Tenant APIs

The Id to use for the new Tenant. If not specified a secure random UUID will be generated.

The optional Id of an existing Tenant to make a copy of. A unique tenant.name is required. If present, the tenant.id value will used for the new Tenant. All other values will be copied from the source Tenant to the new Tenant.

The Id of the IP Access Control List limiting access to all applications in this tenant.

Note: An Enterprise version of FusionAuth is required to utilize IP ACLs.

The type of captcha method to use. This field is required when tenant.captchaConfiguration.enabled is set to true. The possible values are:

• GoogleRecaptchaV2 - use Google Recaptcha v2

• GoogleRecaptchaV3 - use Google Recaptcha v3

• HCaptcha - use HCaptcha

• HCaptchaEnterprise - use HCaptcha Enterprise - v25

Note: An Enterprise version of FusionAuth is required to utilize CAPTCHA.

Whether captcha configuration is enabled.

Note: An Enterprise version of FusionAuth is required to utilize CAPTCHA.

The secret key for this captcha method. This field is required when tenant.captchaConfiguration.enabled is set to true.

Note: An Enterprise version of FusionAuth is required to utilize CAPTCHA.

The site key for this captcha method. This field is required when tenant.captchaConfiguration.enabled is set to true.

Note: An Enterprise version of FusionAuth is required to utilize CAPTCHA.

The numeric threshold which separates a passing score from a failing one. This value only applies if using either the Google v3 or HCaptcha Enterprise method, otherwise this value is ignored.

The value must be between 0.0 and 1.0. Values outside of that range will result in an error.

Note: An Enterprise version of FusionAuth is required to utilize CAPTCHA.

A list of Connector policies. Users will be authenticated against Connectors in order. Each Connector can be included in this list at most once and must exist.

The identifier of the Connector to which this policy refers.

An list of email domains to which this connector should apply.

A value of ["*"] indicates this connector applies to all users.

If true, the user’s data will be migrated to FusionAuth at first successful authentication; subsequent authentications will occur against the FusionAuth datastore. If false, the Connector’s source will be treated as authoritative.

Prior to version 1.28.0 this value was required.

An object that can hold any information about the Tenant that should be persisted.

The additional SMTP headers to be added to each outgoing email. Each SMTP header consists of a name and a value.

The default email address that emails will be sent from when a from address is not provided on an individual email template. This is the address part email address (i.e. Jared Dunn <jared@piedpiper.com>).

The default From Name used in sending emails when a from name is not provided on an individual email template. This is the display name part of the email address ( i.e. Jared Dunn <jared@piedpiper.com>).

The Id of the Email Template used to send emails to users to verify that their email address is valid.

The Id of the Email Template used to send emails to users when their email address is updated.

Note: An Enterprise version of FusionAuth is required to utilize advanced threat detection emails.

The Id of the Email Template used to verify user emails.

The Id of the Email Template that is used when a user is sent a forgot password email.

The host name of the SMTP server that FusionAuth will use.

Prior to version 1.28.0 this value was required.

When set to true, this allows email to be verified as a result of completing a similar email based workflow such as change password. When set to false, the user must explicitly complete the email verification workflow even if the user has already completed a similar email workflow such as change password.

The Id of the Email Template used to send emails to users when another user attempts to create an account with their login Id.

Note: An Enterprise version of FusionAuth is required to utilize advanced threat detection emails.

The Id of the Email Template used to send emails to users when another user attempts to update an existing account to use their login Id.

Note: An Enterprise version of FusionAuth is required to utilize advanced threat detection emails.

The Id of the Email Template used to send emails to users when they log in on a new device.

Note: An Enterprise version of FusionAuth is required to utilize advanced threat detection emails.

The Id of the Email Template used to send emails to users when a suspicious login occurs.

Note: An Enterprise version of FusionAuth is required to utilize advanced threat detection emails.

An optional password FusionAuth will use to authenticate with the SMTP server.

The Id of the Passwordless Email Template, sent to users when they start a passwordless login.

The Id of the Email Template used to send emails to users when they have completed a 'forgot password' workflow and their password has been reset.

Note: An Enterprise version of FusionAuth is required to utilize advanced threat detection emails.

The Id of the Email Template used to send emails to users when their password has been updated.

Note: An Enterprise version of FusionAuth is required to utilize advanced threat detection emails.

The port of the SMTP server that FusionAuth will use.

Prior to version 1.28.0 this value was required.

Additional Email Configuration in a properties file formatted String.

The type of security protocol FusionAuth will use when connecting to the SMTP server. The possible values are:

• NONE - no security will be used. All communications will be sent plaintext.

• SSL - SSL will be used to connect to the SMTP server. This protocol is not recommended unless it is the only one your SMTP server supports.

• TLS - TLS will be used to connect to the SMTP server. This is the preferred protocol for all SMTP servers.

The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password.

