System APIs - Home - FusionAuth

1. Overview

This page contains the APIs that are used for retrieving and updating the system configuration.

Retrieve the System Configuration
Update the System Configuration

The following APIs provide a subset of the System Configuration without an API Key.

Retrieve the Password Validation Rules

2. Retrieve the System Configuration

This API is used to retrieve the System Configuration.

2.1. Request

Retrieve the System Configuration

URI

GET /api/system-configuration

2.2. Response

The response for this API contains the System Configuration.

Table 1. Response Codes
Code	Description
200	The request was successful. The response will contain a JSON body.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Table 2. Response Body
systemConfiguration.auditLogConfiguration.delete.enabled [Boolean] Available Since 1.7.0	Whether or not FusionAuth should delete the Audit Log based upon this configuration. When `true` the auditLogConfiguration.delete.numberOfDaysToRetain will be used to identify audit logs that are eligible for deletion. When this value is set to `false` audit logs will be preserved forever.
systemConfiguration.auditLogConfiguration.delete.numberOfDaysToRetain [Integer] Available Since 1.7.0	The number of days to retain the Audit Log.
systemConfiguration.cookieEncryptionIV [String]	The Base64 encoded initialization vector used to encrypt saved request cookies for FusionAuth. This value has been auto-generated and may not be modified.
systemConfiguration.cookieEncryptionKey [String]	The Base64 encoded encryption key used to encrypt saved request cookies for FusionAuth. This value has been auto-generated and may not be modified.
systemConfiguration.corsConfiguration.allowCredentials [Boolean] Available Since 1.8.0	The `Access-Control-Allow-Credentials` response header values as described by MDN Access-Control-Allow-Credentials.
systemConfiguration.corsConfiguration.allowedHeaders [Array<String>] Available Since 1.8.0	The `Access-Control-Allow-Headers` response header values as described by MDN Access-Control-Allow-Headers.
systemConfiguration.corsConfiguration.allowedMethods [Array<String>] Available Since 1.8.0	The `Access-Control-Allow-Methods` response header values as described by MDN Access-Control-Allow-Methods. The possible values are: `GET` `POST` `PUT` `DELETE` `HEAD` `OPTIONS`
systemConfiguration.corsConfiguration.allowedOrigins [Array<String>] Available Since 1.8.0	The `Access-Control-Allow-Origin` response header values as described by MDN Access-Control-Allow-Origin. If the wildcard `*` is specified, no additional domains may be specified.
systemConfiguration.corsConfiguration.enabled [Boolean] Available Since 1.8.0	Whether the FusionAuth CORS filter will process requests made to FusionAuth.
systemConfiguration.corsConfiguration.exposedHeaders [Array<String>] Available Since 1.8.0	The `Access-Control-Expose-Headers` response header values as described by MDN Access-Control-Expose-Headers.
systemConfiguration.corsConfiguration.preflightMaxAgeInSeconds [Integer] Available Since 1.8.0	The `Access-Control-Max-Age` response header values as described by MDN Access-Control-Max-Age.
systemConfiguration.emailConfiguration.enabled [Boolean] Deprecated	Indicates that the SMTP email configuration is available for use by FusionAuth. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.host [String] Deprecated	The host name of the SMTP server that FusionAuth will use. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.forgotPasswordEmailTemplateId [UUID] Deprecated	The Id of the Email Template that is used when a user is sent a forgot password email. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.password [String] Deprecated	An optional password FusionAuth will use to authenticate with the SMTP server. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.port [Integer] Deprecated	The port of the SMTP server that FusionAuth will use. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.security String Deprecated	The type of security protocol FusionAuth will use when connecting to the SMTP server. The possible values are: `NONE` - no security will be used. All communications will be sent plaintext. `SSL` - SSL will be used to connect to the SMTP server. This protocol is not recommended unless it is the only one your SMTP server supports. `TLS` - TLS will be used to connect to the SMTP server. This is the preferred protocol for all SMTP servers. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.setPasswordEmailTemplateId [UUID] Deprecated	The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.username [String] Deprecated	An optional username FusionAuth will to authenticate with the SMTP server. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.verificationEmailTemplateId [UUID] Deprecated	The Id of the Email Template that is used to send the verification emails to users. These emails are used to verify that a user’s email address is valid. If the `verifyEmail` field is `true` this field is required. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.verifyEmail [Boolean] Deprecated	Whether or not user’s email addresses are verified when the register with your application. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.verifyEmailWhenChanged [Boolean] Deprecated	Whether or not user’s email addresses are verified when the user changes them. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.eventConfiguration.events [Object]	A mapping of the configuration for each event type that FusionAuth sends. The event types that are the keys into this Object are: `user.action` - When a user action is triggered `user.bulk.create` - When multiple users are created in bulk (i.e. during an import) `user.create` - When a user is created `user.email.verified` - When a user verifies their email address `user.update` - When a user is updated `user.deactivate` - When a user is deactivated `user.reactivate` - When a user is reactivated `user.login.success` - When a user completes a login request `user.login.failed` - When a user fails a login request `user.registration.create` - When a user registration is created `user.registration.update` - When a user registration is updated `user.registration.delete` - When a user registration is deleted `user.registration.verified` - When a user completes registration verification `user.delete` - When a user is deleted `jwt.public-key.update` - When a JWT RSA Public / Private keypair may have been changed `jwt.refresh-token.revoke` - When a JWT Refresh Token is revoked
systemConfiguration.eventConfiguration.events`[type]`.enabled [Boolean]	Whether or not FusionAuth should send these types of events to any configured Webhooks.
systemConfiguration.eventConfiguration.events`[type]`.transactionType String	The transaction type that FusionAuth uses when sending these types of events to any configured Webhooks. The transaction types are: `None` - No Webhooks are required to succeed for the FusionAuth transaction to be committed. `Any` - Only a single Webhook is required to succeed for the FusionAuth transaction to be committed. `SimpleMajority` - A simple majority (50% or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed. `SuperMajority` - A super majority (2/3 or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed. `AbsoluteMajority` - Every Webhook must succeed for the FusionAuth transaction to be committed.
systemConfiguration.eventLogConfiguration.numberToRetain [Integer] Available Since 1.7.0	The number of events to retain. Once the the number of event logs exceeds this configured value they will be deleted starting with the oldest event logs.
systemConfiguration.externalIdentifierConfiguration.authorizationGrantIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until a OAuth authorization code in no longer valid to be exchanged for an access token. This is essentially the time allowed between the start of an Authorization request during the Authorization code grant and when you request an access token using this authorization code on the Token endpoint. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.changePasswordIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until a change password Id is no longer valid and cannot be used by the Change Password API. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.emailVerificationIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until a email verification Id is no longer valid and cannot be used by the Verify Email API. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.registrationVerificationIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until a registration verification Id is no longer valid and cannot be used by the Verify Registration API. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.setupPasswordIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until a setup password Id is no longer valid and cannot be used by the Change Password API. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.twoFactorIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until a two factor Id is no longer valid and cannot be used by the Two Factor Login API. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.twoFactorTrustIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until an issued Two Factor trust Id is no longer valid and the User will be required to complete Two Factor authentication during the next authentication attempt. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.actionDuration [Long] Deprecated	The duration of the User Action. This value along with the `actionDurationUnit` will be used to set the duration of the User Action. Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.actionDurationUnit [String] Deprecated	The unit of time associated with a duration. The possible values are: `MINUTES` `HOURS` `DAYS` `WEEKS` `MONTHS` `YEARS` Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.resetCountInSeconds [Integer] Deprecated	The length of time in seconds before the failed authentication count will be reset. For example, if `tooManyAttempts` is set to `5` and you fail to authenticate `4` times in a row, waiting for the duration specified here will cause your fifth attempt to start back at `1`. Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.tooManyAttempts [Integer] Deprecated	The number of failed attempts considered to be too many. Once this threshold is reached the specified User Action will be applied to the user for the duration specified. Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.userActionId [UUID] Deprecated	The Id of the User Action that is applied when the threshold is reached for too many failed authentication attempts. Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.httpSessionMaxInactiveInterval [Integer]	The time in seconds until an inactive session will be invalidated. Used when creating a new session in the FusionAuth OAuth front-end.
systemConfiguration.issuer [String] Available Since 1.6.0	The name or issuer of the JWT, this is generally something unique such as a fully qualified domain name. This is also used as the default issuer value when generating `Keys`. For example, `fusionauth.io`.
systemConfiguration.jwtConfiguration.accessTokenId [UUID] Available Since 1.6.0	The Id of the signing key used to sign the access token.
systemConfiguration.jwtConfiguration.algorithm [String] Deprecated	The algorithm used to sign the JSON Web Token (JWT). The following available JSON Web Algorithms (JWA) as described in RFC 7518 are available. `ES256` - ECDSA using P-256 curve and SHA-256 Available Since 1.4.0 `ES384` - ECDSA using P-384 curve and SHA-384 Available Since 1.4.0 `ES512` - ECDSA using P-521 curve and SHA-512 Available Since 1.4.0 `HS256` - HMAC using SHA-256 `HS384` - HMAC using SHA-384 `HS512` - HMAC using SHA-512 `RS256` - RSASSA-PKCS1-v1_5 using SHA-256 `RS384` - RSASSA-PKCS1-v1_5 using SHA-384 `RS512` - RSASSA-PKCS1-v1_5 using SHA-512 Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.enabled [Boolean]	This value will always be true. The JWT configuration may not be disabled for the System Configuration.
systemConfiguration.jwtConfiguration.idTokenKeyId [UUID] Available Since 1.6.0	The Id of the signing key used to sign the Id token.
systemConfiguration.jwtConfiguration.issuer [String] Deprecated	The name or issuer of the JWT, this is generally something unique such as a fully qualified domain name. For example, `fusionauth.io`. Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.privateKey [String] Deprecated	The private key used when an `RSA` signing algorithm has been selected. The private key will be used to sign the JWT. This key will be returned in a PEM encoded format. Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.publicKey [String] Deprecated	The public key used when an `RSA` signing algorithms has been selected. The public key will be used to verify JWTs signed with the private key. This key will be returned in a PEM encoded format. Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.refreshTokenTimeToLiveInMinutes [Integer]	The length of time in minutes the JWT refresh token will live before it is expired and is not able to be exchanged for a JWT.
systemConfiguration.jwtConfiguration.secret [String] Deprecated	The secret used when an `HMAC` based signing algorithm has been selected. This secret is used to sign and verify JWTs. Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.timeToLiveInSeconds [Integer]	The length of time in seconds the JWT will live before it is expired. This value is used to calculate the `exp` (expiration) identity claim.
systemConfiguration.loginRecordConfiguration.delete.enabled [Boolean] Available Since 1.7.0	Whether or not FusionAuth should delete the login records based upon this configuration. When `true` the loginRecordConfiguration.delete.numberOfDaysToRetain will be used to identify login records that are eligible for deletion. When this value is set to `false` login records will be preserved forever.
systemConfiguration.loginRecordConfiguration.delete.numberOfDaysToRetain [Integer] Available Since 1.7.0	The number of days to retain login records.
systemConfiguration.logoutURL [String]	The logout redirect URL when sending the user’s browser to the `/oauth2/logout` URI of the FusionAuth Front End. This value is only used when a logout URL is not defined in your Application.
systemConfiguration.maximumPasswordAge.days [Integer] Deprecated	The password maximum age in days. The number of days after which FusionAuth will require a user to change their password. Removed in version 1.8.0 In version 1.8.0 and beyond, password age settings are managed per `Tenant`.
systemConfiguration.maximumPasswordAge.enabled [Boolean] Deprecated	Indicates that the maximum password age is enabled and being enforced. Removed in version 1.8.0 In version 1.8.0 and beyond, password age settings are managed per `Tenant`.
systemConfiguration.minimumPasswordAge.seconds [Integer] Deprecated	The password minimum age in seconds. When enabled FusionAuth will not allow a password to be changed until it reaches this minimum age. Removed in version 1.8.0 In version 1.8.0 and beyond, password age settings are managed per `Tenant`.
systemConfiguration.minimumPasswordAge.enabled [Boolean] Deprecated	Indicates that the minimum password age is enabled and being enforced. Removed in version 1.8.0 In version 1.8.0 and beyond, password age settings are managed per `Tenant`.
systemConfiguration.passwordEncryptionConfiguration.encryptionScheme [String] Deprecated	The selected default encryption scheme. Removed in version 1.8.0 In version 1.8.0 and beyond, password encryption configuration is managed per `Tenant`.
systemConfiguration.passwordEncryptionConfiguration.encryptionSchemeFactor [String] Deprecated	The factor used by the password encryption scheme. Generally this will be used as an iteration count to generate the hash. The actual use of this value is up to the `PasswordEncryptor` implementation. Removed in version 1.8.0 In version 1.8.0 and beyond, password encryption configuration is managed per `Tenant`.
systemConfiguration.passwordEncryptionConfiguration.modifyEncryptionSchemeOnLogin [Boolean] Deprecated	When enabled a user’s hash configuration will be modified to match these configured settings. Removed in version 1.8.0 In version 1.8.0 and beyond, password encryption configuration is managed per `Tenant`.
systemConfiguration.passwordValidationRules.maxLength [Integer]	The maximum number of characters that are allowed for user passwords.
systemConfiguration.passwordValidationRules.minLength [Integer]	The minimum number of characters that are required for user passwords.
systemConfiguration.passwordValidationRules.rememberPreviousPasswords.count [Integer]	The number of previous passwords that should be remembered so they are not re-used by the User.
systemConfiguration.passwordValidationRules.rememberPreviousPasswords.enabled [Boolean]	Indicates that the remember previous password validation is enabled and being enforced.
systemConfiguration.passwordValidationRules.requireMixedCase [Boolean]	Indicates that passwords require an uppercase and lowercase character to be valid.
systemConfiguration.passwordValidationRules.requireNonAlpha [Boolean]	Indicates that passwords require a non-alphanumeric character to be valid.
systemConfiguration.passwordValidationRules.requireNumber [Boolean]	Indicates that passwords require at least one number to be valid.
systemConfiguration.reportTimezone [String]	The time zone used to adjust the stored UTC time when generating reports. Since reports are usually rolled up hourly, this timezone will be used for demarcating the hours. For example: `America/Denver` or `US/Mountain`
systemConfiguration.uiConfiguration.headerColor [String]	A hexadecimal color to override the default menu color in the user interface.
systemConfiguration.uiConfiguration.loginTheme.emailComplete [String]	A FreeMarker template that is rendered when the user requests the /email/complete page. This page is used after a user has verified their email address by clicking the URL in the email. After FusionAuth has updated their user object to indicate that their email was verified, the browser is redirected to this page.
systemConfiguration.uiConfiguration.loginTheme.emailSend [String]	A FreeMarker template that is rendered when the user requests the /email/send page. This page is used after a user has asked for the verification email to be resent. This can happen if the URL in the email expired and the user clicked it. In this case, the user can provide their email address again and FusionAuth will resend the email. After the user submits their email and FusionAuth re-sends a verification email to them, the browser is redirected to this page.
systemConfiguration.uiConfiguration.loginTheme.emailVerify [String]	A FreeMarker template that is rendered when the user requests the /email/verify page by clicking the URL from the verification email and the `verificationId` has expired. FusionAuth expires `verificationId` after a period of time (which is configurable). If the user has a URL from the verification email that has expired, this page will be rendered and the error will be displayed to the user.
systemConfiguration.uiConfiguration.loginTheme.enabled [Boolean]	Indicates that the login theme is enabled and will be used to style the login pages.
systemConfiguration.uiConfiguration.loginTheme.helpers [String]	A FreeMarker template that contains all of the macros and templates used by the rest of the `loginTheme` FreeMarker templates (i.e. `oauth2Authorize`). This allows you to configure the general layout of your UI configuration and login theme without having to copy and paste HTML into each of the templates.
systemConfiguration.uiConfiguration.loginTheme.oauth2Authorize [String]	A FreeMarker template that is rendered when the user requests the /oauth2/authorize page. This is the main login page for FusionAuth and is used for all interactive OAuth and OpenId Connect workflows.
systemConfiguration.uiConfiguration.loginTheme.oauth2Error [String]	A FreeMarker template that is rendered when the user requests the /oauth2/error page. This page is used if the user starts or is in the middle of the OAuth workflow and any type of error occurs. This could be caused by the user messing with the URL or internally some type of information wasn’t passed between the OAuth endpoints correctly. For example, if you are federating login to an external IdP and that IdP does not properly echo the `state` parameter, FusionAuth’s OAuth workflow will break and this page will be displayed.
systemConfiguration.uiConfiguration.loginTheme.oauth2TwoFactor [String]	A FreeMarker template that is rendered when the user requests the /oauth2/two-factor page. This page is used if the user has two-factor authentication enabled and they need to type in their code again. FusionAuth will properly handle the SMS or authenticator app processing on the back end. This page contains the form that the user will put their code into.
systemConfiguration.uiConfiguration.loginTheme.passwordChange [String]	A FreeMarker template that is rendered when the user requests the /password/change page. This page is used if the user is required to change their password or if they have requested a password reset. This page contains the form that allows the user to provide a new password.
systemConfiguration.uiConfiguration.loginTheme.passwordComplete [String]	A FreeMarker template that is rendered when the user requests the /password/complete page. This page is used after the user has successfully updated their password (or reset it). This page should instruct the user that their password was updated and that they need to login again.
systemConfiguration.uiConfiguration.loginTheme.passwordForgot [String]	A FreeMarker template that is rendered when the user requests the /password/forgot page. This page is used when a user starts the forgot password workflow. This page renders the form where the user types in their email address.
systemConfiguration.uiConfiguration.loginTheme.passwordSent [String]	A FreeMarker template that is rendered when the user requests the /password/sent page. This page is used when a user has submitted the forgot password form with their email. FusionAuth does not indicate back to the user if their email address was valid in order to prevent malicious activity that could reveal valid email addresses. Therefore, this page should indicate to the user that if their email was valid, they will receive an email shortly with a link to reset their password.
systemConfiguration.uiConfiguration.loginTheme.registrationComplete [String]	A FreeMarker template that is rendered when the user requests the /registration/complete page. This page is used after a user has verified their email address for a specific application (i.e. a user registration) by clicking the URL in the email. After FusionAuth has updated their registration object to indicate that their email was verified, the browser is redirected to this page.
systemConfiguration.uiConfiguration.loginTheme.registrationSend [String]	A FreeMarker template that is rendered when the user requests the /registration/send page. This page is used after a user has asked for the application specific verification email to be resent. This can happen if the URL in the email expired and the user clicked it. In this case, the user can provide their email address again and FusionAuth will resend the email. After the user submits their email and FusionAuth re-sends a verification email to them, the browser is redirected to this page.
systemConfiguration.uiConfiguration.loginTheme.registrationVerify [String]	A FreeMarker template that is rendered when the user requests the /registration/verify page by clicking the URL from the application specific verification email and the `verificationId` has expired. FusionAuth expires `verificationId` after a period of time (which is configurable). If the user has a URL from the verification email that has expired, this page will be rendered and the error will be displayed to the user.
systemConfiguration.uiConfiguration.loginTheme.stylesheet [String]	A CSS stylesheet used to style the login page and other templates such as forgot password, and verify email.
systemConfiguration.uiConfiguration.logoURL [String]	A URL of a logo to override the default FusionAuth logo in the user interface.
systemConfiguration.uiConfiguration.menuFontColor [String]	A hexadecimal color to override the default menu font color in the user interface.

