameForExistingUser` `identityProvider.xmlSignatureC14nMethod`StringAvailable since 1.20.0 The XML signature canonicalization method used when digesting and signing the SAML request. The possible values are: * `exclusive`: The URI for this method is `http://www.w3.org/2001/10/xml-exc-c14n#` * `exclusive_with_comments`: The URI for this method is `http://www.w3.org/2001/10/xml-exc-c14n#WithComments` * `inclusive`: The URI for this method is `http://www.w3.org/TR/2001/REC-xml-c14n-20010315` * `inclusive_with_comments`: The URI for this method is `http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments` *Example SAML v2 Response JSON* ``` { "identityProvider": { "applicationConfiguration": { "2c73b816-f48c-4c36-964b-40589a9ae629": { "buttonText": "Login with SAML (app text)", "createRegistration": true, "enabled": true } }, "assertionConfiguration": { "destination": { "alternates": [], "policy": "Enabled" } }, "assertionDecryptionConfiguration": { "enabled": true, "keyTransportDecryptionKeyId": "ce0ca33d-3555-4b89-9777-0ef1276f7b26" }, "buttonText": "Login with SAML", "emailClaim": "email", "debug": false, "domains": [], "enabled": true, "id": "e13afb7b-77c7-4451-9c07-897d38f4fb3d", "idpEndpoint": "https://www.example.com/login", "idpInitiatedConfiguration": { "enabled": false, "issuer": "https://www.example.com" }, "insertInstant": 1595361142909, "lastUpdateInstant": 1595361143101, "keyId": "a60f46c9-5d8e-48af-ac23-dbaa00579c57", "lambdaConfiguration": { "reconcileId": "0bf07e2d-08fa-4d56-8f63-9f9d40ee7fd5" }, "linkingStrategy": "LinkByEmail", "loginHintConfiguration": { "enabled": true, "parameterName": "login_hint" }, "name": "My SAML provider", "nameIdFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent", "postRequest": true, "requestSigningKeyId": "3168129b-91fa-46f4-9676-947f5509fdce", "signRequest": true, "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "SAMLv2", "xmlSignatureC14nMethod": "exclusive", "uniqueIdClaim": "userId", "useNameIdForEmail": true, "usernameClaim": "username" } } ``` ## Update a SAML v2 Identity Provider[#](#update-a-saml-v2-identity-provider) This API is used to update an existing SAML v2 Identity Provider. You must specify all of the properties of the SAML v2 Identity Provider when calling this API with the `PUT` HTTP method. When used with `PUT`, this API doesn't merge the existing SAML v2 Identity Provider and your new data. It replaces the existing SAML v2 Identity Provider with your new data. Utilize the `PATCH` HTTP method to send specific changes to merge into an existing SAML v2 Identity Provider. ### Request[#](#request-2) Update an Identity Provider PUT/api/identity-provider/{identityProviderId} OpenAPI Spec PATCH/api/identity-provider/{identityProviderId} OpenAPI Spec For backward compatibility, the `PATCH` method accepts the same media type (specified by a `Content-Type` of `application/json`) and body as the `PUT` request. You can also use the following media types for different behavior: * [JSON Patch/RFC 6902](https://www.rfc-editor.org/rfc/rfc6902): `application/json-patch+json` * [JSON Merge Patch/RFC 7396](https://www.rfc-editor.org/rfc/rfc7396): `merge-patch+json` For details, see the [PATCH documentation](/docs/apis/#the-patch-http-method). Using a media type of `application/json` merges the provided request parameters into the existing object. As a result, all parameters are optional with `PATCH`: only provide the values you want to change. To remove a value, provide a `null` value. Patching an `Array` appends all values in the new list to the old list. #### Request Parameters[#](#request-parameters-2) `identityProviderId`UUIDrequiredImmutable The unique Id of the SAML v2 Identity Provider to update. #### Request Body[#](#request-body) `identityProvider.applicationConfiguration`Mapoptional The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].buttonImageURL`Stringoptional This is an optional Application specific override for the top level **buttonImageURL**. `identityProvider.applicationConfiguration[applicationId].buttonText`Stringoptional This is an optional Application specific override for the top level **buttonText**. `identityProvider.applicationConfiguration[applicationId].createRegistration`BooleanoptionalDefaults to true Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`BooleanoptionalDefaults to false Determines if this identity provider is enabled for the Application specified by the `applicationId` key. `identityProvider.assertionConfiguration.destination.alternates`ArrayoptionalAvailable since 1.43.0 The array of URLs that FusionAuth will accept as SAML login destinations if the **identityProvider.assertionConfiguration.destination.policy** setting is `AllowAlternates`. `identityProvider.assertionConfiguration.destination.policy`StringoptionalDefaults to EnabledAvailable since 1.43.0 The policy to use when performing a destination assertion on the SAML login request. The possible values are: * `Enabled` - Verifies the Destination attribute in the SAML response is equal to the expected Destination which is the FusionAuth ACS (Assertion Consumer Service) URL. This is the default and the recommended setting. * `Disabled` - Do not validate the Destination attribute. This is not recommended, please use with caution. * `AllowAlternates` - Verifies the Destination attribute is either the expected FusionAuth ACS, or one of the configured alternate values. This option is intended to assist with migrations from third-party IdPs and should be used with caution. `identityProvider.assertionDecryptionConfiguration.enabled`BooleanoptionalDefaults to falseAvailable since 1.55.1 Determines if FusionAuth requires encrypted assertions in SAML responses from the identity provider. When `true`, SAML responses from the identity provider containing unencrypted assertions will be rejected by FusionAuth. `identityProvider.assertionDecryptionConfiguration.keyTransportDecryptionKeyId`UUIDoptionalAvailable since 1.55.1 The Id of the key stored in Key Master that is used to decrypt the symmetric key on the SAML response sent to FusionAuth from the identity provider. The selected Key must contain an RSA private key. Required when **identityProvider.assertionDecryptionConfiguration.enabled** is `true`. `identityProvider.buttonImageURL`Stringoptional The top-level button image (URL) to use on the FusionAuth login page for this Identity Provider. `identityProvider.buttonText`Stringrequired The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.attributeMappings`MapoptionalAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and must begin with `user.` or `registration.`. Each value is the source expression in the identity provider response payload. A dot-notated value such as `email` or `id_token.given_name` is converted to a JSON Pointer. A value that starts with `/` is treated as a JSON Pointer as-is. This property cannot be used with `identityProvider.lambdaConfiguration.reconcileId`. This property is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. This property defaults to an empty map. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored. Mappings to `user.password` do not set a password. `identityProvider.debug`BooleanoptionalDefaults to falseAvailable since 1.7.3 Determines if debug is enabled for this provider. When enabled, an Event Log is created each time this provider is invoked to reconcile a login. This is useful for debugging purposes, but is not intended to be left on during production. It should be enabled during integration or if you are experiencing an issue with this identity provider. `identityProvider.domains`Arrayoptional This is an optional list of domains that this SAML v2 provider should be used for. This converts the FusionAuth login form to a domain-based login form. This type of form first asks the user for their email. FusionAuth then uses their email to determine if an identity provider should be used. If an identity provider should be used, the browser is redirected to the login URL of that identity provider. Otherwise, the password field is revealed on the form so that the user can login using FusionAuth. `identityProvider.emailClaim`Stringoptional The name of the email claim (attribute in the `Assertion` element) in the SAML response that FusionAuth uses to uniquely identity the user. Required when **identityProvider.useNameIdForEmail** is `false`. `identityProvider.enabled`BooleanoptionalDefaults to false Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.idpEndpoint`Stringrequired The SAML v2 login page of the identity provider. Must be a valid URL. `identityProvider.idpInitiatedConfiguration.enabled`BooleanoptionalDefaults to falseAvailable since 1.43.0 Determines if FusionAuth will accept IdP initiated login requests from this SAMLv2 Identity Provider. A valid license is required to use this feature. In general FusionAuth does not recommend you utilize this type of login due to the inherent risks of accepting an unsolicited authentication response from a third-party identity provider. In a service provider initiated login, the SAML Authentication Response is returned to the service provider (FusionAuth) in response to an authentication request. This means FusionAuth can validate certain parameters and only accept a response for a request that FusionAuth initiated. In contrast, during an identity provider initiated login, the third-party identity provider sends FusionAuth a SAML Authentication Response indicating a user has been authenticated without any context. The problem is that FusionAuth did not initiate this so it is unexpected, and this limits what can be verified and requires FusionAuth to allow a cross site request from this third party. If you must enable this feature to support a legacy integration or because the user experience is of the highest concern, then you may proceed. `identityProvider.idpInitiatedConfiguration.issuer`StringoptionalAvailable since 1.43.0 The EntityId (unique identifier) of the SAML v2 identity provider. This value should be provided to you. Required when **identityProvider.idpInitiatedConfiguration.enabled** is `true`. `identityProvider.keyId`UUIDrequired The Id of the key stored in Key Master that is used to verify the SAML response sent back to FusionAuth from the identity provider. This key must be a verification only key or certificate (meaning that it only has a public key component). `identityProvider.lambdaConfiguration.reconcileId`UUIDoptional The Id of a SAML reconcile lambda that is applied when the identity provider sends back a successful SAML response. The specified Lambda Id must be of type `SAMLv2Reconcile`. `identityProvider.linkingStrategy`StringoptionalDefaults to LinkByEmailAvailable since 1.28.0 The linking strategy to use when creating the link between the SAML v2 Identity Provider and the user. Available since 1.65.0 You can **only** change this value when the identity provider is **disabled**. To change the linking strategy for an identity provider that is already enabled, disable the provider, change the value, and then re-enable the provider. The possible values are: * `CreatePendingLink` - Do not automatically link, instead return a pending link identifier that can be used to link to an existing user. * `Disabled` - Disables linking automatically. You must use the API to create links. Available since 1.37.0 * `LinkAnonymously` - Always create a link based upon the unique Id returned by the identify provider. A username or email is not required and will not be used to link the user. A reconcile lambda will not be used in this configuration. * `LinkByEmail` - Link to an existing user based upon email. A user will be created with the email returned by the identity provider if one does not already exist. * `LinkByEmailForExistingUser` - Only link to an existing user based upon email. A user will not be created if one does not already exist with email returned by the identity provider. * `LinkByUsername` - Link to an existing user based upon username. A user will be created with the username returned by the identity provider if one does not already exist. * `LinkByUsernameForExistingUser` - Only link to an existing user based upon username. A user will not be created if one does not already exist with username returned by the identity provider. `identityProvider.loginHintConfiguration.enabled`BooleanoptionalDefaults to trueAvailable since 1.43.0 When enabled and HTTP-Redirect bindings are used, FusionAuth will provide the username or email address when available to the IdP as a login hint using the configured parameter name set by the **identityProvider.loginHintConfiguration.parameterName** to initiate the AuthN request. `identityProvider.loginHintConfiguration.parameterName`StringoptionalDefaults to login\_hintAvailable since 1.43.0 The name of the parameter used to pass the username or email as login hint to the IDP when enabled, and HTTP redirect bindings are used to initiate the AuthN request. Required when **identityProvider.loginHintConfiguration.enabled** is `true`. `identityProvider.name`Stringrequired The name of this SAML v2 identity provider. This is only used for display purposes. Must be unique across all identity providers. `identityProvider.nameIdFormat`Stringrequired The Name Id is used to facilitate communication about a user between a Service Provider (SP) and Identity Provider (IdP). The SP can specify the preferred format in the AuthN request regarding a user. The identity Provider will attempt to honor this format in the AuthN response. When this parameter is omitted a default value of `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` will be used. `identityProvider.postRequest`BooleanoptionalAvailable since 1.20.0 When `true` the authentication request will use the HTTP POST binding with the identity provider instead of the default Redirect binding which uses the HTTP GET method. `identityProvider.requestSigningKeyId`UUIDoptionalAvailable since 1.20.0 The key pair Id to use to sign the SAML request. Required when **identityProvider.signRequest** is `true`. `identityProvider.signRequest`BooleanoptionalAvailable since 1.20.0 When `true` authentication requests sent to the identity provider will be signed. `identityProvider.source`StringoptionalDefaults to SystemAvailable since 1.65.0 The source of this Identity Provider. The maximum length is `191` characters. This value is only used on create. If provided on update, it is ignored and the existing value is preserved. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDoptionalAvailable since 1.62.0 The unique Id of the Tenant. Providing a value creates an identity provider scoped to the specified tenant, otherwise a global identity provider is created. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. Global identity providers can be used with any tenant. This value is read-only once the identity provider is created. `identityProvider.type`Stringrequired This field must be set to `SAMLv2`. `identityProvider.uniqueIdClaim`Stringoptional The name of the unique claim in the SAML response that FusionAuth uses to uniquely link the user. If this is not set, the `emailClaim` will be used when linking user. `identityProvider.useNameIdForEmail`Booleanoptional Whether or not FusionAuth will use the **NameID** element value as the email address of the user for reconciliation processing. If this is set to `false`, then the **emailClaim** property must be set. `identityProvider.usernameClaim`Stringoptional The name of the claim in the SAML response that FusionAuth uses to identity the username. If this is not set, the **NameId** value will be used to link a user. This property is required when **identityProvider.linkingStrategy** is set to `LinkByUsername` or `LinkByUsernameForExistingUser` `identityProvider.xmlSignatureC14nMethod`StringoptionalAvailable since 1.20.0 The XML signature canonicalization method used when digesting and signing the SAML request. Required when **identityProvider.signRequest** and **identityProvider.postRequest** are `true`. The possible values are: * `exclusive`: The URI for this method is `http://www.w3.org/2001/10/xml-exc-c14n#` * `exclusive_with_comments`: The URI for this method is `http://www.w3.org/2001/10/xml-exc-c14n#WithComments` * `inclusive`: The URI for this method is `http://www.w3.org/TR/2001/REC-xml-c14n-20010315` * `inclusive_with_comments`: The URI for this method is `http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments` *Example SAML v2 Request JSON* ``` { "identityProvider": { "applicationConfiguration": { "2c73b816-f48c-4c36-964b-40589a9ae629": { "buttonText": "Login with SAML (app text)", "createRegistration": true, "enabled": true } }, "assertionConfiguration": { "destination": { "alternates": [], "policy": "Enabled" } }, "assertionDecryptionConfiguration": { "enabled": true, "keyTransportDecryptionKeyId": "ce0ca33d-3555-4b89-9777-0ef1276f7b26" }, "buttonText": "Login with SAML", "debug": false, "emailClaim": "email", "enabled": true, "idpEndpoint": "https://www.example.com/login", "idpInitiatedConfiguration": { "enabled": false, "issuer": "https://www.example.com" }, "keyId": "a60f46c9-5d8e-48af-ac23-dbaa00579c57", "lambdaConfiguration": { "reconcileId": "0bf07e2d-08fa-4d56-8f63-9f9d40ee7fd5" }, "linkingStrategy": "LinkByEmail", "loginHintConfiguration": { "enabled": true, "parameterName": "login_hint" }, "name": "My SAML provider", "nameIdFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent", "postRequest": true, "requestSigningKeyId": "3168129b-91fa-46f4-9676-947f5509fdce", "signRequest": true, "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "SAMLv2", "xmlSignatureC14nMethod": "exclusive", "uniqueIdClaim": "userId", "useNameIdForEmail": true, "usernameClaim": "username" } } ``` ### Response[#](#response-2) The response for this API contains the SAML v2 Identity Provider that was updated. *Response Codes* | Code | Description | | --- | --- | | 200 | The request was successful. The response will contain a JSON body. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. | | 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](/docs/apis/authentication). | | 404 | The object you are trying to update doesn't exist. The response will be empty. | | 409 | A conflict was encountered processing this request. If the response has a general error code of `[retryableConflict]`, then the client should exponentially backoff and retry the request. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | #### Response Body[#](#response-body) `identityProvider.applicationConfiguration`Map The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].buttonImageURL`String This is an optional Application specific override for the top level button image URL. `identityProvider.applicationConfiguration[applicationId].buttonText`String This is an optional Application specific override for the top level button text. `identityProvider.applicationConfiguration[applicationId].createRegistration`Boolean Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`Boolean Determines if this identity provider is enabled for the Application specified by the applicationId key. `identityProvider.assertionConfiguration.destination.alternates`ArrayAvailable since 1.43.0 The array of URLs that FusionAuth will accept as SAML login destinations if the **identityProvider.assertionConfiguration.destination.policy** setting is `AllowAlternates`. `identityProvider.assertionConfiguration.destination.policy`StringAvailable since 1.43.0 The policy to use when performing a destination assertion on the SAML login request. The possible values are: * `Enabled` - Verifies the Destination attribute in the SAML response is equal to the expected Destination which is the FusionAuth ACS (Assertion Consumer Service) URL. This is the default and the recommended setting. * `Disabled` - Do not validate the Destination attribute. This is not recommended, please use with caution. * `AllowAlternates` - Verifies the Destination attribute is either the expected FusionAuth ACS, or one of the configured alternate values. This option is intended to assist with migrations from third-party IdPs and should be used with caution. `identityProvider.assertionDecryptionConfiguration.enabled`BooleanAvailable since 1.55.1 Determines if FusionAuth requires encrypted assertions in SAML responses from the identity provider. When `true`, SAML responses from the identity provider containing unencrypted assertions will be rejected by FusionAuth. `identityProvider.assertionDecryptionConfiguration.keyTransportDecryptionKeyId`UUIDAvailable since 1.55.1 The Id of the key stored in Key Master that is used to decrypt the symmetric key on the SAML response sent back to FusionAuth from the identity provider. The selected Key must contain an RSA private key. `identityProvider.buttonImageURL`String The top-level button image (URL) to use on the FusionAuth login page for this Identity Provider. `identityProvider.buttonText`String The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.attributeMappings`MapAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and begins with `user.` or `registration.`. Each value is the source expression from the identity provider response payload. This configuration is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored at runtime. Mappings to `user.password` do not set a password. `identityProvider.debug`Boolean Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created. `identityProvider.domains`Array This is an optional list of domains that this SAML v2 provider should be used for. This converts the FusionAuth login form to a domain-based login form. This type of form first asks the user for their email. FusionAuth then uses their email to determine if an identity provider should be used. If an identity provider should be used, the browser is redirected to the login URL of that identity provider. Otherwise, the password field is revealed on the form so that the user can login using FusionAuth. `identityProvider.emailClaim`String The name of the email claim (attribute in the `Assertion` element) in the SAML response that FusionAuth uses to uniquely identity the user. `identityProvider.enabled`Boolean Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.id`UUID The Id of the provider. `identityProvider.idpEndpoint`String The SAML v2 login page of the identity provider. `identityProvider.idpInitiatedConfiguration.enabled`BooleanAvailable since 1.43.0 Determines if FusionAuth will accept IDP-initiated login requests from this SAMLv2 Identity Provider. A valid license is required to use this feature. `identityProvider.idpInitiatedConfiguration.issuer`StringAvailable since 1.43.0 The EntityId (unique identifier) of the SAML v2 identity provider. This value should be provided to you. `identityProvider.insertInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was added to the FusionAuth database. `identityProvider.lastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was updated in the FusionAuth database. `identityProvider.keyId`UUID The Id of the key stored in KeyMaster that is used to verify the SAML response sent back to FusionAuth from the identity provider. This key must be a verification only key or certificate (meaning that it only has a public key component). `identityProvider.lambdaConfiguration.reconcileId` The Id of a SAML reconcile lambda that is applied when the identity provider sends back a successful SAML response. `identityProvider.linkingStrategy`StringoptionalDefaults to LinkByEmailAvailable since 1.28.0 The linking strategy to use when creating the link between the SAML v2 Identity Provider and the user. The possible values are: * `CreatePendingLink` - Create pending link. * `Disabled` - Disables linking automatically. Available since 1.37.0 * `LinkAnonymously` - Anonymous Link. * `LinkByEmail` - Link on email. Create the user if they do not exist. * `LinkByEmailForExistingUser` - Link on email. Do not create the user if they do not exist. * `LinkByUsername` - Link on username. Create the user if they do not exist. * `LinkByUsernameForExistingUser` - Link on username. Do not create the user if they do not exist. `identityProvider.loginHintConfiguration.enabled`BooleanAvailable since 1.43.0 When enabled and HTTP-Redirect bindings are used, FusionAuth will provide the username or email address when available to the IdP as a login hint using the configured parameter name set by the **identityProvider.loginHintConfiguration.parameterName** to initiate the AuthN request. `identityProvider.loginHintConfiguration.parameterName`StringAvailable since 1.43.0 The name of the parameter used to pass the username or email as login hint to the IDP when enabled, and HTTP redirect bindings are used to initiate the AuthN request. `identityProvider.name`String The name of this SAML v2 identity provider. This is only used for display purposes. `identityProvider.nameIdFormat`String The Name Id is used to facilitate communication about a user between a Service Provider (SP) and Identity Provider (IdP). The SP can specify the preferred format in the AuthN request regarding a user. The identity Provider will attempt to honor this format in the AuthN response. `identityProvider.postRequest`BooleanAvailable since 1.20.0 When `true` the authentication request will use the HTTP POST binding with the identity provider instead of the default Redirect binding which uses the HTTP GET method. `identityProvider.requestSigningKeyId`UUIDAvailable since 1.20.0 The key pair Id to use to sign the SAML request. `identityProvider.signRequest`BooleanAvailable since 1.20.0 When `true` authentication requests sent to the identity provider will be signed. `identityProvider.source`StringAvailable since 1.65.0 The source for this Identity Provider. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDAvailable since 1.62.0 The unique Id of the Tenant. This value is present if the identity provider is tenant-scoped. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. This value is read-only once the key is created. `identityProvider.type`String This field will be `SAMLv2`. `identityProvider.uniqueIdClaim`String The name of the unique claim in the SAML response that FusionAuth uses to uniquely link the user. If this is not set, the `emailClaim` will be used when linking user. `identityProvider.useNameIdForEmail`Boolean Whether or not FusionAuth will use the `NameID` element value as the email address of the user for reconciliation processing. `identityProvider.usernameClaim`String The name of the claim in the SAML response that FusionAuth uses to identity the username. If this is not set, the **NameId** value will be used to link a user. This property is required when **identityProvider.linkingStrategy** is set to `LinkByUsername` or `LinkByUsernameForExistingUser` `identityProvider.xmlSignatureC14nMethod`StringAvailable since 1.20.0 The XML signature canonicalization method used when digesting and signing the SAML request. The possible values are: * `exclusive`: The URI for this method is `http://www.w3.org/2001/10/xml-exc-c14n#` * `exclusive_with_comments`: The URI for this method is `http://www.w3.org/2001/10/xml-exc-c14n#WithComments` * `inclusive`: The URI for this method is `http://www.w3.org/TR/2001/REC-xml-c14n-20010315` * `inclusive_with_comments`: The URI for this method is `http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments` *Example SAML v2 Response JSON* ``` { "identityProvider": { "applicationConfiguration": { "2c73b816-f48c-4c36-964b-40589a9ae629": { "buttonText": "Login with SAML (app text)", "createRegistration": true, "enabled": true } }, "assertionConfiguration": { "destination": { "alternates": [], "policy": "Enabled" } }, "assertionDecryptionConfiguration": { "enabled": true, "keyTransportDecryptionKeyId": "ce0ca33d-3555-4b89-9777-0ef1276f7b26" }, "buttonText": "Login with SAML", "emailClaim": "email", "debug": false, "domains": [], "enabled": true, "id": "e13afb7b-77c7-4451-9c07-897d38f4fb3d", "idpEndpoint": "https://www.example.com/login", "idpInitiatedConfiguration": { "enabled": false, "issuer": "https://www.example.com" }, "insertInstant": 1595361142909, "lastUpdateInstant": 1595361143101, "keyId": "a60f46c9-5d8e-48af-ac23-dbaa00579c57", "lambdaConfiguration": { "reconcileId": "0bf07e2d-08fa-4d56-8f63-9f9d40ee7fd5" }, "linkingStrategy": "LinkByEmail", "loginHintConfiguration": { "enabled": true, "parameterName": "login_hint" }, "name": "My SAML provider", "nameIdFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent", "postRequest": true, "requestSigningKeyId": "3168129b-91fa-46f4-9676-947f5509fdce", "signRequest": true, "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "SAMLv2", "xmlSignatureC14nMethod": "exclusive", "uniqueIdClaim": "userId", "useNameIdForEmail": true, "usernameClaim": "username" } } ``` ## Delete a SAML v2 Identity Provider[#](#delete-a-saml-v2-identity-provider) ### Request[#](#request-3) Delete a SAML v2 Identity Provider by Id DELETE/api/identity-provider/{identityProviderId} OpenAPI Spec #### Request Parameters[#](#request-parameters-3) `identityProviderId`UUIDrequired The unique Id of the SAML v2 Identity Provider to delete. ### Response[#](#response-3) This API does not return a JSON response body. *Response Codes* | Code | Description | | --- | --- | | 200 | The request was successful. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. | | 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](/docs/apis/authentication). | | 404 | The object you requested doesn't exist. The response will be empty. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | ## Start a SAML v2 Login Request[#](#start-a-saml-v2-login-request) This API has been available since 1.19.0 This API is used to initiate a SAML v2 login request when integrating without the FusionAuth hosted login pages. The SAML v2 AuthN request will require a unique request identifier. This API must be used to record this identifier prior to sending the SAML response from the IdP to FusionAuth in order to protect against SAML response replay attacks. You may optionally provide an identifier to this API if you need to generate your own identifier, or use the generated value provided in the API response. ### Request[#](#request-4) Start a login request POST/api/identity-provider/start OpenAPI Spec #### Request Body[#](#request-body) `applicationId`UUIDrequired The Id of the Application the user is to be logged into. This application must have SAML v2 login enabled for this request to succeed. `data.requestId`Stringoptional The optional SAML v2 request identifier to be used when making the SAML AuthN request to the SAML v2 IdP. If this parameter is omitted a value will be generated. `identityProviderId`UUIDrequired The unique Id of the identity provider to process this login request. `connectionTestId`StringoptionalAvailable since 1.65.0 The Id of an identity provider connection test returned by the [Start an Identity Provider Connection Test](/docs/apis/identity-providers/test#start-an-identity-provider-connection-test) API. *Example Request JSON* ``` { "applicationId": "1c212e59-0d0e-6b1a-ad48-f4f92793be32", "identityProviderId": "b68026e5-4688-4a9d-b790-a524468c4c9a" } ``` ### Response[#](#response-4) The response for this API contains a code that can be used to complete the login request. | Code | Description | | --- | --- | | 202 | The request completed successfully. The response will contain the `code` to be used to complete the login request. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | `code`String The code used to complete login using the Complete SAML v2 Login API. *Example Response JSON* ``` { "code": "id62bb157cb5a84abe858e0877a39bccda" } ``` ## Complete a SAML v2 Login[#](#complete-a-saml-v2-login) This API allows you to complete a SAML v2 login after the user has authenticated with a SAML v2 identity provider. If you are using the FusionAuth login UI with the SAML v2 button you will not utilize this API directly. This API is intended to be used if you want to build your own login page and you have added a SAML v2 login button to this page. For example, if you built your own login page, you could add a Login with Pied Piper button to utilize a third party SAML v2 identity provider. When the user completes the SAML v2 login step, they will be redirected back to your application. This is done via a form submit (using the HTTP `POST` method). This `POST` will contain a parameter named `SAMLResponse`. Using this API you can pass the `SAMLResponse` returned from the SAML v2 provider to FusionAuth and we will complete the login workflow and reconcile the user to FusionAuth. The user does not need to exist yet in FusionAuth to utilize this API, depending on the configured [linking strategy](/docs/lifecycle/authenticate-users/identity-providers/#linking-strategies). The `SAMLResponse` returned from the provider will be used to retrieve the user's information. If that user does not yet exist in FusionAuth the user may be created. If **createRegistration** has been enabled for this identity provider and the user does not yet have a registration for this application, a registration will be automatically created for the user. The user will be assigned any default roles configured for the application. If **createRegistration** has not been enabled, a registration will not be created if one does not yet exist. This last scenario is useful if you wish to manually provision users and then subsequently allow them to login with this identity provider. ### Request[#](#request-5) Complete SAML v2 Login POST/api/identity-provider/login OpenAPI Spec #### Request Headers[#](#request-headers) `X-Forwarded-For`Stringoptional The IP address of a client requesting authentication. If the IP address is provided it will be stored in the user's login record. It is generally preferred to specify the IP address in the request body. If it is not provided in the request body this header value will be used if available. However, the request body value takes precedence. `X-FusionAuth-TenantId`Stringoptional The unique Id of the tenant used to scope this API request. The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required. Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result. See [Making an API request using a Tenant Id](/docs/apis/authentication#making-an-api-request-using-a-tenant-id) for additional information. #### Request Body `applicationId`UUIDrequired The Id of the Application the user is to be logged into. This application must have SAML v2 login enabled for this request to succeed. `data.samlResponse`Stringrequired The `SAMLResponse` parameter from the form submit (via a `POST` request) from the SAML v2 identity provider. This must contain the `code` retrieved from the Start Login Request API call. `identityProviderId`UUIDrequired The unique Id of the identity provider to process this login request. `connectionTestId`StringoptionalAvailable since 1.65.0 The Id of an identity provider connection test returned by the [Start an Identity Provider Connection Test](/docs/apis/identity-providers/test#start-an-identity-provider-connection-test) API. `ipAddress`Stringoptional The IP address of the end-user that is logging into FusionAuth. If this value is omitted FusionAuth will attempt to obtain the IP address of the client, the value will be that of the `X-Forwarded-For` header if provided or the last proxy that sent the request. The IP address will be stored in the User login history. `metaData.device.description`Stringoptional A human readable description of the device represented by the `device` parameter. `metaData.device.lastAccessedAddress`Stringoptional The IP address of this login request. `metaData.device.name`Stringoptional A human readable name of the device represented by the `device` parameter. `metaData.device.type`Stringoptional The type of device represented by the `device` parameter. Prior to version `1.46.0`, this value was restricted to the following types: * `BROWSER` * `DESKTOP` * `LAPTOP` * `MOBILE` * `OTHER` * `SERVER` * `TABLET` * `TV` * `UNKNOWN` In version `1.46.0` and beyond, this value can be any string value you'd like, have fun with it! `newDevice`BooleanoptionalDefaults to false Indicates that this device has never been used by this user to log in before. One of many signals used to decide whether to issue an MFA challenge as part of [Intelligent MFA](/docs/lifecycle/authenticate-users/contextual-multi-factor#intelligent-mfa) or the [MFA Requirement Lambda](/docs/extend/code/lambdas/mfa-requirement). When `true`, triggers the [New Device Webhook](/docs/extend/events-and-webhooks/events/user/login/user-login-new-device). `noJWT`BooleanoptionalDefaults to false When this value is set to true a JWT will not be issued as part of this request. The response body will not contain the `token` field, and the `access_token` and `refresh_token` cookies will not be written to the HTTP response. This optional parameter may be helpful when performing high volume authentication requests and the JWT is not being used, in this scenario removing the additional latency required to issue and sign the JWT may have a measurable cumulative effect on performance. `noLink`BooleanoptionalDefaults to falseAvailable since 1.29.0 When this value is set to `true`, if a link does not yet exist to a FusionAuth user, a `404` status code will be returned instead of using the requested linking strategy. This may be useful if you want to identify if a link exists before starting a full interactive workflow with the user to complete a link. *Example Request