The Id of the Email Template used to send emails to users when a MFA method has been added to their account.

Note: An Enterprise version of FusionAuth is required to utilize advanced threat detection emails.

The Id of the Email Template used to send emails to users when a MFA method has been removed from their account.

Note: An Enterprise version of FusionAuth is required to utilize advanced threat detection emails.

When this value is set to true, the user is allowed to change their email address when they are gated because they haven’t verified their email address.

The desired behavior during login for a user that does not have a verified email. The possible values are:

• Allow - the user will be allowed to complete login.

• Gated - verification is required before a user can complete login. The use of this value will require a paid edition of FusionAuth.

An optional username FusionAuth will to authenticate with the SMTP server.

The Id of the Email Template used to send emails to users to verify that their email address is valid. If either the verifyEmail or verifyEmailWhenChanged fields are true, this field is required.

The process by which the user will verify their email address. The possible values are:

• ClickableLink - send the user a code with a clickable link.

• FormField - send the user a short code intended to be manually entered into a form field. This is only available when tenant.emailConfiguration.unverified.behavior has the Gated value.

Whether the user’s email addresses are verified when the registers with your application.

Whether the user’s email addresses are verified when the user changes them.

A mapping of the configuration for each event type that FusionAuth sends. The event types that are the keys into this Object are:

• audit-log.create - When an audit log is created Available since 1.30.0

• event-log.create - When an event log is created Available since 1.30.0

• jwt.public-key.update - When a JWT RSA Public / Private keypair may have been changed

• jwt.refresh - When an access token is refreshed using a refresh token Available since 1.16.0

• jwt.refresh-token.revoke - When a JWT Refresh Token is revoked

• kickstart.success - When kickstart has successfully completed Available since 1.30.0

• user.action - When a user action is triggered

• user.bulk.create - When multiple users are created in bulk (i.e. during an import)

• user.create - When a user is created

• user.create.complete - When a user create transaction has completed Available since 1.30.0

• user.deactivate - When a user is deactivated

• user.delete - When a user is deleted

• user.delete.complete - When a user delete transaction has completed Available since 1.30.0

• user.email.update - When a user updates their email address Available since 1.30.0

• user.email.verified - When a user verifies their email address Available since 1.8.0

• user.identity-provider.link - When a link is created from a user to an Identity Provider Available since 1.36.0

• user.identity-provider.unlink - When an existing Identity Provider link is removed from a User Available since 1.36.0

• user.loginId.duplicate.create - When a request to create a user with a login Id (email or username) which is already in use has been received Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.loginId.duplicate.update - When a request to update a user and change their login Id (email or username) to one that is already in use has been received Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.login.failed - When a user fails a login request Available since 1.6.0

• user.login.new-device - When a user begins a login request with a new device Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.login.success - When a user completes a login request Available since 1.6.0

• user.login.suspicious - When a user logs in and is considered to be a potential threat (requires an activated Enterprise license) Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.password.breach - When Reactor detects a user is using a potentially breached password (requires an activated license) Available since 1.15.0

  Note: A paid edition of FusionAuth is required to utilize this event.

• user.password.reset.send - When a forgot password email has been sent to a user Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.password.reset.start - When the process to reset a user password has started Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.password.reset.success - When a user has successfully reset their password Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.password.update - When a user has updated their password Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.reactivate - When a user is reactivated

• user.registration.create - When a user registration is created Available since 1.6.0

• user.registration.create.complete - When a user registration create transaction has completed Available since 1.30.0

• user.registration.delete - When a user registration is deleted Available since 1.6.0

• user.registration.delete.complete - When a user registration delete transaction has completed Available since 1.30.0

• user.registration.update - When a user registration is updated Available since 1.6.0

• user.registration.update.complete - When a user registration update transaction has completed Available since 1.30.0

• user.registration.verified - When a user completes registration verification Available since 1.8.0

• user.two-factor.method.add - When a user has added a two-factor method Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.two-factor.method.remove - When a user has removed a two-factor method Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.update - When a user is updated

• user.update.complete - When a user update transaction has completed Available since 1.30.0

Whether or not FusionAuth should send these types of events to any configured Webhooks.

The transaction type that FusionAuth uses when sending these types of events to any configured Webhooks. The transaction types are:

• None - No Webhooks are required to succeed for the FusionAuth transaction to be committed.

• Any - Only a single Webhook is required to succeed for the FusionAuth transaction to be committed.

• SimpleMajority - A simple majority (50% or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.

• SuperMajority - A super majority (2/3 or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.

• AbsoluteMajority - Every Webhook must succeed for the FusionAuth transaction to be committed.

Prior to version 1.36.0, this value did not have a default. This meant at runtime the when the transaction type was calculated, it would be assumed to be AbsoluteMajority even though this value was not set in the domain.

The time in seconds until a OAuth authorization code in no longer valid to be exchanged for an access token. This is essentially the time allowed between the start of an Authorization request during the Authorization code grant and when you request an access token using this authorization code on the Token endpoint.

Value must be greater than 0 and less than or equal to 600.

Prior to version 1.28.0 this value was required.

The length of the secure generator used for generating the change password Id.

If the changePasswordIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the changePasswordIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

Prior to version 1.28.0 this value was required.

The type of the secure generator used for generating the change password Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

Prior to version 1.28.0 this value was required.

The time in seconds until a change password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.

Prior to version 1.28.0 this value was required.

The time in seconds until a device code Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.

Prior to version 1.28.0 this value was required.

The length of the secure generator used for generating the device code Id.

If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

Prior to version 1.28.0 this value was required.

The type of the secure generator used for generating the device code Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

Prior to version 1.28.0 this value was required.

The length of the secure generator used for generating the the email verification Id.

If the emailVerificationIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

Prior to version 1.28.0 this value was required.

The type of the secure generator used for generating the email verification Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

Prior to version 1.28.0 this value was required.

The time in seconds until a email verification Id is no longer valid and cannot be used by the Verify Email API. Value must be greater than 0.

Prior to version 1.28.0 this value was required.

The length of the secure generator used for generating the email verification one time code.

If the emailVerificationIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the email verification one time code. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds until an external authentication Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.

Prior to version 1.28.0 this value was required.

The time in seconds until a One Time Password is no longer valid and cannot be used by the Login API. Value must be greater than 0.

Prior to version 1.28.0 this value was required.

The length of the secure generator used for generating the passwordless login.

If the passwordlessLoginGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the passwordlessLoginGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

Prior to version 1.28.0 this value was required.

The type of the secure generator used for generating the passwordless login. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

Prior to version 1.28.0 this value was required.

The time in seconds until a passwordless code is no longer valid and cannot be used by the Passwordless API. Value must be greater than 0.

Prior to version 1.28.0 this value was required.

The number of seconds before the pending account link identifier is no longer valid to complete an account link request. Value must be greater than 0.

The length of the secure generator used for generating the registration verification Id.

If the registrationVerificationIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

Prior to version 1.28.0 this value was required.

The type of the secure generator used for generating the registration verification Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

Prior to version 1.28.0 this value was required.

The time in seconds until a registration verification Id is no longer valid and cannot be used by the Verify Registration API. Value must be greater than 0.

Prior to version 1.28.0 this value was required.

The length of the secure generator used for generating the registration verification one time code.

If the registrationVerificationIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

Prior to version 1.28.0 this value was required.

The type of the secure generator used for generating the registration verification one time code. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

  Prior to version 1.28.0 this value was required.

The time in seconds that a SAML AuthN request Id returned by the Start SAML v2 Login Request API will be eligible to be used to complete a SAML v2 Login request.

The length of the secure generator used for generating the setup password Id.

If the setupPasswordIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the setupPasswordIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

Prior to version 1.28.0 this value was required.

The type of the secure generator used for generating the setup password Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

Prior to version 1.28.0 this value was required.

The time in seconds until a setup password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.

Prior to version 1.28.0 this value was required.

The number of seconds before the Trust Token is no longer valid to complete a request that requires trust. Value must be greater than 0.

The time in seconds until a two factor Id is no longer valid and cannot be used by the Two Factor Login API. Value must be greater than 0.

Prior to version 1.28.0 this value was required.

The length of the secure generator used for generating the the two factor code Id.

If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

Prior to version 1.28.0 this value was required.

The type of the secure generator used for generating the two factor one time code Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

Prior to version 1.28.0 this value was required.

The number of seconds before the Two-Factor One Time Code used to enable or disable a two-factor method is no longer valid. Must be greater than 0.

Prior to version 1.28.0 this value was required.

The time in seconds until an issued Two Factor trust Id is no longer valid and the User will be required to complete Two Factor authentication during the next authentication attempt. Value must be greater than 0.

Prior to version 1.28.0 this value was required.

The duration of the User Action. This value along with the actionDurationUnit will be used to set the duration of the User Action. Value must be greater than 0.

The unit of time associated with a duration. The possible values are:

• MINUTES

• HOURS

• DAYS

• WEEKS

• MONTHS

• YEARS

The length of time in seconds before the failed authentication count will be reset. Value must be greater than 0.

For example, if tooManyAttempts is set to 5 and you fail to authenticate 4 times in a row, waiting for the duration specified here will cause your fifth attempt to start back at 1.

The number of failed attempts considered to be too many. Once this threshold is reached the specified User Action will be applied to the user for the duration specified. Value must be greater than 0.

The Id of the User Action that is applied when the threshold is reached for too many failed authentication attempts.

Whether to allow child registrations.

The unique Id of the email template to use when confirming a child.

Indicates that child users without parental verification will be permanently deleted after tenant.familyConfiguration.deleteOrphanedAccountsDays days.

The number of days from creation child users will be retained before being deleted for not completing parental verification. