> For the complete documentation index, see [llms.txt](/docs/llms.txt) # Twitter/X | FusionAuth Docs Learn about the APIs for creating, retrieving, updating and disabling a Twitter/X identity provider. # Twitter/X Available since version `1.1.0` The Twitter/X identity provider type will use the Twitter OAuth v1.0 login API. it will provide a Login with Twitter button on FusionAuth's login page that will leverage the Twitter login page directly. Additionally, this identity provider will call Twitter's `/1.1/account/verify_credentials.json` API to load additional details about the user and store them in FusionAuth. The email address returned by Twitter will be used to create or lookup the existing user. Additional claims returned by Twitter can be used to reconcile the User to FusionAuth by using a Twitter Reconcile Lambda. Unless you assign a reconcile lambda to this provider, on the `email` address will be used from the available claims returned by Twitter. Twitter does not require a user to have an email address. However, to prevent account hijacking and take-over, FusionAuth prevents users from logging in with Twitter unless they have setup an email address in their Twitter account. Keep this in mind as you enable this identity provider. FusionAuth will also store the Twitter `access token` returned from the OAuth v1.0 login workflow in the `identityProviderLink` object, in the **identityProviderLink.token** field. This object is accessible using the [Link API](/docs/apis/identity-providers/links). The `identityProviderLink` object stores the token so that you can use it in your application to call Twitter APIs on behalf of the user if desired. Prior to version `1.28.0`, the token was stored in the `UserRegistration` object, in the `tokens` Map. ## Create a Twitter Identity Provider[#](#create-a-twitter-identity-provider) ### Request[#](#request) Create a Twitter Identity Provider using a randomly generated Id POST/api/identity-provider OpenAPI Spec Create a Twitter Identity Provider (client provided Id) POST/api/identity-provider/{identityProviderId} OpenAPI Spec The **type** property in the request JSON indicates this is a Twitter Identity Provider. #### Request Parameters[#](#request-parameters) `identityProviderId`UUIDoptionalDefaults to secure random UUIDAvailable since 1.61.0Immutable The Id to use for the new Identity Provider. If an Id is not provided, a secure random UUID is generated. If neither an Id nor **identityProvider.name** are provided, the legacy fixed Twitter IdP Id `45bb233c-0901-4236-b5ca-ac46e2e0a5a5` will be used. #### Request Body[#](#request-body) `identityProvider.applicationConfiguration`Mapoptional The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].buttonText`Stringoptional This is an optional Application specific override for the top level **buttonText**. `identityProvider.applicationConfiguration[applicationId].consumerKey`Stringoptional This is an optional Application specific override for the top level **consumerKey**. `identityProvider.applicationConfiguration[applicationId].consumerSecret`Stringoptional This is an optional Application specific override for the top level **consumerSecret**. `identityProvider.applicationConfiguration[applicationId].createRegistration`BooleanoptionalDefaults to true Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`BooleanoptionalDefaults to false Determines if this identity provider is enabled for the Application specified by the `applicationId` key. `identityProvider.buttonText`Stringrequired The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.consumerKey`Stringrequired The top-level consumer key to use with the Twitter Identity Provider. This value is retrieved from the Twitter developer website when you setup your Twitter developer account. `identityProvider.consumerSecret`Stringrequired The top-level consumer secret to use with the Twitter Identity Provider. This value is retrieved from the Twitter developer website when you setup your Twitter developer account. `identityProvider.attributeMappings`MapoptionalAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and must begin with `user.` or `registration.`. Each value is the source expression in the identity provider response payload. A dot-notated value such as `email` or `id_token.given_name` is converted to a JSON Pointer. A value that starts with `/` is treated as a JSON Pointer as-is. This property cannot be used with `identityProvider.lambdaConfiguration.reconcileId`. This property is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. This property defaults to an empty map. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored. Mappings to `user.password` do not set a password. `identityProvider.debug`BooleanoptionalDefaults to falseAvailable since 1.7.3 Determines if debug is enabled for this provider. When enabled, an Event Log is created each time this provider is invoked to reconcile a login. This is useful for debugging purposes, but is not intended to be left on during production. It should be enabled during integration or if you are experiencing an issue with this identity provider. `identityProvider.enabled`BooleanoptionalDefaults to false Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.lambdaConfiguration.reconcileId`UUIDoptionalAvailable since 1.17.0 The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user. The specified Lambda Id must be of type `TwitterReconcile` `identityProvider.linkingStrategy`StringoptionalDefaults to LinkByEmailAvailable since 1.28.0 The linking strategy to use when creating the link between the Twitter Identity Provider and the user. Available since 1.65.0 You can **only** change this value when the identity provider is **disabled**. To change the linking strategy for an identity provider that is already enabled, disable the provider, change the value, and then re-enable the provider. The possible values are: * `CreatePendingLink` - Do not automatically link, instead return a pending link identifier that can be used to link to an existing user. * `Disabled` - Disables linking automatically. You must use the API to create links. Available since 1.37.0 * `LinkAnonymously` - Always create a link based upon the unique Id returned by the identify provider. A username or email is not required and will not be used to link the user. A reconcile lambda will not be used in this configuration. * `LinkByEmail` - Link to an existing user based upon email. A user will be created with the email returned by the identity provider if one does not already exist. * `LinkByEmailForExistingUser` - Only link to an existing user based upon email. A user will not be created if one does not already exist with email returned by the identity provider. * `LinkByUsername` - Link to an existing user based upon username. A user will be created with the username returned by the identity provider if one does not already exist. * `LinkByUsernameForExistingUser` - Only link to an existing user based upon username. A user will not be created if one does not already exist with username returned by the identity provider. `identityProvider.name`StringoptionalAvailable since 1.61.0 The display name of this provider instance. Required when using a provided **identityProviderId** or **identityProvider.tenantId**. `identityProvider.source`StringoptionalDefaults to SystemAvailable since 1.65.0 The source of this Identity Provider. The maximum length is `191` characters. This value is only used on create. If provided on update, it is ignored and the existing value is preserved. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDoptionalAvailable since 1.62.0 The unique Id of the Tenant. Providing a value creates an identity provider scoped to the specified tenant, otherwise a global identity provider is created. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. Global identity providers can be used with any tenant. This value is read-only once the identity provider is created. `identityProvider.type`Stringrequired This field must be set to `Twitter`. *Example Twitter Request JSON* ``` { "identityProvider": { "applicationConfiguration": { "1c212e59-0d0e-6b1a-ad48-f4f92793be32": { "createRegistration": true, "enabled": true } }, "buttonText": "Login with Twitter", "consumerKey": "24iuleLRKIZUNhxuuUK6yDZwb", "consumerSecret": "e2ZpAaAfxv2j9eeh6JTeNcXMWdVLjRNriXm4wSZt1f1Ss3Syp4", "name": "Twitter Provider", "debug": false, "enabled": true, "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "Twitter" } } ``` ### Response[#](#response) *Response Codes* | Code | Description | | --- | --- | | 200 | The request was successful. The response will contain a JSON body. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. | | 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](/docs/apis/authentication). | | 409 | A conflict was encountered processing this request. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | #### Response Body[#](#response-body) `identityProvider.applicationConfiguration`Map The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].buttonText`String This is an optional Application specific override for the top level **buttonText**. `identityProvider.applicationConfiguration[applicationId].consumerKey`String This is an optional Application specific override for the top level **consumerKey**. `identityProvider.applicationConfiguration[applicationId].consumerSecret`String This is an optional Application specific override for the top level **consumerSecret**. `identityProvider.applicationConfiguration[applicationId].createRegistration`Boolean Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`Boolean Determines if this identity provider is enabled for the Application specified by the `applicationId` key. `identityProvider.buttonText`String The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.consumerKey`String The top-level consumer key to use with the Twitter Identity Provider. This value is retrieved from the Twitter developer website when you setup your Twitter developer account. `identityProvider.consumerSecret`String The top-level consumer secret to use with the Twitter Identity Provider. This value is retrieved from the Twitter developer website when you setup your Twitter developer account. `identityProvider.attributeMappings`MapAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and begins with `user.` or `registration.`. Each value is the source expression from the identity provider response payload. This configuration is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored at runtime. Mappings to `user.password` do not set a password. `identityProvider.debug`BooleanAvailable since 1.7.3 Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created. `identityProvider.enabled`Boolean Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.id`UUID The Id of the provider. `identityProvider.insertInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was added to the FusionAuth database. `identityProvider.lastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was updated in the FusionAuth database. `identityProvider.lambdaConfiguration.reconcileId`UUIDAvailable since 1.17.0 The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user. `identityProvider.linkingStrategy`StringoptionalDefaults to LinkByEmailAvailable since 1.28.0 The linking strategy to use when creating the link between the Twitter Identity Provider and the user. The possible values are: * `CreatePendingLink` - Create pending link. * `Disabled` - Disables linking automatically. Available since 1.37.0 * `LinkAnonymously` - Anonymous Link. * `LinkByEmail` - Link on email. Create the user if they do not exist. * `LinkByEmailForExistingUser` - Link on email. Do not create the user if they do not exist. * `LinkByUsername` - Link on username. Create the user if they do not exist. * `LinkByUsernameForExistingUser` - Link on username. Do not create the user if they do not exist. `identityProvider.name`String The name of this Twitter identity provider. This is only used for display purposes. `identityProvider.source`StringAvailable since 1.65.0 The source for this Identity Provider. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDAvailable since 1.62.0 The unique Id of the Tenant. This value is present if the identity provider is tenant-scoped. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. This value is read-only once the key is created. `identityProvider.type`String The type of this provider, this field will always be set to `Twitter`. *Example Twitter Response JSON* ``` { "identityProvider": { "applicationConfiguration": { "1c212e59-0d0e-6b1a-ad48-f4f92793be32": { "createRegistration": true, "enabled": true } }, "buttonText": "Login with Twitter", "consumerKey": "24iuleLRKIZUNhxuuUK6yDZwb", "consumerSecret": "e2ZpAaAfxv2j9eeh6JTeNcXMWdVLjRNriXm4wSZt1f1Ss3Syp4", "debug": false, "enabled": true, "id": "c2e7f5d4-9a31-46b8-80c2-5d1a7b3f6e94", "insertInstant": 1595361142909, "lastUpdateInstant": 1595361143101, "name": "Twitter Provider", "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "Twitter" } } ``` ## Retrieve a Twitter Identity Provider[#](#retrieve-a-twitter-identity-provider) ### Request[#](#request-1) Retrieve a Twitter Identity Provider by Id GET/api/identity-provider/{identityProviderId} OpenAPI Spec Retrieve Twitter Identity Providers by type GET/api/identity-provider?type=Twitter OpenAPI Spec #### Request Parameters[#](#request-parameters-1) `identityProviderId`UUIDrequired The unique Id of the Twitter Identity Provider to retrieve. ### Response[#](#response-1) *Response Codes* | Code | Description | | --- | --- | | 200 | The request was successful. The response will contain a JSON body. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. | | 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](/docs/apis/authentication). | | 404 | The object you requested doesn't exist. The response will be empty. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | #### Response Body[#](#response-body) `identityProvider.applicationConfiguration`Map The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].buttonText`String This is an optional Application specific override for the top level **buttonText**. `identityProvider.applicationConfiguration[applicationId].consumerKey`String This is an optional Application specific override for the top level **consumerKey**. `identityProvider.applicationConfiguration[applicationId].consumerSecret`String This is an optional Application specific override for the top level **consumerSecret**. `identityProvider.applicationConfiguration[applicationId].createRegistration`Boolean Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`Boolean Determines if this identity provider is enabled for the Application specified by the `applicationId` key. `identityProvider.buttonText`String The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.consumerKey`String The top-level consumer key to use with the Twitter Identity Provider. This value is retrieved from the Twitter developer website when you setup your Twitter developer account. `identityProvider.consumerSecret`String The top-level consumer secret to use with the Twitter Identity Provider. This value is retrieved from the Twitter developer website when you setup your Twitter developer account. `identityProvider.attributeMappings`MapAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and begins with `user.` or `registration.`. Each value is the source expression from the identity provider response payload. This configuration is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored at runtime. Mappings to `user.password` do not set a password. `identityProvider.debug`BooleanAvailable since 1.7.3 Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created. `identityProvider.enabled`Boolean Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.id`UUID The Id of the provider. `identityProvider.insertInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was added to the FusionAuth database. `identityProvider.lastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was updated in the FusionAuth database. `identityProvider.lambdaConfiguration.reconcileId`UUIDAvailable since 1.17.0 The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user. `identityProvider.linkingStrategy`Stringoptional The linking strategy to use when creating the link between the Identity Provider and the user. The possible values are: * `CreatePendingLink` - Create pending link. * `Disabled` - Disables linking automatically. Available since 1.37.0 * `LinkAnonymously` - Anonymous Link. * `LinkByEmail` - Link on email. Create the user if they do not exist. * `LinkByEmailForExistingUser` - Link on email. Do not create the user if they do not exist. * `LinkByUsername` - Link on username. Create the user if they do not exist. * `LinkByUsernameForExistingUser` - Link on username. Do not create the user if they do not exist. `identityProvider.name`String The name of this Twitter identity provider. This is only used for display purposes. `identityProvider.source`StringAvailable since 1.65.0 The source for this Identity Provider. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDAvailable since 1.62.0 The unique Id of the Tenant. This value is present if the identity provider is tenant-scoped. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. This value is read-only once the key is created. `identityProvider.type`String The type of this provider, this field will always be set to `Twitter`. *Example Twitter Response JSON* ``` { "identityProvider": { "applicationConfiguration": { "1c212e59-0d0e-6b1a-ad48-f4f92793be32": { "createRegistration": true, "enabled": true } }, "buttonText": "Login with Twitter", "consumerKey": "24iuleLRKIZUNhxuuUK6yDZwb", "consumerSecret": "e2ZpAaAfxv2j9eeh6JTeNcXMWdVLjRNriXm4wSZt1f1Ss3Syp4", "debug": false, "enabled": true, "id": "c2e7f5d4-9a31-46b8-80c2-5d1a7b3f6e94", "insertInstant": 1595361142909, "lastUpdateInstant": 1595361143101, "name": "Twitter Provider", "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "Twitter" } } ``` ## Update a Twitter Identity Provider[#](#update-a-twitter-identity-provider) This API is used to update an existing Twitter Identity Provider. You must specify all of the properties of the Twitter Identity Provider when calling this API with the `PUT` HTTP method. When used with `PUT`, this API doesn't merge the existing Twitter Identity Provider and your new data. It replaces the existing Twitter Identity Provider with your new data. Utilize the `PATCH` HTTP method to send specific changes to merge into an existing Twitter Identity Provider. ### Request[#](#request-2) Update a Twitter Identity Provider by Id PUT/api/identity-provider/{identityProviderId} OpenAPI Spec PATCH/api/identity-provider/{identityProviderId} OpenAPI Spec For backward compatibility, the `PATCH` method accepts the same media type (specified by a `Content-Type` of `application/json`) and body as the `PUT` request. You can also use the following media types for different behavior: * [JSON Patch/RFC 6902](https://www.rfc-editor.org/rfc/rfc6902): `application/json-patch+json` * [JSON Merge Patch/RFC 7396](https://www.rfc-editor.org/rfc/rfc7396): `merge-patch+json` For details, see the [PATCH documentation](/docs/apis/#the-patch-http-method). Using a media type of `application/json` merges the provided request parameters into the existing object. As a result, all parameters are optional with `PATCH`: only provide the values you want to change. To remove a value, provide a `null` value. Patching an `Array` appends all values in the new list to the old list. Update a Twitter Identity Provider by type (deprecated) PUT/api/identity-provider?type=Twitter PATCH/api/identity-provider?type=Twitter For backward compatibility, the `PATCH` method accepts the same media type (specified by a `Content-Type` of `application/json`) and body as the `PUT` request. You can also use the following media types for different behavior: * [JSON Patch/RFC 6902](https://www.rfc-editor.org/rfc/rfc6902): `application/json-patch+json` * [JSON Merge Patch/RFC 7396](https://www.rfc-editor.org/rfc/rfc7396): `merge-patch+json` For details, see the [PATCH documentation](/docs/apis/#the-patch-http-method). Using a media type of `application/json` merges the provided request parameters into the existing object. As a result, all parameters are optional with `PATCH`: only provide the values you want to change. To remove a value, provide a `null` value. Patching an `Array` appends all values in the new list to the old list. Deprecated since 1.61.0 Prefer updating by Id. Updating by type attempts to update the Identity Provider with the legacy fixed Id `45bb233c-0901-4236-b5ca-ac46e2e0a5a5`. #### Request Parameters[#](#request-parameters-2) `identityProviderId`UUIDrequiredImmutable The unique Id of the Twitter Identity Provider to update. #### Request Body[#](#request-body) `identityProvider.applicationConfiguration`Mapoptional The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].buttonText`Stringoptional This is an optional Application specific override for the top level **buttonText**. `identityProvider.applicationConfiguration[applicationId].consumerKey`Stringoptional This is an optional Application specific override for the top level **consumerKey**. `identityProvider.applicationConfiguration[applicationId].consumerSecret`Stringoptional This is an optional Application specific override for the top level **consumerSecret**. `identityProvider.applicationConfiguration[applicationId].createRegistration`BooleanoptionalDefaults to true Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`BooleanoptionalDefaults to false Determines if this identity provider is enabled for the Application specified by the `applicationId` key. `identityProvider.buttonText`Stringrequired The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.consumerKey`Stringrequired The top-level consumer key to use with the Twitter Identity Provider. This value is retrieved from the Twitter developer website when you setup your Twitter developer account. `identityProvider.consumerSecret`Stringrequired The top-level consumer secret to use with the Twitter Identity Provider. This value is retrieved from the Twitter developer website when you setup your Twitter developer account. `identityProvider.attributeMappings`MapoptionalAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and must begin with `user.