JSON* ``` { "applicationId": "10000000-0000-0002-0000-000000000001", "data": { "samlResponse": "PHNhbWxwOlJlc3BvbnNlIElEPSJfYzgxODM3YWMtNjQ2NS00MWNjLWExMDItNjI1N2Q3MTEyNDczIiBWZXJzaW9uPSIyLjAiIElzc3VlSW5zdGFudD0iMjAxOS0wMi0yOFQxODoyOTo1NS40NzNaIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9sb2NhbC5mdXNpb25hdXRoLmlvL29hdXRoMi9jYWxsYmFjayIgSW5SZXNwb25zZVRvPSJpZDMxZjgzYjM1LTU5NTQtNGI2Ny1hY2Y4LTc2M2MxNWZjM2FhYyIgeG1sbnM6c2FtbHA9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpwcm90b2NvbCI+PElzc3VlciB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+aHR0cHM6Ly9zdHMud2luZG93cy5uZXQvYzIxNTAxMTEtM2M0NC00NTA4LTlmMDgtNzkwY2I0MDMyYTIzLzwvSXNzdWVyPjxzYW1scDpTdGF0dXM+PHNhbWxwOlN0YXR1c0NvZGUgVmFsdWU9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2VzcyIvPjwvc2FtbHA6U3RhdHVzPjxBc3NlcnRpb24gSUQ9Il85OThiMTBhNC00YTQ5LTQ2OGEtOWQ3ZC0yZTFiNmRlNTFjMWIiIElzc3VlSW5zdGFudD0iMjAxOS0wMi0yOFQxODoyOTo1NS40NzNaIiBWZXJzaW9uPSIyLjAiIHhtbG5zPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj48SXNzdWVyPmh0dHBzOi8vc3RzLndpbmRvd3MubmV0L2MyMTUwMTExLTNjNDQtNDUwOC05ZjA4LTc5MGNiNDAzMmEyMy88L0lzc3Vlcj48U2lnbmF0dXJlIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48U2lnbmVkSW5mbz48Q2Fub25pY2FsaXphdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjxTaWduYXR1cmVNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGRzaWctbW9yZSNyc2Etc2hhMjU2Ii8+PFJlZmVyZW5jZSBVUkk9IiNfOTk4YjEwYTQtNGE0OS00NjhhLTlkN2QtMmUxYjZkZTUxYzFiIj48VHJhbnNmb3Jtcz48VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz48VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PC9UcmFuc2Zvcm1zPjxEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNzaGEyNTYiLz48RGlnZXN0VmFsdWU+ZlF3QlJpcWwxT0NzdkI1NGZNNDFvNkpzYjFxK1IvMXN4Q2Q3cFhNWDRldz08L0RpZ2VzdFZhbHVlPjwvUmVmZXJlbmNlPjwvU2lnbmVkSW5mbz48U2lnbmF0dXJlVmFsdWU+TlN4Rk1PVlpmd1M1a29yZ2ZUVkN1TmZLUkEzVTRvS29pWHo3a0ZKQ3p2UXAzYzVSS2k2eWJyZHdlZHp3WGFKalBmUGw0a2k1TmtxOFZMRVliRVJoa0dCL0VBb095RVR3YWJGQ0tzS1VEcUs0OUZiOHZFaWtRWDlYNEhVR0hncWhXdkplbzM2NDhmSFNIdkMwbU9sRnRRMTlmUjhKaUdGalZmTEoyMG9VMTFFUkNIVnFPWWc5dU9uLzBFcFJVK1hESW5kTkFMUDdqc0VFMXVQdUQ0aUR0dkxucWFLTGtHai9MMUk3OUU4WjA4eTRoLzRidVNiQjNSNXRIUHlaalpBcnBCc1ZzY2tUbldCZVAvR0F4QlZCZ1d6R28rQ0NNSGlONVJxTS95akN4Wm95aHVQbU9ISk9lQS9KcENadTRSM0d6dUUyM1gzblJjN1hLOS9XdFpQLzdRPT08L1NpZ25hdHVyZVZhbHVlPjxLZXlJbmZvPjxYNTA5RGF0YT48WDUwOUNlcnRpZmljYXRlPk1JSUM4RENDQWRpZ0F3SUJBZ0lRUjdodnZzbjRTYkZBRjVNY2ZRNkdiakFOQmdrcWhraUc5dzBCQVFzRkFEQTBNVEl3TUFZRFZRUURFeWxOYVdOeWIzTnZablFnUVhwMWNtVWdSbVZrWlhKaGRHVmtJRk5UVHlCRFpYSjBhV1pwWTJGMFpUQWVGdzB4T1RBeU1qY3lNVFV3TWpSYUZ3MHlNakF5TWpjeU1UVXdNalJhTURReE1qQXdCZ05WQkFNVEtVMXBZM0p2YzI5bWRDQkJlblZ5WlNCR1pXUmxjbUYwWldRZ1UxTlBJRU5sY25ScFptbGpZWFJsTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF6WUozV3VhdWtVVEFrMDJPL3cyRFBRanVONnFqZC9WSHBWSWE0OGQrd0JDWkxibUJ6NjYxb2J4Skxnc3pRa0ZLMlVJaWVmbjY0TDB4RHIza0dKcCt4dytZRjVSVFVtTzhMVTRqNlovL01XSS9XTjdqZnVwRERJYVUxSlZVbG83My81TVdVUE8yQVY0LzFGL2YvUmhuTWRwYlpUVnFiV0tMT21BYlJmaWMwb3pHOW15Q0xBeFMrNW9rWSsyaW1CSndMSndzU3ROcjAxTmJiT2JhdFFmY0FXV2JFTi9hT1NZbXE1QlFwOXJyV3FmK1pQRFVqWWc0c3VsaUVHWlZwY3lZc1JxeHhvaFdQU2JRd0pZeEV3Wmg3UTFsc2xQdm92QlBxeC9ZRkV2MXUveVUvc3ZVUnVTd0YvUUd4b0xyS3E4OXVMT2c1V1hsU203dkRXUHB2S0MyaFFJREFRQUJNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUJPaUVod0ZZNjR6R3ZWZW56eWkzR0k3djlFK0tDeXFFL0pkZGdxSGhsd0lQQzAwTXRRK3pEbE8ralZIWmw5ZWhJQzVLY1E1VktsQnh4S1VGM0lJdzFRY0o4UGVQenlzYmtYMXNmUzYyUmJmczVjWlcyQUlRL3dtY1B2V3MwenhjcmVPbzBRaGdUcmdnYlNlYjFpcUZEWTdFTkk0Uk0rdkZWWTVINDROZEVha05ucHowVm1kUkp6M1Q4R0Q0cThqRCtjOWUwZWZNTHhzQmxkSy8reHY2QnJNN3pKcUdCdy8yajlkRThPWXZ0Ym9xRm5PSmgrWkptcEd3ZC9EWlc0aHpKZDMzVDVWYVJjYklhRTl4ZUNTeEthY1ljWUpwU0RrVlVQdTBXSXJlU0FLKzZzbTM0MWZINDk5NEhiczhLUGF5MjQ5bEZLL0FFODZDNERBa00zeHd4MTwvWDUwOUNlcnRpZmljYXRlPjwvWDUwOURhdGE+PC9LZXlJbmZvPjwvU2lnbmF0dXJlPjxTdWJqZWN0PjxOYW1lSUQgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoxLjE6bmFtZWlkLWZvcm1hdDplbWFpbEFkZHJlc3MiPmJyaWFuX2ludmVyc29mdC5jb20jRVhUI0BicmlhbmludmVyc29mdC5vbm1pY3Jvc29mdC5jb208L05hbWVJRD48U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBJblJlc3BvbnNlVG89ImlkMzFmODNiMzUtNTk1NC00YjY3LWFjZjgtNzYzYzE1ZmMzYWFjIiBOb3RPbk9yQWZ0ZXI9IjIwMTktMDItMjhUMTg6MzQ6NTUuNDczWiIgUmVjaXBpZW50PSJodHRwczovL2xvY2FsLmZ1c2lvbmF1dGguaW8vb2F1dGgyL2NhbGxiYWNrIi8+PC9TdWJqZWN0Q29uZmlybWF0aW9uPjwvU3ViamVjdD48Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMTktMDItMjhUMTg6MjQ6NTUuNDczWiIgTm90T25PckFmdGVyPSIyMDE5LTAyLTI4VDE5OjI0OjU1LjQ3M1oiPjxBdWRpZW5jZVJlc3RyaWN0aW9uPjxBdWRpZW5jZT5odHRwczovL2xvY2FsLmZ1c2lvbmF1dGguaW88L0F1ZGllbmNlPjwvQXVkaWVuY2VSZXN0cmljdGlvbj48L0NvbmRpdGlvbnM+PEF0dHJpYnV0ZVN0YXRlbWVudD48QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vaWRlbnRpdHkvY2xhaW1zL3RlbmFudGlkIj48QXR0cmlidXRlVmFsdWU+YzIxNTAxMTEtM2M0NC00NTA4LTlmMDgtNzkwY2I0MDMyYTIzPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vaWRlbnRpdHkvY2xhaW1zL29iamVjdGlkZW50aWZpZXIiPjxBdHRyaWJ1dGVWYWx1ZT4yYjIwNmJhYS0yMGQyLTQyNzMtYjIyMy00Y2M1MzI4MjcyZTg8L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjxBdHRyaWJ1dGUgTmFtZT0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS9pZGVudGl0eS9jbGFpbXMvZGlzcGxheW5hbWUiPjxBdHRyaWJ1dGVWYWx1ZT5CcmlhbiBQb250YXJlbGxpPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vaWRlbnRpdHkvY2xhaW1zL2lkZW50aXR5cHJvdmlkZXIiPjxBdHRyaWJ1dGVWYWx1ZT5saXZlLmNvbTwvQXR0cmlidXRlVmFsdWU+PC9BdHRyaWJ1dGU+PEF0dHJpYnV0ZSBOYW1lPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL2NsYWltcy9hdXRobm1ldGhvZHNyZWZlcmVuY2VzIj48QXR0cmlidXRlVmFsdWU+aHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2F1dGhlbnRpY2F0aW9ubWV0aG9kL3Bhc3N3b3JkPC9BdHRyaWJ1dGVWYWx1ZT48QXR0cmlidXRlVmFsdWU+aHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2F1dGhlbnRpY2F0aW9ubWV0aG9kL3Vuc3BlY2lmaWVkPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDUvaWRlbnRpdHkvY2xhaW1zL2dpdmVubmFtZSI+PEF0dHJpYnV0ZVZhbHVlPkJyaWFuPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDUvaWRlbnRpdHkvY2xhaW1zL3N1cm5hbWUiPjxBdHRyaWJ1dGVWYWx1ZT5Qb250YXJlbGxpPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDUvaWRlbnRpdHkvY2xhaW1zL2VtYWlsYWRkcmVzcyI+PEF0dHJpYnV0ZVZhbHVlPmJyaWFuQGludmVyc29mdC5jb208L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjxBdHRyaWJ1dGUgTmFtZT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNS9pZGVudGl0eS9jbGFpbXMvbmFtZSI+PEF0dHJpYnV0ZVZhbHVlPmJyaWFuX2ludmVyc29mdC5jb20jRVhUI0BicmlhbmludmVyc29mdC5vbm1pY3Jvc29mdC5jb208L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjwvQXR0cmlidXRlU3RhdGVtZW50PjxBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMTktMDItMjdUMjE6Mzk6NDguNzI2WiIgU2Vzc2lvbkluZGV4PSJfOTk4YjEwYTQtNGE0OS00NjhhLTlkN2QtMmUxYjZkZTUxYzFiIj48QXV0aG5Db250ZXh0PjxBdXRobkNvbnRleHRDbGFzc1JlZj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6Y2xhc3NlczpQYXNzd29yZDwvQXV0aG5Db250ZXh0Q2xhc3NSZWY+PC9BdXRobkNvbnRleHQ+PC9BdXRoblN0YXRlbWVudD48L0Fzc2VydGlvbj48L3NhbWxwOlJlc3BvbnNlPg==" }, "identityProviderId": "19544aa2-d634-4859-b193-e57af82b5d12", "ipAddress": "192.168.1.42" } ``` ### Response[#](#response-5) The response for this API contains the User object. *Response Codes* | Code | Description | | --- | --- | | 200 | The authentication was successful. The response will contain the User object that was authenticated. | | 202 | The user was authenticated successfully. The user is not registered for the application specified by `applicationId` on the request. The response will contain the User object that was authenticated. | | 203 | The user was authenticated successfully. The user is required to change their password, the response will contain the `changePasswordId` to be used on the [Change Password](/docs/apis/users/change-password) API. *Example Response JSON* ``` { "changePasswordId": "XOgai4Ro68xfGiex0ngXiJ2bbhduM4Pm7h3lvF0xibQ", "changePasswordReason": "Expired" } ``` | | 204 | The login is pending action by the end user. Wait and try the request again. | | 212 | The user's email address has not yet been verified. The response will contain the User object that was authenticated. If the verification strategy has been set to `FormField`, the response will contain the **emailVerificationId** that was generated for the user. | | 213 | The user's registration has not yet been verified. The response will contain the User object that was authenticated. If the verification strategy has been set to `FormField`, the response will contain the **registrationVerificationId** that was generated for the user. Prior to version `1.27.0`, this status code was not returned, and you will see a `200` instead. | | 232 | The user is completing a login with an Identity Provider configured to use the `Create a pending link` linking strategy and this user does not have a link established. The API response will only contain the `pendingIdPLinkId` and, possibly, `threatsDetected`. A call to the Link API's [Complete a Pending Link](/docs/apis/identity-providers/links#complete-a-pending-link) endpoint is required. Once the user is linked, calling this API again will allow login to succeed. *Example Response JSON* ``` { "pendingIdPLinkId": "0TxfELqDE0d2Y6PqCkztz4o-lXdRyAscAXh8EAyRZsx" } ``` | | 242 | The user was authenticated successfully. The user has two-factor authentication enabled. Since version `1.42.0`, this status code is also returned when two-factor authentication is required. The response will contain the `twoFactorId` to be used on the [Complete Two-Factor Authentication](/docs/apis/login/complete-mfa). *Example Response JSON* ``` { "methods": [ { "authenticator": { "algorithm": "HmacSHA1", "codeLength": 6, "timeStep": 30 }, "id": "2KSZ", "method": "authenticator" }, { "email": "richard@fusionauth.io", "id": "KLRT", "method": "email" } ], "twoFactorId": "YkQY5Gsyo4RlfmDciBGRmvfj3RmatUqrbjoIZ19fmw4" } ``` | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. | | 401 | Unable to complete the login request. The user cannot be reconciled or logged in using the external identity provider. | | 404 | The user was not found, the password was incorrect, the linking strategy is set to `disabled`, or the value `noLink: true` is passed on the linking request. The response will be empty. | | 409 | The user is currently in an action that has prevented login. The response will contain the actions that prevented login. *Example Response JSON* ``` { "actions": [ { "actionId": "00000000-0000-0000-0000-000000000042", "actionerUserId": "00000000-0000-0001-0000-000000000000", "expiry": 1571786483322, "localizedName": "Prevent Login Action", "localizedReason": "Hard Lock", "name": "Prevent Login Action", "reason": "Hard Lock", "reasonCode": "hard_lock" } ] } ``` | | 410 | The user has expired. The response will be empty. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | | 503 | The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body. | | 504 | One or more Webhook endpoints returned an invalid response or were unreachable. Based on the transaction configuration for this event your action cannot be completed. A stack trace is provided and logged in the FusionAuth log files. | #### Response Body[#](#response-body) `emailVerificationId`String An email verification Id, which is needed when performing your own email verification using the `/api/user/verify-email` API. This field is only returned when the **tenant.emailConfiguration.verificationStrategy** is set to `FormField`. `identityVerificationId`StringAvailable since 1.59.0 An identity verification Id, which is needed when performing your own identity verification using the `/api/identity/verify` API. This field is only returned under the following conditions, based on the identity that was used to log in: * An email address - the **tenant.emailConfiguration.verificationStrategy** is set to `FormField`. * A phone number - the **tenant.phoneConfiguration.verificationStrategy** is set to `FormField`. `pendingIdPLinkId`StringAvailable since 1.28.0 The pending identity provider link Id. This value is created when logging in with an identity provider configured with a linking strategy of `Create a pending link`. It will only be included in the response body when this strategy is configured and a link does not yet exist for the user. It is used in conjunction with the [Link APIs](/docs/apis/identity-providers/links) to complete a pending link. `refreshToken`String The refresh token that can be used to obtain a new access token once the provided one has expired. Because a refresh token is per user and per application, this value will only be returned when an **applicationId** was provided on the login request and the user is registered to the application. You must explicitly allow generation of refresh tokens when using the Login API. Configure the **application.loginConfiguration.generateRefreshTokens** setting via the API or enable the setting by navigating to the Application -> My Application -> Security tab. `refreshTokenId`StringAvailable since 1.37.0 When the **refreshToken** is returned in the response, this field will also be returned. This unique Id is the persistent identifier for this refresh token, and will not change even when using one-time use refresh tokens. This value may optionally be used to revoke the token using the [Refresh Token API](/docs/apis/jwt/revoke-refresh-tokens). `state`Object If authenticated using a One Time Password and **state** was provided during the Change Password request this value will be returned exactly as it was provided. `token`StringAvailable since 1.16.0 The access token, this string is an encoded JSON Web Token (JWT). When the user will be sent a setup password email or sms message, this token will not be returned. `tokenExpirationInstant`LongAvailable since 1.33.0 The [instant](/docs/reference/data-types#instants) the **token** will expire. If the response does not contain a **token**, this field will also be omitted from the response. `user.active`Boolean True if the User is active. False if the User has been deactivated. Deactivated Users will not be able to log in. `user.birthDate`String The User's birthdate formatted as `YYYY-MM-DD` `user.breachedPasswordLastCheckedInstant`Long The [instant](/docs/reference/data-types#instants) this user's password was last checked to determine if it is compromised. `user.connectorId`UUIDAvailable since 1.18.0 The unique Id of the [Connector](/docs/lifecycle/migrate-users/connectors/) associated with the System of Record being used to authenticate the user. `user.cleanSpeakId`UUID This Id is used by FusionAuth when the User's username is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the **content Id** of the username inside CleanSpeak. `user.data`Object An object that can hold any information about the User that should be persisted. `user.data.email`String This field will be used as the email address if no **user.email** field is found. This feature was removed in version 1.26.0 and added back in 1.27.2. `user.email`String The User's email address. `user.expiry`Long The expiration [instant](/docs/reference/data-types#instants) of the User's account. An expired user is not permitted to log in. `user.firstName`String The first name of the User. `user.fullName`String The User's full name as a separate field that is not calculated from **firstName** and **lastName**. `user.id`UUID The User's unique Id. `user.identities`ArrayAvailable since 1.59.0 The list of identities that exist for a User. `user.identities[x].displayValue`StringAvailable since 1.59.0 The display value for the identity. Only used for `username` type identities. If the unique username feature is not enabled, this value will be the same as **user.identities\[x\].value**. Otherwise, it will be the username the User has chosen. For primary username identities, this will be the same value as **user.username**. `user.identities[x].insertInstant`LongAvailable since 1.59.0 The [instant](/docs/reference/data-types#instants) when the identity was created. `user.identities[x].lastLoginInstant`LongAvailable since 1.59.0 The [instant](/docs/reference/data-types#instants) when the identity was last used to log in. If a User has multiple identity types (`username`, `email`, and `phoneNumber`), then this value will represent the specific identity they last used to log in. This contrasts with **user.lastLoginInstant**, which represents the last time any of the User's identities was used to log in. Identity provider logins will not be reflected here (see **user.lastLoginInstant** for a field that includes identity provider logins). `user.identities[x].lastUpdateInstant`LongAvailable since 1.59.0 The [instant](/docs/reference/data-types#instants) when the identity was last updated. `user.identities[x].moderationStatus`StringAvailable since 1.59.0 The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are: * `ACTIVE` - the username is active * `PENDING` - the username is pending approval/moderation * `REJECTED` - the username was rejected during moderation If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again. Only used for `username` type identities. For primary username identities, this will be the same value as **user.usernameStatus**. `user.identities[x].type`StringAvailable since 1.59.0 The identity type. The possible values are: * `email` - identities defined by an email address * `phoneNumber` - identities defined by a phone number * `username` - identities defined by a username `user.identities[x].value`StringAvailable since 1.59.0 The value represented by the identity. The contents of this field depend on **user.identities\[x\].type**and will be one of the following: * Email address - The User's email address, always lower cased. For primary email identities, this will be the same value as **user.email** * Phone number - The User's phone number, in E.164 canonical format. For primary phone number identities, this will be the same value as **user.phoneNumber** * Username - User's username - this will be the same as **user.identities\[x\].displayValue**. For primary username identities, this will be the same value as **user.username** This value is unique within a tenant for a particular **user.identities\[x\].type**. If the unique usernames feature is enabled, `value` will be the unique username (within the tenant). For primary username identities, this will also be the same value as **user.uniqueUsername**. `user.identities[x].verified`BooleanAvailable since 1.59.0 Whether verification was actually performed on the identity by FusionAuth. This is used in combination with the **user.identities\[x\].verifiedReason** to decide whether an identity needs verification. `user.identities[x].verifiedInstant`LongAvailable since 1.59.0 The [instant](/docs/reference/data-types#instants) when verification was performed on the identity. This field is only populated when verification was actually performed on the identity by FusionAuth. `user.identities[x].verifiedReason`StringAvailable since 1.59.0 The reason the User's identity was verified or not verified. The possible values are: * `Skipped` - Verification was skipped due to the `skipVerification` parameter on the request * `Trusted` - Identity was created via an identity provider or a connector * `Unverifiable` - FusionAuth doesn't know how to verify this identity type. Usernames are an example * `Implicit` - Verification was implicitly performed by sending a set password or passwordless message * `Pending` - Tenant policy requires verification but no verification has been performed yet * `Completed` - Verification was performed by FusionAuth * `Disabled` - Tenant policy did not require verification * `Import` - User was imported so verification was not performed by FusionAuth If this field is `Disabled`, `Import`, `Skipped`, `Trusted`, or `Unverifiable`, then verification will not be required, regardless of the **user.identities\[x\].verified** value. For `Implicit`, `Pending`, or `Completed`, the identity will require verification if **user.identities\[x\].verified** is false. `user.imageUrl`String The URL that points to an image file that is the User's profile image. `user.insertInstant`Long The [instant](/docs/reference/data-types#instants) when the user was created. `user.lastLoginInstant`Long The [instant](/docs/reference/data-types#instants) when the User logged in last. See **user.identities\[x\].lastLoginInstant** for more granular information based on identity. `user.lastName`String The User's last name. `user.lastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) when the User was last updated. `user.legacyIdentifier`StringAvailable since 1.67 Used to override the `sub` claim in tokens issued by the Legacy Identity Provider Adapter. This value is immutable after the user is created and is unique within the tenant when non-null. `user.memberships`Array The list of memberships for the User. `user.memberships[x].data`Object An object that can hold any information about the User for this membership that should be persisted. `user.memberships[x].groupId`UUID The Id of the Group of this membership. `user.memberships[x].id`UUID The unique Id of this membership. `user.memberships[x].insertInstant`Long The [instant](/docs/reference/data-types#instants) that the membership was created. `user.middleName`String The User's middle name. `user.mobilePhone`String The User's mobile phone number. This is useful if you will be sending push notifications or SMS messages to the User. This differs from **user.phoneNumber** and cannot be used to log in. `user.parentEmail`StringAvailable since 1.7.0 The email address of the user's parent or guardian. If this value was provided during a create or update operation, this value will only remain until the child is claimed by a parent. `user.passwordChangeRequired`Boolean Indicates that the User's password needs to be changed during their next login attempt. `user.passwordLastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) that the User last changed their password. Since version 1.59.0, if a user does not currently have a password, this field will not be returned in the response. `user.phoneNumber`StringAvailable since 1.59.0 The User's primary phone number. The phone number is stored and returned in E.164 canonical format, however a phone number is considered unique regardless of the format. `303-555-1212` is considered equal to `+13035551212` so either version of this phone number can be used whenever providing it as input to an API. This differs from **user.mobilePhone** in that **user.phoneNumber** can be used to log in, just like an email address or a username. `user.preferredLanguages`Array An array of locale strings that give, in order, the User's preferred languages. These are important for email templates and other localizable text. See [Locales](/docs/reference/data-types#locales). `user.registrations`Array The list of registrations for the User. This will include registrations for inactive applications. `user.registrations[x].applicationId`UUID The Id of the Application that this registration is for. `user.registrations[x].authenticationToken`String The Authentication Token for this registration (if one exists). `user.registrations[x].cleanSpeakId`UUID This Id is used by FusionAuth when the User's username for this registration is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the **content Id** of the username inside CleanSpeak. `user.registrations[x].data`Object An object that can hold any information about the User for this registration that should be persisted. `user.registrations[x].id`UUID The Id of this registration. `user.registrations[x].insertInstant`Long The [instant](/docs/reference/data-types#instants) that this registration was created. `user.registrations[x].lastLoginInstant`Long The [instant](/docs/reference/data-types#instants) that the User last logged into the Application for this registration. `user.registrations[x].preferredLanguages`Array An array of locale strings that give, in order, the User's preferred languages for this registration. These are important for email templates and other localizable text. `user.registrations[x].roles`Array The list of roles that the User has for this registration. The string is the role's `Name` not the role's `Id`, e.g. `admin` or `user-role`. `user.registrations[x].timezone`String The User's preferred timezone for this registration. The string will be in an [IANA](https://www.iana.org/time-zones) time zone format. `user.registrations[x].tokens`Map