Example Response JSON

{
  "systemConfiguration": {
    "auditLogConfiguration": {
      "delete": {
        "enabled": true,
        "numberOfDaysToRetain": 90
      }
    },
    "cookieEncryptionIV": "aZCGlFQmWHW2OLpLYPC8hw==",
    "cookieEncryptionKey": "spq1hhDHqBR8T5g479QS7w==",
    "corsConfiguration": {
      "allowCredentials": true,
      "allowedHeaders": [
        "Accept",
        "Access-Control-Request-Headers",
        "Access-Control-Request-Method",
        "Authorization",
        "Content-Type",
        "Last-Modified",
        "Origin",
        "X-FusionAuth-TenantId",
        "X-Requested-With"
      ],
      "allowedMethods": [
        "GET",
        "POST",
        "HEAD",
        "OPTIONS",
        "PUT",
        "DELETE"
      ],
      "allowedOrigins": [
        "*"
      ],
      "enabled": true,
      "exposedHeaders": [
        "Access-Control-Allow-Origin",
        "Access-Control-Allow-Credentials"
      ],
      "preflightMaxAgeInSeconds": 1800
    },
    "eventConfiguration": {
      "user.create": {
        "enabled": true,
        "transactionType": "AbsoluteMajority"
      }
    },
    "eventLogConfiguration": {
      "numberToRetain": 10000
    },
    "httpSessionMaxInactiveInterval": 3600,
    "issuer": "https://example.com",
    "jwtConfiguration": {
      "accessTokenKeyId": "025233ca-d4f3-2aa4-eca9-7e4200e9b472",
      "enabled": true,
      "idTokenKeyId": "092dbedc-30af-4149-9c61-b578f2c72f59",
      "refreshTokenTimeToLiveInMinutes": 43200,
      "timeToLiveInSeconds": 3600
    },
    "loginRecordConfiguration": {
      "delete": {
        "enabled": true,
        "numberOfDaysToRetain": 90
      }
    },
    "logoutURL": "http://example.com/logout",
    "passwordValidationRules": {
      "maxLength": 256,
      "minLength": 8,
      "rememberPreviousPasswords": {
        "count": 2,
        "enabled": true
      },
      "requireMixedCase": true,
      "requireNonAlpha": true,
      "requireNumber": true
    },
    "reportTimezone": "America/Denver",
    "uiConfiguration": {
      "loginTheme": {
        "emailComplete": "FreeMarker template goes here ...",
        "emailSend": "FreeMarker template goes here ...",
        "emailVerify": "FreeMarker template goes here ...",
        "enabled": true,
        "lastModified": 1540588216227,
        "helpers": "FreeMarker template goes here ...",
        "oauth2Authorize": "FreeMarker template goes here ...",
        "oauth2Error": "FreeMarker template goes here ...",
        "oauth2TwoFactor": "FreeMarker template goes here ...",
        "passwordChange": "FreeMarker template goes here ...",
        "passwordComplete": "FreeMarker template goes here ...",
        "passwordForgot": "FreeMarker template goes here ...",
        "passwordSent": "FreeMarker template goes here ...",
        "registrationComplete": "FreeMarker template goes here ...",
        "registrationSend": "FreeMarker template goes here ...",
        "registrationVerify": "FreeMarker template goes here ...",
        "stylesheet": "CSS definition goes here ..."
      }
    }
  }
}

3. Update the System Configuration

This API is used to update System Configuration.

3.1. Request

Update the System Configuration

URI

PUT /api/system-configuration

Table 3. Request Body
systemConfiguration.auditLogConfiguration.delete.enabled [Boolean] Optional defaults to `false` Available Since 1.7.0	Whether or not FusionAuth should delete the Audit Log based upon this configuration. When `true` the auditLogConfiguration.delete.numberOfDaysToRetain will be used to identify audit logs that are eligible for deletion. When this value is set to `false` audit logs will be preserved forever.
systemConfiguration.auditLogConfiguration.delete.numberOfDaysToRetain [Integer] Optional Available Since 1.7.0	The number of days to retain the Audit Log. Required when auditLogConfiguration.delete.enabled is set to `true`.
systemConfiguration.corsConfiguration.allowCredentials [Boolean] Optional defaults to `false` Available Since 1.8.0	The `Access-Control-Allow-Credentials` response header values as described by MDN Access-Control-Allow-Credentials.
systemConfiguration.corsConfiguration.allowedHeaders [Array<String>] Optional Available Since 1.8.0	The `Access-Control-Allow-Headers` response header values as described by MDN Access-Control-Allow-Headers.
systemConfiguration.corsConfiguration.allowedMethods [Array<String>] Optional Available Since 1.8.0	The `Access-Control-Allow-Methods` response header values as described by MDN Access-Control-Allow-Methods.
systemConfiguration.corsConfiguration.allowedOrigins [Array<String>] Optional Available Since 1.8.0	The `Access-Control-Allow-Origin` response header values as described by MDN Access-Control-Allow-Origin. If the wildcard `*` is specified, no additional domains may be specified.
systemConfiguration.corsConfiguration.enabled [Boolean] Optional defaults to `false` Available Since 1.8.0	Whether the FusionAuth CORS filter will process requests made to FusionAuth.
systemConfiguration.corsConfiguration.exposedHeaders [Array<String>] Optional Available Since 1.8.0	The `Access-Control-Expose-Headers` response header values as described by MDN Access-Control-Expose-Headers.
systemConfiguration.corsConfiguration.preflightMaxAgeInSeconds [Integer] Optional Available Since 1.8.0	The `Access-Control-Max-Age` response header values as described by MDN Access-Control-Max-Age.
systemConfiguration.emailConfiguration.enabled Optional [Boolean] defaults to `false` Deprecated	Indicates that the SMTP email configuration is available for use by FusionAuth. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.forgotPasswordEmailTemplateId [UUID] Required Deprecated	The Id of the Email Template that is used when a user is sent a forgot password email. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.host [String] Optional Deprecated	The host name of the SMTP server that FusionAuth will use. Required when `systemConfiguration.emailConfiguration.enabled` is set to `true`. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.password [String] Optional Deprecated	An optional password FusionAuth will use to authenticate with the SMTP server. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.port [Integer] Optional Deprecated	The port of the SMTP server that FusionAuth will use. Required when `systemConfiguration.emailConfiguration.enabled` is set to `true`. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.setPasswordEmailTemplateId [UUID] Optional Deprecated	The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.security String Optional defaults to NONE Deprecated	The type of security protocol FusionAuth will use when connecting to the SMTP server. The possible values are: `NONE` - no security will be used. All communications will be sent plaintext. `SSL` - SSL will be used to connect to the SMTP server. This protocol is not recommended unless it is the only one your SMTP server supports. `TLS` - TLS will be used to connect to the SMTP server. This is the preferred protocol for all SMTP servers. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.username [String] Optional Deprecated	An optional username FusionAuth will to authenticate with the SMTP server. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.verificationEmailTemplateId [UUID] Optional Deprecated	The If of the Email Template that is used to send the verification emails to users. These emails are used to verify that a user’s email address is valid. If the `verifyEmail` field is `true` this field is required. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.verifyEmail [Boolean] Optional defaults to `false` Deprecated	Whether or not user’s email addresses are verified when the register with your application. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.verifyEmailWhenChanged [Boolean] Optional defaults to `false` Deprecated	Whether or not user’s email addresses are verified when the user changes them. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.eventConfiguration.events [Object] Optional defaults to {}	A mapping of the configuration for each event type that FusionAuth sends. The event types that are the keys into this Object are: `user.action` - When a user action is triggered `user.bulk.create` - When multiple users are created in bulk (i.e. during an import) `user.create` - When a user is created `user.email.verified` - When a user verifies their email address `user.update` - When a user is updated `user.deactivate` - When a user is deactivated `user.reactivate` - When a user is reactivated `user.login.success` - When a user completes a login request `user.login.failed` - When a user fails a login request `user.registration.create` - When a user registration is created `user.registration.update` - When a user registration is updated `user.registration.delete` - When a user registration is deleted `user.registration.verified` - When a user completes registration verification `user.delete` - When a user is deleted `jwt.public-key.update` - When a JWT RSA Public / Private keypair may have been changed `jwt.refresh-token.revoke` - When a JWT Refresh Token is revoked
systemConfiguration.eventConfiguration.events`[type]`.enabled [Boolean] Optional defaults to `false`	Whether or not FusionAuth should send these types of events to any configured Webhooks.
systemConfiguration.eventConfiguration.events`[type]`.transactionType String Optional	The transaction type that FusionAuth uses when sending these types of events to any configured Webhooks. The transaction types are: `None` - No Webhooks are required to succeed for the FusionAuth transaction to be committed. `Any` - Only a single Webhook is required to succeed for the FusionAuth transaction to be committed. `SimpleMajority` - A simple majority (50% or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed. `SuperMajority` - A super majority (2/3 or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed. `AbsoluteMajority` - Every Webhook must succeed for the FusionAuth transaction to be committed.
systemConfiguration.eventLogConfiguration.numberToRetain [Integer] Optional defaults to `10,000` Available Since 1.7.0	The number of events to retain. Once the the number of event logs exceeds this configured value they will be deleted starting with the oldest event logs.
systemConfiguration.externalIdentifierConfiguration.authorizationGrantIdTimeToLiveInSeconds [Integer] Required Deprecated	The time in seconds until a OAuth authorization code in no longer valid to be exchanged for an access token. This is essentially the time allowed between the start of an Authorization request during the Authorization code grant and when you request an access token using this authorization code on the Token endpoint. Value must be greater than 0 and less than or equal to 600. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.changePasswordIdTimeToLiveInSeconds [Integer] Required Deprecated	The time in seconds until a change password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.emailVerificationIdTimeToLiveInSeconds [Integer] Required Deprecated	The time in seconds until a email verification Id is no longer valid and cannot be used by the Verify Email API. Value must be greater than 0. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.registrationVerificationIdTimeToLiveInSeconds [Integer] Required Deprecated	The time in seconds until a registration verification Id is no longer valid and cannot be used by the Verify Registration API. Value must be greater than 0. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.setupPasswordIdTimeToLiveInSeconds [Integer] Required Deprecated	The time in seconds until a setup password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.twoFactorIdTimeToLiveInSeconds [Integer] Required Deprecated	The time in seconds until a two factor Id is no longer valid and cannot be used by the Two Factor Login API. Value must be greater than 0. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.twoFactorTrustIdTimeToLiveInSeconds [Integer] Required Deprecated	The time in seconds until an issued Two Factor trust Id is no longer valid and the User will be required to complete Two Factor authentication during the next authentication attempt. Value must be greater than 0. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.actionDuration [Long] Deprecated	The duration of the User Action. This value along with the `actionDurationUnit` will be used to set the duration of the User Action. Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.actionDurationUnit [String] Deprecated	The unit of time associated with a duration. The possible values are: `MINUTES` `HOURS` `DAYS` `WEEKS` `MONTHS` `YEARS` Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.resetCountInSeconds [Integer] Deprecated	The length of time in seconds before the failed authentication count will be reset. For example, if `tooManyAttempts` is set to `5` and you fail to authenticate `4` times in a row, waiting for the duration specified here will cause your fifth attempt to start back at `1`. Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.tooManyAttempts [Integer] Deprecated	The number of failed attempts considered to be too many. Once this threshold is reached the specified User Action will be applied to the user for the duration specified. Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.userActionId [UUID] Deprecated	The Id of the User Action that is applied when the threshold is reached for too many failed authentication attempts. Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.httpSessionMaxInactiveInterval [Integer] Required defaults to `60 minutes`	The time in seconds until an inactive session will be invalidated. Used when creating a new session in the FusionAuth Front End.
systemConfiguration.issuer [String] Required Available Since 1.6.0	The name or issuer of the JWT, this is generally something unique such as a fully qualified domain name. This is also used as the default issuer value when generating `Keys`. For example, `fusionauth.io`.
systemConfiguration.jwtConfiguration.accessTokenId [UUID] Required Available Since 1.6.0	The Id of the signing key used to sign the access token.
systemConfiguration.jwtConfiguration.algorithm [String] Required Deprecated	The algorithm used to sign the JSON Web Token (JWT). The following available JSON Web Algorithms (JWA) as described in RFC 7518 are available. `ES256` - ECDSA using P-256 curve and SHA-256 Available Since 1.4.0 `ES384` - ECDSA using P-384 curve and SHA-384 Available Since 1.4.0 `ES512` - ECDSA using P-521 curve and SHA-512 Available Since 1.4.0 `HS256` - HMAC using SHA-256 `HS384` - HMAC using SHA-384 `HS512` - HMAC using SHA-512 `RS256` - RSASSA-PKCS1-v1_5 using SHA-256 `RS384` - RSASSA-PKCS1-v1_5 using SHA-384 `RS512` - RSASSA-PKCS1-v1_5 using SHA-512 Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.idTokenKeyId [UUID] Required Available Since 1.6.0	The Id of the signing key used to sign the Id token.
systemConfiguration.jwtConfiguration.issuer [String] Required Deprecated	The name or issuer of the JWT, this is generally something unique such as a fully qualified domain name. For example, `fusionauth.io`. Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.privateKey [String] Optional Deprecated	The private key used when an `RSA` signing algorithm has been selected. The private key will be used to sign the JWT. This key is expected to be in a PEM encoded format. Required when `algorithm` is set to an RSA based value. Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.publicKey [String] Optional Deprecated	The public key used when an `RSA` signing algorithms has been selected. The public key will be used to verify JWTs signed with the private key. This key is expected to be in a PEM encoded format. Required when `algorithm` is set to an RSA based value. Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.refreshTokenTimeToLiveInMinutes Required [Integer]	The length of time in minutes the JWT refresh token will live before it is expired and is not able to be exchanged for a JWT.
systemConfiguration.jwtConfiguration.secret [String] Optional Deprecated	The secret used when an `HMAC` based signing algorithm has been selected. This secret is used to sign and verify JWTs. Required when `algorithm` is set to an HMAC based value. Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.timeToLiveInSeconds [Integer] Required	The length of time in seconds the JWT will live before it is expired. This value is used to calculate the `exp` (expiration) identity claim.
systemConfiguration.loginRecordConfiguration.delete.enabled [Boolean] Optional defaults to `false` Available Since 1.7.0	Whether or not FusionAuth should delete the login records based upon this configuration. When `true` the loginRecordConfiguration.delete.numberOfDaysToRetain will be used to identify login records that are eligible for deletion. When this value is set to `false` login records will be preserved forever.
systemConfiguration.loginRecordConfiguration.delete.numberOfDaysToRetain [Integer] Optional Available Since 1.7.0	The number of days to retain login records. Required when loginRecordConfiguration.delete.enabled is set to `true`.
systemConfiguration.logoutURL [String] Optional	The logout redirect URL when sending the user’s browser to the `/oauth2/logout` URI of the FusionAuth Front End. This value is only used when a logout URL is not defined in your Application.
systemConfiguration.maximumPasswordAge.days [Integer] Optional Deprecated	The password maximum age in days. The number of days after which FusionAuth will require a user to change their password. Required when `systemConfiguration.maximumPasswordAge.enabled` is set to `true`. Removed in version 1.8.0 In version 1.8.0 and beyond, password age settings are managed per `Tenant`.
systemConfiguration.maximumPasswordAge.enabled [Boolean] Optional Deprecated	Indicates that the maximum password age is enabled and being enforced. Removed in version 1.8.0 In version 1.8.0 and beyond, password age settings are managed per `Tenant`.
systemConfiguration.minimumPasswordAge.seconds [Integer] Optional Deprecated	The password minimum age in seconds. When enabled FusionAuth will not allow a password to be changed until it reaches this minimum age. Required when `systemConfiguration.minimumPasswordAge.enabled` is set to `true`. Removed in version 1.8.0 In version 1.8.0 and beyond, password age settings are managed per `Tenant`.
systemConfiguration.minimumPasswordAge.enabled [Boolean] Optional Deprecated	Indicates that the minimum password age is enabled and being enforced. Removed in version 1.8.0 In version 1.8.0 and beyond, password age settings are managed per `Tenant`.
systemConfiguration.passwordEncryptionConfiguration.encryptionScheme [String] Optional Deprecated	The default method for encrypting the User’s password. The following encryptors are provided with FusionAuth: `salted-md5` `salted-sha256` `salted-hmac-sha256` `salted-pbkdf2-hmac-sha256` `bcrypt` Removed in version 1.8.0 In version 1.8.0 and beyond, password encryption configuration is managed per `Tenant`.
systemConfiguration.passwordEncryptionConfiguration.encryptionSchemeFactor [String] Optional Deprecated	The factor used by the password encryption scheme. If not provided, the `PasswordEncryptor` provides a default value. Generally this will be used as an iteration count to generate the hash. The actual use of this value is up to the `PasswordEncryptor` implementation. Removed in version 1.8.0 In version 1.8.0 and beyond, password encryption configuration is managed per `Tenant`.
systemConfiguration.passwordEncryptionConfiguration.modifyEncryptionSchemeOnLogin [Boolean] Optional Deprecated	When enabled a user’s hash configuration will be modified to match these configured settings. This can be useful to increase a password hash strength over time or upgrade imported users to a more secure encryption scheme after an initial import. Removed in version 1.8.0 In version 1.8.0 and beyond, password encryption configuration is managed per `Tenant`.
systemConfiguration.passwordValidationRules.maxLength [Integer] Required	The maximum number of characters that are allowed for user passwords.
systemConfiguration.passwordValidationRules.minLength [Integer] Required	The minimum number of characters that are required for user passwords.
systemConfiguration.passwordValidationRules.rememberPreviousPasswords.count [Integer] Optional	The number of previous passwords that should be remembered so they are not re-used by the User. Required when `systemConfiguration.passwordValidationRules.rememberPreviousPasswords.count` is set to `true`.
systemConfiguration.passwordValidationRules.rememberPreviousPasswords.enabled [Boolean] Optional	Indicates that the remember previous password validation is enabled and being enforced.
systemConfiguration.passwordValidationRules.requireMixedCase [Boolean] Optional defaults to `false`	Indicates that passwords require an uppercase and lowercase character to be valid.
systemConfiguration.passwordValidationRules.requireNonAlpha [Boolean] Optional defaults to `false`	Indicates that passwords require a non-alphanumeric character to be valid.
systemConfiguration.passwordValidationRules.requireNumber [Boolean] Optional defaults to `false`	Indicates that passwords require at least one number to be valid.
systemConfiguration.reportTimezone [String] Required	The time zone used to adjust the stored UTC time when generating reports. Since reports are usually rolled up hourly, this timezone will be used for demarcating the hours. For example: `America/Denver` or `US/Mountain`
systemConfiguration.uiConfiguration.headerColor [String] Optional	A hexadecimal color to override the default menu color in the user interface. Example: `000000` would set the menu color to black.
systemConfiguration.uiConfiguration.loginTheme.emailComplete [String]	A FreeMarker template that is rendered when the user requests the /email/complete page. This page is used after a user has verified their email address by clicking the URL in the email. After FusionAuth has updated their user object to indicate that their email was verified, the browser is redirected to this page.
systemConfiguration.uiConfiguration.loginTheme.emailSend [String]	A FreeMarker template that is rendered when the user requests the /email/send page. This page is used after a user has asked for the verification email to be resent. This can happen if the URL in the email expired and the user clicked it. In this case, the user can provide their email address again and FusionAuth will resend the email. After the user submits their email and FusionAuth re-sends a verification email to them, the browser is redirected to this page.
systemConfiguration.uiConfiguration.loginTheme.emailVerify [String]	A FreeMarker template that is rendered when the user requests the /email/verify page by clicking the URL from the verification email and the `verificationId` has expired. FusionAuth expires `verificationId` after a period of time (which is configurable). If the user has a URL from the verification email that has expired, this page will be rendered and the error will be displayed to the user.
systemConfiguration.uiConfiguration.loginTheme.enabled [Boolean]	Indicates that the login theme is enabled and will be used to style the login pages.
systemConfiguration.uiConfiguration.loginTheme.helpers [String]	A FreeMarker template that contains all of the macros and templates used by the rest of the `loginTheme` FreeMarker templates (i.e. `oauth2Authorize`). This allows you to configure the general layout of your UI configuration and login theme without having to copy and paste HTML into each of the templates.
systemConfiguration.uiConfiguration.loginTheme.oauth2Authorize [String]	A FreeMarker template that is rendered when the user requests the /oauth2/authorize page. This is the main login page for FusionAuth and is used for all interactive OAuth and OpenId Connect workflows.
systemConfiguration.uiConfiguration.loginTheme.oauth2Error [String]	A FreeMarker template that is rendered when the user requests the /oauth2/error page. This page is used if the user starts or is in the middle of the OAuth workflow and any type of error occurs. This could be caused by the user messing with the URL or internally some type of information wasn’t passed between the OAuth endpoints correctly. For example, if you are federating login to an external IdP and that IdP does not properly echo the `state` parameter, FusionAuth’s OAuth workflow will break and this page will be displayed.
systemConfiguration.uiConfiguration.loginTheme.oauth2TwoFactor [String]	A FreeMarker template that is rendered when the user requests the /oauth2/two-factor page. This page is used if the user has two-factor authentication enabled and they need to type in their code again. FusionAuth will properly handle the SMS or authenticator app processing on the back end. This page contains the form that the user will put their code into.
systemConfiguration.uiConfiguration.loginTheme.passwordChange [String]	A FreeMarker template that is rendered when the user requests the /password/change page. This page is used if the user is required to change their password or if they have requested a password reset. This page contains the form that allows the user to provide a new password.
systemConfiguration.uiConfiguration.loginTheme.passwordComplete [String]	A FreeMarker template that is rendered when the user requests the /password/complete page. This page is used after the user has successfully updated their password (or reset it). This page should instruct the user that their password was updated and that they need to login again.
systemConfiguration.uiConfiguration.loginTheme.passwordForgot [String]	A FreeMarker template that is rendered when the user requests the /password/forgot page. This page is used when a user starts the forgot password workflow. This page renders the form where the user types in their email address.
systemConfiguration.uiConfiguration.loginTheme.passwordSent [String]	A FreeMarker template that is rendered when the user requests the /password/sent page. This page is used when a user has submitted the forgot password form with their email. FusionAuth does not indicate back to the user if their email address was valid in order to prevent malicious activity that could reveal valid email addresses. Therefore, this page should indicate to the user that if their email was valid, they will receive an email shortly with a link to reset their password.
systemConfiguration.uiConfiguration.loginTheme.registrationComplete [String]	A FreeMarker template that is rendered when the user requests the /registration/complete page. This page is used after a user has verified their email address for a specific application (i.e. a user registration) by clicking the URL in the email. After FusionAuth has updated their registration object to indicate that their email was verified, the browser is redirected to this page.
systemConfiguration.uiConfiguration.loginTheme.registrationSend [String]	A FreeMarker template that is rendered when the user requests the /registration/send page. This page is used after a user has asked for the application specific verification email to be resent. This can happen if the URL in the email expired and the user clicked it. In this case, the user can provide their email address again and FusionAuth will resend the email. After the user submits their email and FusionAuth re-sends a verification email to them, the browser is redirected to this page.
systemConfiguration.uiConfiguration.loginTheme.emailVerify [String]	A FreeMarker template that is rendered when the user requests the /registration/verify page by clicking the URL from the application specific verification email and the `verificationId` has expired. FusionAuth expires `verificationId` after a period of time (which is configurable). If the user has a URL from the verification email that has expired, this page will be rendered and the error will be displayed to the user.
systemConfiguration.uiConfiguration.loginTheme.stylesheet [String]	A CSS stylesheet used to style the login page and other templates such as forgot password, and verify email.
systemConfiguration.uiConfiguration.logoURL [String] Optional	A URL of a logo to override the default FusionAuth logo in the user interface.
systemConfiguration.uiConfiguration.menuFontColor [String] Optional	A hexadecimal color to override the default menu font color in the user interface. Example: `FFFFFF` would set the menu font color to white.