` or `registration.`. Each value is the source expression in the identity provider response payload. A dot-notated value such as `email` or `id_token.given_name` is converted to a JSON Pointer. A value that starts with `/` is treated as a JSON Pointer as-is. This property cannot be used with `identityProvider.lambdaConfiguration.reconcileId`. This property is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. This property defaults to an empty map. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored. Mappings to `user.password` do not set a password. `identityProvider.debug`BooleanoptionalDefaults to false Determines if debug is enabled for this provider. When enabled, an Event Log is created each time this provider is invoked to reconcile a login. This is useful for debugging purposes, but is not intended to be left on during production. It should be enabled during integration or if you are experiencing an issue with this identity provider. `identityProvider.enabled`BooleanoptionalDefaults to false Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.lambdaConfiguration.reconcileId`UUIDoptionalAvailable since 1.17.0 The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user. The specified Lambda Id must be of type `TwitterReconcile` `identityProvider.linkingStrategy`Stringoptional The linking strategy to use when creating the link between the Identity Provider and the user. Available since 1.65.0 You can **only** change this value when the identity provider is **disabled**. To change the linking strategy for an identity provider that is already enabled, disable the provider, change the value, and then re-enable the provider. The possible values are: * `CreatePendingLink` - Do not automatically link, instead return a pending link identifier that can be used to link to an existing user. * `Disabled` - Disables linking automatically. You must use the API to create links. Available since 1.37.0 * `LinkAnonymously` - Always create a link based upon the unique Id returned by the identify provider. A username or email is not required and will not be used to link the user. A reconcile lambda will not be used in this configuration. * `LinkByEmail` - Link to an existing user based upon email. A user will be created with the email returned by the identity provider if one does not already exist. * `LinkByEmailForExistingUser` - Only link to an existing user based upon email. A user will not be created if one does not already exist with email returned by the identity provider. * `LinkByUsername` - Link to an existing user based upon username. A user will be created with the username returned by the identity provider if one does not already exist. * `LinkByUsernameForExistingUser` - Only link to an existing user based upon username. A user will not be created if one does not already exist with username returned by the identity provider. `identityProvider.name`StringoptionalAvailable since 1.61.0 The display name of this provider instance. Required when using a provided **identityProviderId** or **identityProvider.tenantId**. `identityProvider.source`StringoptionalDefaults to SystemAvailable since 1.65.0 The source of this Identity Provider. The maximum length is `191` characters. This value is only used on create. If provided on update, it is ignored and the existing value is preserved. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDoptionalAvailable since 1.62.0 The unique Id of the Tenant. Providing a value creates an identity provider scoped to the specified tenant, otherwise a global identity provider is created. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. Global identity providers can be used with any tenant. This value is read-only once the identity provider is created. `identityProvider.type`Stringrequired This field must be set to `Twitter`. *Example Twitter Request JSON* ``` { "identityProvider": { "applicationConfiguration": { "1c212e59-0d0e-6b1a-ad48-f4f92793be32": { "createRegistration": true, "enabled": true } }, "buttonText": "Login with Twitter", "consumerKey": "24iuleLRKIZUNhxuuUK6yDZwb", "consumerSecret": "e2ZpAaAfxv2j9eeh6JTeNcXMWdVLjRNriXm4wSZt1f1Ss3Syp4", "name": "Twitter Provider", "debug": false, "enabled": true, "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "Twitter" } } ``` ### Response[#](#response-2) The response for this API contains a Twitter Identity Provider. *Response Codes* | Code | Description | | --- | --- | | 200 | The request was successful. The response will contain a JSON body. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. | | 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](/docs/apis/authentication). | | 404 | The object you are trying to update doesn't exist. The response will be empty. | | 409 | A conflict was encountered processing this request. If the response has a general error code of `[retryableConflict]`, then the client should exponentially backoff and retry the request. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | #### Response Body[#](#response-body) `identityProvider.applicationConfiguration`Map The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].buttonText`String This is an optional Application specific override for the top level **buttonText**. `identityProvider.applicationConfiguration[applicationId].consumerKey`String This is an optional Application specific override for the top level **consumerKey**. `identityProvider.applicationConfiguration[applicationId].consumerSecret`String This is an optional Application specific override for the top level **consumerSecret**. `identityProvider.applicationConfiguration[applicationId].createRegistration`Boolean Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`Boolean Determines if this identity provider is enabled for the Application specified by the `applicationId` key. `identityProvider.buttonText`String The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.consumerKey`String The top-level consumer key to use with the Twitter Identity Provider. This value is retrieved from the Twitter developer website when you setup your Twitter developer account. `identityProvider.consumerSecret`String The top-level consumer secret to use with the Twitter Identity Provider. This value is retrieved from the Twitter developer website when you setup your Twitter developer account. `identityProvider.attributeMappings`MapAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and begins with `user.` or `registration.`. Each value is the source expression from the identity provider response payload. This configuration is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored at runtime. Mappings to `user.password` do not set a password. `identityProvider.debug`BooleanAvailable since 1.7.3 Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created. `identityProvider.enabled`Boolean Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.id`UUID The Id of the provider. `identityProvider.insertInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was added to the FusionAuth database. `identityProvider.lastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was updated in the FusionAuth database. `identityProvider.lambdaConfiguration.reconcileId`UUIDAvailable since 1.17.0 The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user. `identityProvider.linkingStrategy`StringoptionalDefaults to LinkByEmailAvailable since 1.28.0 The linking strategy to use when creating the link between the Twitter Identity Provider and the user. The possible values are: * `CreatePendingLink` - Create pending link. * `Disabled` - Disables linking automatically. Available since 1.37.0 * `LinkAnonymously` - Anonymous Link. * `LinkByEmail` - Link on email. Create the user if they do not exist. * `LinkByEmailForExistingUser` - Link on email. Do not create the user if they do not exist. * `LinkByUsername` - Link on username. Create the user if they do not exist. * `LinkByUsernameForExistingUser` - Link on username. Do not create the user if they do not exist. `identityProvider.name`String The name of this Twitter identity provider. This is only used for display purposes. `identityProvider.source`StringAvailable since 1.65.0 The source for this Identity Provider. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDAvailable since 1.62.0 The unique Id of the Tenant. This value is present if the identity provider is tenant-scoped. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. This value is read-only once the key is created. `identityProvider.type`String The type of this provider, this field will always be set to `Twitter`. *Example Twitter Response JSON* ``` { "identityProvider": { "applicationConfiguration": { "1c212e59-0d0e-6b1a-ad48-f4f92793be32": { "createRegistration": true, "enabled": true } }, "buttonText": "Login with Twitter", "consumerKey": "24iuleLRKIZUNhxuuUK6yDZwb", "consumerSecret": "e2ZpAaAfxv2j9eeh6JTeNcXMWdVLjRNriXm4wSZt1f1Ss3Syp4", "debug": false, "enabled": true, "id": "c2e7f5d4-9a31-46b8-80c2-5d1a7b3f6e94", "insertInstant": 1595361142909, "lastUpdateInstant": 1595361143101, "name": "Twitter Provider", "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "Twitter" } } ``` ## Delete a Twitter Identity Provider[#](#delete-a-twitter-identity-provider) ### Request[#](#request-3) Delete a Twitter Identity Provider by Id DELETE/api/identity-provider/{identityProviderId} OpenAPI Spec Delete a Twitter Identity Provider by type (deprecated) DELETE/api/identity-provider?type=Twitter Deprecated since 1.61.0 Prefer deleting by Id. Deleting by type attempts to delete the Identity Provider with the legacy fixed Id `45bb233c-0901-4236-b5ca-ac46e2e0a5a5`. ### Response[#](#response-3) This API does not return a JSON response body. *Response Codes* | Code | Description | | --- | --- | | 200 | The request was successful. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. | | 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](/docs/apis/authentication). | | 404 | The object you requested doesn't exist. The response will be empty. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | ## Complete the Twitter Login[#](#complete-the-twitter-login) This API allows you to complete a Twitter login after authenticating a user using the Twitter API. If you are using the FusionAuth login UI with the Twitter button you will not utilize this API directly. This API is intended to be used if you want to build your own login page and you have added the Twitter login button to your own login page and you then need to complete the login with FusionAuth. For example, if you built your own login page, you could add a "Login with Twitter" button and complete the Twitter authentication. When you complete the Twitter authentication you will have been returned tokens from Twitter. Using this API you can pass that set of tokens to FusionAuth and we will complete the login workflow and reconcile the user to FusionAuth. The user does not need to exist yet in FusionAuth to utilize this API, depending on the configured [linking strategy](/docs/lifecycle/authenticate-users/identity-providers/#linking-strategies). The set of tokens returned from Twitter will be used to retrieve the user's email address or username and if that user does not yet exist in FusionAuth the user may be created. If **createRegistration** has been enabled for this identity provider and the user does not yet have a registration for this application, a registration will be automatically created for the user. The user will be assigned any default roles configured for the application. If **createRegistration** has not been enabled, a registration will not be created if one does not yet exist. This is useful if you wish to manually provision users and then subsequently allow them to login with Twitter. ### Request[#](#request-4) Complete Twitter Login POST/api/identity-provider/login OpenAPI Spec #### Request Headers[#](#request-headers) `X-Forwarded-For`Stringoptional The IP address of a client requesting authentication. If the IP address is provided it will be stored in the user's login record. It is generally preferred to specify the IP address in the request body. If it is not provided in the request body this header value will be used if available. However, the request body value takes precedence. `X-FusionAuth-TenantId`Stringoptional The unique Id of the tenant used to scope this API request. The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required. Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result. See [Making an API request using a Tenant Id](/docs/apis/authentication#making-an-api-request-using-a-tenant-id) for additional information. #### Request Body `applicationId`UUIDrequired The Id of the Application the user is to be logged into. This application must have Twitter login enabled for this request to succeed. `data.oauth_token`Stringrequired The Twitter OAuth token returned from their login API. This token will be sent to the Twitter OAuth Access Token API as the `oauth_token` parameter. Available since 1.25.0 If this value is an access token then it will not be sent to the Twitter OAuth Access Token API, and instead be directly used to call the Twitter Verify Credentials API to obtain user details. See notes in **oauth\_verifier**. `data.oauth_token_secret`Stringrequired The Twitter OAuth token secret returned from their login API. This token will be used to sign the request to the OAuth Access Token API. Available since 1.25.0 If this value is an access token then it will not be sent to the Twitter OAuth Access Token API, and instead be directly used to call the Twitter Verify Credentials API to obtain user details. See notes in **oauth\_verifier**. `data.oauth_verifier`Stringrequired The Twitter OAuth verifier returned from their login API. This token will be sent to the Twitter OAuth Access Token API in the request body as the `oauth_verifier` parameter. Available since 1.25.0 You may optionally omit the **`oauth_verifier`** field if the values for **`oauth_token`** and **`oauth_token_secret`** are an access token. This allows for a use case where you are not using the FusionAuth themed login pages and you have integrated the Twitter login using this API and prior to calling FusionAuth you have already exchanged these values for a Twitter access token. In this scenario, you may take these two parameters representing the access token and FusionAuth will still complete the login for you by skipping the request to exchange the request token for an access token. `identityProviderId`UUIDrequired The unique Id of the identity provider to process this login request. `connectionTestId`StringoptionalAvailable since 1.65.0 The Id of an identity provider connection test returned by the [Start an Identity Provider Connection Test](/docs/apis/identity-providers/test#start-an-identity-provider-connection-test) API. `ipAddress`Stringoptional The IP address of the end-user that is logging into FusionAuth. If this value is omitted FusionAuth will attempt to obtain the IP address of the client, the value will be that of the `X-Forwarded-For` header if provided or the last proxy that sent the request. The IP address will be stored in the User login history. `metaData.device.description`Stringoptional A human readable description of the device represented by the `device` parameter. `metaData.device.lastAccessedAddress`Stringoptional The IP address of this login request. `metaData.device.name`Stringoptional A human readable name of the device represented by the `device` parameter. `metaData.device.type`Stringoptional The type of device represented by the `device` parameter. Prior to version `1.46.0`, this value was restricted to the following types: * `BROWSER` * `DESKTOP` * `LAPTOP` * `MOBILE` * `OTHER` * `SERVER` * `TABLET` * `TV` * `UNKNOWN` In version `1.46.0` and beyond, this value can be any string value you'd like, have fun with it! `newDevice`BooleanoptionalDefaults to false Indicates that this device has never been used by this user to log in before. One of many signals used to decide whether to issue an MFA challenge as part of [Intelligent MFA](/docs/lifecycle/authenticate-users/contextual-multi-factor#intelligent-mfa) or the [MFA Requirement Lambda](/docs/extend/code/lambdas/mfa-requirement). When `true`, triggers the [New Device Webhook](/docs/extend/events-and-webhooks/events/user/login/user-login-new-device). `noJWT`BooleanoptionalDefaults to false When this value is set to true a JWT will not be issued as part of this request. The response body will not contain the `token` field, and the `access_token` and `refresh_token` cookies will not be written to the HTTP response. This optional parameter may be helpful when performing high volume authentication requests and the JWT is not being used, in this scenario removing the additional latency required to issue and sign the JWT may have a measurable cumulative effect on performance. `noLink`BooleanoptionalDefaults to falseAvailable since 1.29.0 When this value is set to `true`, if a link does not yet exist to a FusionAuth user, a `404` status code will be returned instead of using the requested linking strategy. This may be useful if you want to identify if a link exists before starting a full interactive workflow with the user to complete a link. *Example Request JSON* ``` { "applicationId": "10000000-0000-0002-0000-000000000001", "data": { "oauth_token": "1179659262-VUvqmPjPcGC9BxwHdVxMGs0ka5Gmz91G0svPp2Z", "oauth_token_secret": "9oWLhYVg2fQ4ZmAWPEB0gSnE6tWSVpLRfGlFA6IUwB2Jh", "oauth_verifier": "uw7NjWHT6OJ1MpJOXsHfNxoAhPKpgI8BlYDhxEjIBY" }, "identityProviderId": "45bb233c-0901-4236-b5ca-ac46e2e0a5a5", "ipAddress": "192.168.1.42" } ``` ### Response[#](#response-4) The response for this API contains the User object. *Response Codes* | Code | Description | | --- | --- | | 200 | The authentication was successful. The response will contain the User object that was authenticated. | | 202 | The user was authenticated successfully. The user is not registered for the application specified by `applicationId` on the request. The response will contain the User object that was authenticated. | | 203 | The user was authenticated successfully. The user is required to change their password, the response will contain the `changePasswordId` to be used on the [Change Password](/docs/apis/users/change-password) API. *Example Response JSON* ``` { "changePasswordId": "XOgai4Ro68xfGiex0ngXiJ2bbhduM4Pm7h3lvF0xibQ", "changePasswordReason": "Expired" } ``` | | 204 | The login is pending action by the end user. Wait and try the request again. | | 212 | The user's email address has not yet been verified. The response will contain the User object that was authenticated. If the verification strategy has been set to `FormField`, the response will contain the **emailVerificationId** that was generated for the user. | | 213 | The user's registration has not yet been verified. The response will contain the User object that was authenticated. If the verification strategy has been set to `FormField`, the response will contain the **registrationVerificationId** that was generated for the user. Prior to version `1.27.0`, this status code was not returned, and you will see a `200` instead. | | 232 | The user is completing a login with an Identity Provider configured to use the `Create a pending link` linking strategy and this user does not have a link established. The API response will only contain the `pendingIdPLinkId` and, possibly, `threatsDetected`. A call to the Link API's [Complete a Pending Link](/docs/apis/identity-providers/links#complete-a-pending-link) endpoint is required. Once the user is linked, calling this API again will allow login to succeed. *Example Response JSON* ``` { "pendingIdPLinkId": "0TxfELqDE0d2Y6PqCkztz4o-lXdRyAscAXh8EAyRZsx" } ``` | | 242 | The user was authenticated successfully. The user has two-factor authentication enabled. Since version `1.42.0`, this status code is also returned when two-factor authentication is required. The response will contain the `twoFactorId` to be used on the [Complete Two-Factor Authentication](/docs/apis/login/complete-mfa). *Example Response JSON* ``` { "methods": [ { "authenticator": { "algorithm": "HmacSHA1", "codeLength": 6, "timeStep": 30 }, "id": "2KSZ", "method": "authenticator" }, { "email": "richard@fusionauth.io", "id": "KLRT", "method": "email" } ], "twoFactorId": "YkQY5Gsyo4RlfmDciBGRmvfj3RmatUqrbjoIZ19fmw4" } ``` | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. | | 401 | Unable to complete the login request. The user cannot be reconciled or logged in using the external identity provider. | | 404 | The user was not found, the password was incorrect, the linking strategy is set to `disabled`, or the value `noLink: true` is passed on the linking request. The response will be empty. | | 409 | The user is currently in an action that has prevented login. The response will contain the actions that prevented login. *Example Response JSON* ``` { "actions": [ { "actionId": "00000000-0000-0000-0000-000000000042", "actionerUserId": "00000000-0000-0001-0000-000000000000", "expiry": 1571786483322, "localizedName": "Prevent Login Action", "localizedReason": "Hard Lock", "name": "Prevent Login Action", "reason": "Hard Lock", "reasonCode": "hard_lock" } ] } ``` | | 410 | The user has expired. The response will be empty. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | | 503 | The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body. | | 504 | One or more Webhook endpoints returned an invalid response or were unreachable. Based on the transaction configuration for this event your action cannot be completed. A stack trace is provided and logged in the FusionAuth log files. | #### Response Body[#](#response-body) `emailVerificationId`String An email verification Id, which is needed when performing your own email verification using the `/api/user/verify-email` API. This field is only returned when the **tenant.emailConfiguration.verificationStrategy** is set to `FormField`. `identityVerificationId`StringAvailable since 1.59.0 An identity verification Id, which is needed when performing your own identity verification using the `/api/identity/verify` API. This field is only returned under the following conditions, based on the identity that was used to log in: * An email address - the **tenant.emailConfiguration.verificationStrategy** is set to `FormField`. * A phone number - the **tenant.phoneConfiguration.verificationStrategy** is set to `FormField`. `pendingIdPLinkId`StringAvailable since 1.28.0 The pending identity provider link Id. This value is created when logging in with an identity provider configured with a linking strategy of `Create a pending link`. It will only be included in the response body when this strategy is configured and a link does not yet exist for the user. It is used in conjunction with the [Link APIs](/docs/apis/identity-providers/links) to complete a pending link. `refreshToken`String The refresh token that can be used to obtain a new access token once the provided one has expired. Because a refresh token is per user and per application, this value will only be returned when an **applicationId** was provided on the login request and the user is registered to the application. You must explicitly allow generation of refresh tokens when using the Login API. Configure the **application.loginConfiguration.generateRefreshTokens** setting via the API or enable the setting by navigating to the Application -> My Application -> Security tab. `refreshTokenId`StringAvailable since 1.37.0 When the **refreshToken** is returned in the response, this field will also be returned. This unique Id is the persistent identifier for this refresh token, and will not change even when using one-time use refresh tokens. This value may optionally be used to revoke the token using the [Refresh Token API](/docs/apis/jwt/revoke-refresh-tokens). `state`Object If authenticated using a One Time Password and **state** was provided during the Change Password request this value will be returned exactly as it was provided. `token`StringAvailable since 1.16.0 The access token, this string is an encoded JSON Web Token (JWT). When the user will be sent a setup password email or sms message, this token will not be returned. `tokenExpirationInstant`LongAvailable since 1.33.0 The [instant](/docs/reference/data-types#instants) the **token** will expire. If the response does not contain a **token**, this field will also be omitted from the response. `user.active`Boolean True if the User is active. False if the User has been deactivated. Deactivated Users will not be able to log in. `user.birthDate`String The User's birthdate formatted as `YYYY-MM-DD` `user.breachedPasswordLastCheckedInstant`Long The [instant](/docs/reference/data-types#instants) this user's password was last checked to determine if it is compromised. `user.connectorId`UUIDAvailable since 1.18.0 The unique Id of the [Connector](/docs/lifecycle/migrate-users/connectors/) associated with the System of Record being used to authenticate the user. `user.cleanSpeakId`UUID This Id is used by FusionAuth when the User's username is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the **content Id** of the username inside CleanSpeak. `user.data`Object An object that can hold any information about the User that should be persisted. `user.data.email`String This field will be used as the email address if no **user.email** field is found. This feature was removed in version 1.26.0 and added back in 1.27.2. `user.email`String The User's email address. `user.expiry`Long The expiration [instant](/docs/reference/data-types#instants) of the User's account. An expired user is not permitted to log in. `user.firstName`String The first name of the User. `user.fullName`String The User's full name as a separate field that is not calculated from **firstName** and **lastName**. `user.id`UUID The User's unique Id. `user.identities`ArrayAvailable since 1.59.0 The list of identities that exist for a User. `user.identities[x].displayValue`StringAvailable since 1.59.0 The display value for the identity. Only used for `username` type identities. If the unique username feature is not enabled, this value will be the same as **user.identities\[x\].value**. Otherwise, it will be the username the User has chosen. For primary username identities, this will be the same value as **user.username**. `user.identities[x].insertInstant`LongAvailable since 1.59.0 The [instant](/docs/reference/data-types#instants) when the identity was created. `user.identities[x].lastLoginInstant`LongAvailable since 1.59.0 The [instant](/docs/reference/data-types#instants) when the identity was last used to log in. If a User has multiple identity types (`username`, `email`, and `phoneNumber`), then this value will represent the specific identity they last used to log in. This contrasts with **user.lastLoginInstant**, which represents the last time any of the User's identities was used to log in. Identity provider logins will not be reflected here (see **user.lastLoginInstant** for a field that includes identity provider logins). `user.identities[x].lastUpdateInstant`LongAvailable since 1.59.0 The [instant](/docs/reference/data-types#instants) when the identity was last updated. `user.identities[x].moderationStatus`StringAvailable since 1.59.0 The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are: * `ACTIVE` - the username is active * `PENDING` - the username is pending approval/moderation * `REJECTED` - the username was rejected during moderation If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again. Only used for `username` type identities. For primary username identities, this will be the same value as **user.usernameStatus**. `user.identities[x].type`StringAvailable since 1.59.0 The identity type. The possible values are: * `email` - identities