Example Request JSON

{
  "systemConfiguration": {
    "auditLogConfiguration": {
      "delete": {
        "enabled": true,
        "numberOfDaysToRetain": 90
      }
    },
    "corsConfiguration": {
      "allowCredentials": true,
      "allowedHeaders": [
        "Accept",
        "Access-Control-Request-Headers",
        "Access-Control-Request-Method",
        "Authorization",
        "Content-Type",
        "Last-Modified",
        "Origin",
        "X-FusionAuth-TenantId",
        "X-Requested-With"
      ],
      "allowedMethods": [
        "GET",
        "POST",
        "HEAD",
        "OPTIONS",
        "PUT",
        "DELETE"
      ],
      "allowedOrigins": [
        "*"
      ],
      "enabled": true,
      "exposedHeaders": [
        "Access-Control-Allow-Origin",
        "Access-Control-Allow-Credentials"
      ],
      "preflightMaxAgeInSeconds": 1800
    },
    "eventConfiguration": {
      "user.create": {
        "enabled": true,
        "transactionType": "AbsoluteMajority"
      }
    },
    "eventLogConfiguration": {
      "numberToRetain": 10000
    },
    "httpSessionMaxInactiveInterval": 3600,
    "issuer": "https://example.com",
    "jwtConfiguration": {
      "accessTokenKeyId": "025233ca-d4f3-2aa4-eca9-7e4200e9b472",
      "idTokenKeyId": "092dbedc-30af-4149-9c61-b578f2c72f59",
      "refreshTokenTimeToLiveInMinutes": 43200,
      "timeToLiveInSeconds": 3600
    },
    "loginRecordConfiguration": {
      "delete": {
        "enabled": true,
        "numberOfDaysToRetain": 90
      }
    },
    "logoutURL": "http://example.com/logout",
    "passwordValidationRules": {
      "maxLength": 256,
      "minLength": 8,
      "rememberPreviousPasswords": {
        "count": 2,
        "enabled": true
      },
      "requireMixedCase": true,
      "requireNonAlpha": true,
      "requireNumber": true
    },
    "reportTimezone": "America/Denver",
    "uiConfiguration": {
      "loginTheme": {
        "emailComplete": "FreeMarker template goes here ...",
        "emailSend": "FreeMarker template goes here ...",
        "emailVerify": "FreeMarker template goes here ...",
        "enabled": true,
        "helpers": "FreeMarker template goes here ...",
        "oauth2Authorize": "FreeMarker template goes here ...",
        "oauth2Error": "FreeMarker template goes here ...",
        "oauth2TwoFactor": "FreeMarker template goes here ...",
        "passwordChange": "FreeMarker template goes here ...",
        "passwordComplete": "FreeMarker template goes here ...",
        "passwordForgot": "FreeMarker template goes here ...",
        "passwordSent": "FreeMarker template goes here ...",
        "registrationComplete": "FreeMarker template goes here ...",
        "registrationSend": "FreeMarker template goes here ...",
        "registrationVerify": "FreeMarker template goes here ...",
        "stylesheet": "CSS definition goes here ..."
      }
    }
  }
}

3.2. Response

The response for this API contains the System Configuration.