defined by an email address * `phoneNumber` - identities defined by a phone number * `username` - identities defined by a username `user.identities[x].value`StringAvailable since 1.59.0 The value represented by the identity. The contents of this field depend on **user.identities\[x\].type**and will be one of the following: * Email address - The User's email address, always lower cased. For primary email identities, this will be the same value as **user.email** * Phone number - The User's phone number, in E.164 canonical format. For primary phone number identities, this will be the same value as **user.phoneNumber** * Username - User's username - this will be the same as **user.identities\[x\].displayValue**. For primary username identities, this will be the same value as **user.username** This value is unique within a tenant for a particular **user.identities\[x\].type**. If the unique usernames feature is enabled, `value` will be the unique username (within the tenant). For primary username identities, this will also be the same value as **user.uniqueUsername**. `user.identities[x].verified`BooleanAvailable since 1.59.0 Whether verification was actually performed on the identity by FusionAuth. This is used in combination with the **user.identities\[x\].verifiedReason** to decide whether an identity needs verification. `user.identities[x].verifiedInstant`LongAvailable since 1.59.0 The [instant](/docs/reference/data-types#instants) when verification was performed on the identity. This field is only populated when verification was actually performed on the identity by FusionAuth. `user.identities[x].verifiedReason`StringAvailable since 1.59.0 The reason the User's identity was verified or not verified. The possible values are: * `Skipped` - Verification was skipped due to the `skipVerification` parameter on the request * `Trusted` - Identity was created via an identity provider or a connector * `Unverifiable` - FusionAuth doesn't know how to verify this identity type. Usernames are an example * `Implicit` - Verification was implicitly performed by sending a set password or passwordless message * `Pending` - Tenant policy requires verification but no verification has been performed yet * `Completed` - Verification was performed by FusionAuth * `Disabled` - Tenant policy did not require verification * `Import` - User was imported so verification was not performed by FusionAuth If this field is `Disabled`, `Import`, `Skipped`, `Trusted`, or `Unverifiable`, then verification will not be required, regardless of the **user.identities\[x\].verified** value. For `Implicit`, `Pending`, or `Completed`, the identity will require verification if **user.identities\[x\].verified** is false. `user.imageUrl`String The URL that points to an image file that is the User's profile image. `user.insertInstant`Long The [instant](/docs/reference/data-types#instants) when the user was created. `user.lastLoginInstant`Long The [instant](/docs/reference/data-types#instants) when the User logged in last. See **user.identities\[x\].lastLoginInstant** for more granular information based on identity. `user.lastName`String The User's last name. `user.lastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) when the User was last updated. `user.legacyIdentifier`StringAvailable since 1.67 Used to override the `sub` claim in tokens issued by the Legacy Identity Provider Adapter. This value is immutable after the user is created and is unique within the tenant when non-null. `user.memberships`Array The list of memberships for the User. `user.memberships[x].data`Object An object that can hold any information about the User for this membership that should be persisted. `user.memberships[x].groupId`UUID The Id of the Group of this membership. `user.memberships[x].id`UUID The unique Id of this membership. `user.memberships[x].insertInstant`Long The [instant](/docs/reference/data-types#instants) that the membership was created. `user.middleName`String The User's middle name. `user.mobilePhone`String The User's mobile phone number. This is useful if you will be sending push notifications or SMS messages to the User. This differs from **user.phoneNumber** and cannot be used to log in. `user.parentEmail`StringAvailable since 1.7.0 The email address of the user's parent or guardian. If this value was provided during a create or update operation, this value will only remain until the child is claimed by a parent. `user.passwordChangeRequired`Boolean Indicates that the User's password needs to be changed during their next login attempt. `user.passwordLastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) that the User last changed their password. Since version 1.59.0, if a user does not currently have a password, this field will not be returned in the response. `user.phoneNumber`StringAvailable since 1.59.0 The User's primary phone number. The phone number is stored and returned in E.164 canonical format, however a phone number is considered unique regardless of the format. `303-555-1212` is considered equal to `+13035551212` so either version of this phone number can be used whenever providing it as input to an API. This differs from **user.mobilePhone** in that **user.phoneNumber** can be used to log in, just like an email address or a username. `user.preferredLanguages`Array An array of locale strings that give, in order, the User's preferred languages. These are important for email templates and other localizable text. See [Locales](/docs/reference/data-types#locales). `user.registrations`Array The list of registrations for the User. This will include registrations for inactive applications. `user.registrations[x].applicationId`UUID The Id of the Application that this registration is for. `user.registrations[x].authenticationToken`String The Authentication Token for this registration (if one exists). `user.registrations[x].cleanSpeakId`UUID This Id is used by FusionAuth when the User's username for this registration is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the **content Id** of the username inside CleanSpeak. `user.registrations[x].data`Object An object that can hold any information about the User for this registration that should be persisted. `user.registrations[x].id`UUID The Id of this registration. `user.registrations[x].insertInstant`Long The [instant](/docs/reference/data-types#instants) that this registration was created. `user.registrations[x].lastLoginInstant`Long The [instant](/docs/reference/data-types#instants) that the User last logged into the Application for this registration. `user.registrations[x].preferredLanguages`Array An array of locale strings that give, in order, the User's preferred languages for this registration. These are important for email templates and other localizable text. `user.registrations[x].roles`Array The list of roles that the User has for this registration. The string is the role's `Name` not the role's `Id`, e.g. `admin` or `user-role`. `user.registrations[x].timezone`String The User's preferred timezone for this registration. The string will be in an [IANA](https://www.iana.org/time-zones) time zone format. `user.registrations[x].tokens`Map