Table 4. Response Codes
Code	Description
200	The request was successful. The response will contain a JSON body.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Table 5. Response Body
systemConfiguration.auditLogConfiguration.delete.enabled [Boolean] Available Since 1.7.0	Whether or not FusionAuth should delete the Audit Log based upon this configuration. When `true` the auditLogConfiguration.delete.numberOfDaysToRetain will be used to identify audit logs that are eligible for deletion. When this value is set to `false` audit logs will be preserved forever.
systemConfiguration.auditLogConfiguration.delete.numberOfDaysToRetain [Integer] Available Since 1.7.0	The number of days to retain the Audit Log.
systemConfiguration.cookieEncryptionIV [String]	The Base64 encoded initialization vector used to encrypt saved request cookies for FusionAuth. This value has been auto-generated and may not be modified.
systemConfiguration.cookieEncryptionKey [String]	The Base64 encoded encryption key used to encrypt saved request cookies for FusionAuth. This value has been auto-generated and may not be modified.
systemConfiguration.corsConfiguration.allowCredentials [Boolean] Available Since 1.8.0	The `Access-Control-Allow-Credentials` response header values as described by MDN Access-Control-Allow-Credentials.
systemConfiguration.corsConfiguration.allowedHeaders [Array<String>] Available Since 1.8.0	The `Access-Control-Allow-Headers` response header values as described by MDN Access-Control-Allow-Headers.
systemConfiguration.corsConfiguration.allowedMethods [Array<String>] Available Since 1.8.0	The `Access-Control-Allow-Methods` response header values as described by MDN Access-Control-Allow-Methods. The possible values are: `GET` `POST` `PUT` `DELETE` `HEAD` `OPTIONS`
systemConfiguration.corsConfiguration.allowedOrigins [Array<String>] Available Since 1.8.0	The `Access-Control-Allow-Origin` response header values as described by MDN Access-Control-Allow-Origin. If the wildcard `*` is specified, no additional domains may be specified.
systemConfiguration.corsConfiguration.enabled [Boolean] Available Since 1.8.0	Whether the FusionAuth CORS filter will process requests made to FusionAuth.
systemConfiguration.corsConfiguration.exposedHeaders [Array<String>] Available Since 1.8.0	The `Access-Control-Expose-Headers` response header values as described by MDN Access-Control-Expose-Headers.
systemConfiguration.corsConfiguration.preflightMaxAgeInSeconds [Integer] Available Since 1.8.0	The `Access-Control-Max-Age` response header values as described by MDN Access-Control-Max-Age.
systemConfiguration.emailConfiguration.enabled [Boolean] Deprecated	Indicates that the SMTP email configuration is available for use by FusionAuth. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.host [String] Deprecated	The host name of the SMTP server that FusionAuth will use. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.forgotPasswordEmailTemplateId [UUID] Deprecated	The Id of the Email Template that is used when a user is sent a forgot password email. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.password [String] Deprecated	An optional password FusionAuth will use to authenticate with the SMTP server. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.port [Integer] Deprecated	The port of the SMTP server that FusionAuth will use. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.security String Deprecated	The type of security protocol FusionAuth will use when connecting to the SMTP server. The possible values are: `NONE` - no security will be used. All communications will be sent plaintext. `SSL` - SSL will be used to connect to the SMTP server. This protocol is not recommended unless it is the only one your SMTP server supports. `TLS` - TLS will be used to connect to the SMTP server. This is the preferred protocol for all SMTP servers. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.setPasswordEmailTemplateId [UUID] Deprecated	The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.username [String] Deprecated	An optional username FusionAuth will to authenticate with the SMTP server. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.verificationEmailTemplateId [UUID] Deprecated	The Id of the Email Template that is used to send the verification emails to users. These emails are used to verify that a user’s email address is valid. If the `verifyEmail` field is `true` this field is required. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.verifyEmail [Boolean] Deprecated	Whether or not user’s email addresses are verified when the register with your application. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.emailConfiguration.verifyEmailWhenChanged [Boolean] Deprecated	Whether or not user’s email addresses are verified when the user changes them. Removed in version 1.8.0 In version 1.8.0 and beyond, email configuration is managed per `Tenant`.
systemConfiguration.eventConfiguration.events [Object]	A mapping of the configuration for each event type that FusionAuth sends. The event types that are the keys into this Object are: `user.action` - When a user action is triggered `user.bulk.create` - When multiple users are created in bulk (i.e. during an import) `user.create` - When a user is created `user.email.verified` - When a user verifies their email address `user.update` - When a user is updated `user.deactivate` - When a user is deactivated `user.reactivate` - When a user is reactivated `user.login.success` - When a user completes a login request `user.login.failed` - When a user fails a login request `user.registration.create` - When a user registration is created `user.registration.update` - When a user registration is updated `user.registration.delete` - When a user registration is deleted `user.registration.verified` - When a user completes registration verification `user.delete` - When a user is deleted `jwt.public-key.update` - When a JWT RSA Public / Private keypair may have been changed `jwt.refresh-token.revoke` - When a JWT Refresh Token is revoked
systemConfiguration.eventConfiguration.events`[type]`.enabled [Boolean]	Whether or not FusionAuth should send these types of events to any configured Webhooks.
systemConfiguration.eventConfiguration.events`[type]`.transactionType String	The transaction type that FusionAuth uses when sending these types of events to any configured Webhooks. The transaction types are: `None` - No Webhooks are required to succeed for the FusionAuth transaction to be committed. `Any` - Only a single Webhook is required to succeed for the FusionAuth transaction to be committed. `SimpleMajority` - A simple majority (50% or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed. `SuperMajority` - A super majority (2/3 or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed. `AbsoluteMajority` - Every Webhook must succeed for the FusionAuth transaction to be committed.
systemConfiguration.eventLogConfiguration.numberToRetain [Integer] Available Since 1.7.0	The number of events to retain. Once the the number of event logs exceeds this configured value they will be deleted starting with the oldest event logs.
systemConfiguration.externalIdentifierConfiguration.authorizationGrantIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until a OAuth authorization code in no longer valid to be exchanged for an access token. This is essentially the time allowed between the start of an Authorization request during the Authorization code grant and when you request an access token using this authorization code on the Token endpoint. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.changePasswordIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until a change password Id is no longer valid and cannot be used by the Change Password API. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.emailVerificationIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until a email verification Id is no longer valid and cannot be used by the Verify Email API. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.registrationVerificationIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until a registration verification Id is no longer valid and cannot be used by the Verify Registration API. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.setupPasswordIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until a setup password Id is no longer valid and cannot be used by the Change Password API. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.twoFactorIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until a two factor Id is no longer valid and cannot be used by the Two Factor Login API. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.externalIdentifierConfiguration.twoFactorTrustIdTimeToLiveInSeconds [Integer] Deprecated	The time in seconds until an issued Two Factor trust Id is no longer valid and the User will be required to complete Two Factor authentication during the next authentication attempt. Removed in version 1.8.0 In version 1.8.0 and beyond, external identifier configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.actionDuration [Long] Deprecated	The duration of the User Action. This value along with the `actionDurationUnit` will be used to set the duration of the User Action. Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.actionDurationUnit [String] Deprecated	The unit of time associated with a duration. The possible values are: `MINUTES` `HOURS` `DAYS` `WEEKS` `MONTHS` `YEARS` Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.resetCountInSeconds [Integer] Deprecated	The length of time in seconds before the failed authentication count will be reset. For example, if `tooManyAttempts` is set to `5` and you fail to authenticate `4` times in a row, waiting for the duration specified here will cause your fifth attempt to start back at `1`. Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.tooManyAttempts [Integer] Deprecated	The number of failed attempts considered to be too many. Once this threshold is reached the specified User Action will be applied to the user for the duration specified. Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.failedAuthenticationConfiguration.userActionId [UUID] Deprecated	The Id of the User Action that is applied when the threshold is reached for too many failed authentication attempts. Removed in version 1.8.0 In version 1.8.0 and beyond, failed authentication configuration is managed per `Tenant`.
systemConfiguration.httpSessionMaxInactiveInterval [Integer]	The time in seconds until an inactive session will be invalidated. Used when creating a new session in the FusionAuth OAuth front-end.
systemConfiguration.issuer [String] Available Since 1.6.0	The name or issuer of the JWT, this is generally something unique such as a fully qualified domain name. This is also used as the default issuer value when generating `Keys`. For example, `fusionauth.io`.
systemConfiguration.jwtConfiguration.accessTokenId [UUID] Available Since 1.6.0	The Id of the signing key used to sign the access token.
systemConfiguration.jwtConfiguration.algorithm [String] Deprecated	The algorithm used to sign the JSON Web Token (JWT). The following available JSON Web Algorithms (JWA) as described in RFC 7518 are available. `ES256` - ECDSA using P-256 curve and SHA-256 Available Since 1.4.0 `ES384` - ECDSA using P-384 curve and SHA-384 Available Since 1.4.0 `ES512` - ECDSA using P-521 curve and SHA-512 Available Since 1.4.0 `HS256` - HMAC using SHA-256 `HS384` - HMAC using SHA-384 `HS512` - HMAC using SHA-512 `RS256` - RSASSA-PKCS1-v1_5 using SHA-256 `RS384` - RSASSA-PKCS1-v1_5 using SHA-384 `RS512` - RSASSA-PKCS1-v1_5 using SHA-512 Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.enabled [Boolean]	This value will always be true. The JWT configuration may not be disabled for the System Configuration.
systemConfiguration.jwtConfiguration.idTokenKeyId [UUID] Available Since 1.6.0	The Id of the signing key used to sign the Id token.
systemConfiguration.jwtConfiguration.issuer [String] Deprecated	The name or issuer of the JWT, this is generally something unique such as a fully qualified domain name. For example, `fusionauth.io`. Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.privateKey [String] Deprecated	The private key used when an `RSA` signing algorithm has been selected. The private key will be used to sign the JWT. This key will be returned in a PEM encoded format. Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.publicKey [String] Deprecated	The public key used when an `RSA` signing algorithms has been selected. The public key will be used to verify JWTs signed with the private key. This key will be returned in a PEM encoded format. Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.refreshTokenTimeToLiveInMinutes [Integer]	The length of time in minutes the JWT refresh token will live before it is expired and is not able to be exchanged for a JWT.
systemConfiguration.jwtConfiguration.secret [String] Deprecated	The secret used when an `HMAC` based signing algorithm has been selected. This secret is used to sign and verify JWTs. Removed in version 1.6.0 In version 1.6.0 and beyond, JWT configuration can be managed in the `Keys API` and Keymaster.
systemConfiguration.jwtConfiguration.timeToLiveInSeconds [Integer]	The length of time in seconds the JWT will live before it is expired. This value is used to calculate the `exp` (expiration) identity claim.
systemConfiguration.loginRecordConfiguration.delete.enabled [Boolean] Available Since 1.7.0	Whether or not FusionAuth should delete the login records based upon this configuration. When `true` the loginRecordConfiguration.delete.numberOfDaysToRetain will be used to identify login records that are eligible for deletion. When this value is set to `false` login records will be preserved forever.
systemConfiguration.loginRecordConfiguration.delete.numberOfDaysToRetain [Integer] Available Since 1.7.0	The number of days to retain login records.
systemConfiguration.logoutURL [String]	The logout redirect URL when sending the user’s browser to the `/oauth2/logout` URI of the FusionAuth Front End. This value is only used when a logout URL is not defined in your Application.
systemConfiguration.maximumPasswordAge.days [Integer] Deprecated	The password maximum age in days. The number of days after which FusionAuth will require a user to change their password. Removed in version 1.8.0 In version 1.8.0 and beyond, password age settings are managed per `Tenant`.
systemConfiguration.maximumPasswordAge.enabled [Boolean] Deprecated	Indicates that the maximum password age is enabled and being enforced. Removed in version 1.8.0 In version 1.8.0 and beyond, password age settings are managed per `Tenant`.
systemConfiguration.minimumPasswordAge.seconds [Integer] Deprecated	The password minimum age in seconds. When enabled FusionAuth will not allow a password to be changed until it reaches this minimum age. Removed in version 1.8.0 In version 1.8.0 and beyond, password age settings are managed per `Tenant`.
systemConfiguration.minimumPasswordAge.enabled [Boolean] Deprecated	Indicates that the minimum password age is enabled and being enforced. Removed in version 1.8.0 In version 1.8.0 and beyond, password age settings are managed per `Tenant`.
systemConfiguration.passwordEncryptionConfiguration.encryptionScheme [String] Deprecated	The selected default encryption scheme. Removed in version 1.8.0 In version 1.8.0 and beyond, password encryption configuration is managed per `Tenant`.
systemConfiguration.passwordEncryptionConfiguration.encryptionSchemeFactor [String] Deprecated	The factor used by the password encryption scheme. Generally this will be used as an iteration count to generate the hash. The actual use of this value is up to the `PasswordEncryptor` implementation. Removed in version 1.8.0 In version 1.8.0 and beyond, password encryption configuration is managed per `Tenant`.
systemConfiguration.passwordEncryptionConfiguration.modifyEncryptionSchemeOnLogin [Boolean] Deprecated	When enabled a user’s hash configuration will be modified to match these configured settings. Removed in version 1.8.0 In version 1.8.0 and beyond, password encryption configuration is managed per `Tenant`.
systemConfiguration.passwordValidationRules.maxLength [Integer]	The maximum number of characters that are allowed for user passwords.
systemConfiguration.passwordValidationRules.minLength [Integer]	The minimum number of characters that are required for user passwords.
systemConfiguration.passwordValidationRules.rememberPreviousPasswords.count [Integer]	The number of previous passwords that should be remembered so they are not re-used by the User.
systemConfiguration.passwordValidationRules.rememberPreviousPasswords.enabled [Boolean]	Indicates that the remember previous password validation is enabled and being enforced.
systemConfiguration.passwordValidationRules.requireMixedCase [Boolean]	Indicates that passwords require an uppercase and lowercase character to be valid.
systemConfiguration.passwordValidationRules.requireNonAlpha [Boolean]	Indicates that passwords require a non-alphanumeric character to be valid.
systemConfiguration.passwordValidationRules.requireNumber [Boolean]	Indicates that passwords require at least one number to be valid.
systemConfiguration.reportTimezone [String]	The time zone used to adjust the stored UTC time when generating reports. Since reports are usually rolled up hourly, this timezone will be used for demarcating the hours. For example: `America/Denver` or `US/Mountain`
systemConfiguration.uiConfiguration.headerColor [String]	A hexadecimal color to override the default menu color in the user interface.
systemConfiguration.uiConfiguration.loginTheme.emailComplete [String]	A FreeMarker template that is rendered when the user requests the /email/complete page. This page is used after a user has verified their email address by clicking the URL in the email. After FusionAuth has updated their user object to indicate that their email was verified, the browser is redirected to this page.
systemConfiguration.uiConfiguration.loginTheme.emailSend [String]	A FreeMarker template that is rendered when the user requests the /email/send page. This page is used after a user has asked for the verification email to be resent. This can happen if the URL in the email expired and the user clicked it. In this case, the user can provide their email address again and FusionAuth will resend the email. After the user submits their email and FusionAuth re-sends a verification email to them, the browser is redirected to this page.
systemConfiguration.uiConfiguration.loginTheme.emailVerify [String]	A FreeMarker template that is rendered when the user requests the /email/verify page by clicking the URL from the verification email and the `verificationId` has expired. FusionAuth expires `verificationId` after a period of time (which is configurable). If the user has a URL from the verification email that has expired, this page will be rendered and the error will be displayed to the user.
systemConfiguration.uiConfiguration.loginTheme.enabled [Boolean]	Indicates that the login theme is enabled and will be used to style the login pages.
systemConfiguration.uiConfiguration.loginTheme.helpers [String]	A FreeMarker template that contains all of the macros and templates used by the rest of the `loginTheme` FreeMarker templates (i.e. `oauth2Authorize`). This allows you to configure the general layout of your UI configuration and login theme without having to copy and paste HTML into each of the templates.
systemConfiguration.uiConfiguration.loginTheme.oauth2Authorize [String]	A FreeMarker template that is rendered when the user requests the /oauth2/authorize page. This is the main login page for FusionAuth and is used for all interactive OAuth and OpenId Connect workflows.
systemConfiguration.uiConfiguration.loginTheme.oauth2Error [String]	A FreeMarker template that is rendered when the user requests the /oauth2/error page. This page is used if the user starts or is in the middle of the OAuth workflow and any type of error occurs. This could be caused by the user messing with the URL or internally some type of information wasn’t passed between the OAuth endpoints correctly. For example, if you are federating login to an external IdP and that IdP does not properly echo the `state` parameter, FusionAuth’s OAuth workflow will break and this page will be displayed.
systemConfiguration.uiConfiguration.loginTheme.oauth2TwoFactor [String]	A FreeMarker template that is rendered when the user requests the /oauth2/two-factor page. This page is used if the user has two-factor authentication enabled and they need to type in their code again. FusionAuth will properly handle the SMS or authenticator app processing on the back end. This page contains the form that the user will put their code into.
systemConfiguration.uiConfiguration.loginTheme.passwordChange [String]	A FreeMarker template that is rendered when the user requests the /password/change page. This page is used if the user is required to change their password or if they have requested a password reset. This page contains the form that allows the user to provide a new password.
systemConfiguration.uiConfiguration.loginTheme.passwordComplete [String]	A FreeMarker template that is rendered when the user requests the /password/complete page. This page is used after the user has successfully updated their password (or reset it). This page should instruct the user that their password was updated and that they need to login again.
systemConfiguration.uiConfiguration.loginTheme.passwordForgot [String]	A FreeMarker template that is rendered when the user requests the /password/forgot page. This page is used when a user starts the forgot password workflow. This page renders the form where the user types in their email address.
systemConfiguration.uiConfiguration.loginTheme.passwordSent [String]	A FreeMarker template that is rendered when the user requests the /password/sent page. This page is used when a user has submitted the forgot password form with their email. FusionAuth does not indicate back to the user if their email address was valid in order to prevent malicious activity that could reveal valid email addresses. Therefore, this page should indicate to the user that if their email was valid, they will receive an email shortly with a link to reset their password.
systemConfiguration.uiConfiguration.loginTheme.registrationComplete [String]	A FreeMarker template that is rendered when the user requests the /registration/complete page. This page is used after a user has verified their email address for a specific application (i.e. a user registration) by clicking the URL in the email. After FusionAuth has updated their registration object to indicate that their email was verified, the browser is redirected to this page.
systemConfiguration.uiConfiguration.loginTheme.registrationSend [String]	A FreeMarker template that is rendered when the user requests the /registration/send page. This page is used after a user has asked for the application specific verification email to be resent. This can happen if the URL in the email expired and the user clicked it. In this case, the user can provide their email address again and FusionAuth will resend the email. After the user submits their email and FusionAuth re-sends a verification email to them, the browser is redirected to this page.
systemConfiguration.uiConfiguration.loginTheme.registrationVerify [String]	A FreeMarker template that is rendered when the user requests the /registration/verify page by clicking the URL from the application specific verification email and the `verificationId` has expired. FusionAuth expires `verificationId` after a period of time (which is configurable). If the user has a URL from the verification email that has expired, this page will be rendered and the error will be displayed to the user.
systemConfiguration.uiConfiguration.loginTheme.stylesheet [String]	A CSS stylesheet used to style the login page and other templates such as forgot password, and verify email.
systemConfiguration.uiConfiguration.logoURL [String]	A URL of a logo to override the default FusionAuth logo in the user interface.
systemConfiguration.uiConfiguration.menuFontColor [String]	A hexadecimal color to override the default menu font color in the user interface.

Example Response JSON

{
  "systemConfiguration": {
    "auditLogConfiguration": {
      "delete": {
        "enabled": true,
        "numberOfDaysToRetain": 90
      }
    },
    "cookieEncryptionIV": "aZCGlFQmWHW2OLpLYPC8hw==",
    "cookieEncryptionKey": "spq1hhDHqBR8T5g479QS7w==",
    "corsConfiguration": {
      "allowCredentials": true,
      "allowedHeaders": [
        "Accept",
        "Access-Control-Request-Headers",
        "Access-Control-Request-Method",
        "Authorization",
        "Content-Type",
        "Last-Modified",
        "Origin",
        "X-FusionAuth-TenantId",
        "X-Requested-With"
      ],
      "allowedMethods": [
        "GET",
        "POST",
        "HEAD",
        "OPTIONS",
        "PUT",
        "DELETE"
      ],
      "allowedOrigins": [
        "*"
      ],
      "enabled": true,
      "exposedHeaders": [
        "Access-Control-Allow-Origin",
        "Access-Control-Allow-Credentials"
      ],
      "preflightMaxAgeInSeconds": 1800
    },
    "eventConfiguration": {
      "user.create": {
        "enabled": true,
        "transactionType": "AbsoluteMajority"
      }
    },
    "eventLogConfiguration": {
      "numberToRetain": 10000
    },
    "httpSessionMaxInactiveInterval": 3600,
    "issuer": "https://example.com",
    "jwtConfiguration": {
      "accessTokenKeyId": "025233ca-d4f3-2aa4-eca9-7e4200e9b472",
      "enabled": true,
      "idTokenKeyId": "092dbedc-30af-4149-9c61-b578f2c72f59",
      "refreshTokenTimeToLiveInMinutes": 43200,
      "timeToLiveInSeconds": 3600
    },
    "loginRecordConfiguration": {
      "delete": {
        "enabled": true,
        "numberOfDaysToRetain": 90
      }
    },
    "logoutURL": "http://example.com/logout",
    "passwordValidationRules": {
      "maxLength": 256,
      "minLength": 8,
      "rememberPreviousPasswords": {
        "count": 2,
        "enabled": true
      },
      "requireMixedCase": true,
      "requireNonAlpha": true,
      "requireNumber": true
    },
    "reportTimezone": "America/Denver",
    "uiConfiguration": {
      "loginTheme": {
        "emailComplete": "FreeMarker template goes here ...",
        "emailSend": "FreeMarker template goes here ...",
        "emailVerify": "FreeMarker template goes here ...",
        "enabled": true,
        "lastModified": 1540588216227,
        "helpers": "FreeMarker template goes here ...",
        "oauth2Authorize": "FreeMarker template goes here ...",
        "oauth2Error": "FreeMarker template goes here ...",
        "oauth2TwoFactor": "FreeMarker template goes here ...",
        "passwordChange": "FreeMarker template goes here ...",
        "passwordComplete": "FreeMarker template goes here ...",
        "passwordForgot": "FreeMarker template goes here ...",
        "passwordSent": "FreeMarker template goes here ...",
        "registrationComplete": "FreeMarker template goes here ...",
        "registrationSend": "FreeMarker template goes here ...",
        "registrationVerify": "FreeMarker template goes here ...",
        "stylesheet": "CSS definition goes here ..."
      }
    }
  }
}

4. Retrieve the Password Validation Rules

This API is used to retrieve the Password Validation Rules. This configuration is a subset of the System Configuration.

4.1. Request

Retrieve the Password Validation Rules

URI

GET /api/system-configuration/password-validation-rules

4.2. Response

The response for this API contains the Password Validation Rules.

Table 6. Response Codes
Code	Description
200	The request was successful. The response will contain a JSON body.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

Table 7. Response Body
systemConfiguration.passwordValidationRules.maxLength [Integer]	The maximum number of characters that are allowed for user passwords.
systemConfiguration.passwordValidationRules.minLength [Integer]	The minimum number of characters that are required for user passwords.
systemConfiguration.passwordValidationRules.rememberPreviousPasswords.count [Integer]	The number of previous passwords that should be remembered so they are not re-used by the User.
systemConfiguration.passwordValidationRules.rememberPreviousPasswords.enabled [Boolean]	Indicates that the remember previous password validation is enabled and being enforced.
systemConfiguration.passwordValidationRules.requireMixedCase [Boolean]	Indicates that passwords require an uppercase and lowercase character to be valid.
systemConfiguration.passwordValidationRules.requireNonAlpha [Boolean]	Indicates that passwords require a non-alphanumeric character to be valid.
systemConfiguration.passwordValidationRules.requireNumber [Boolean]	Indicates that passwords require at least one number to be valid.

Example Response JSON

{
  "passwordValidationRules": {
    "maxLength": 256,
    "minLength": 8,
    "rememberPreviousPasswords": {
      "count": 2,
      "enabled": true
    },
    "requireMixedCase": true,
    "requireNonAlpha": true,
    "requireNumber": true
  }
}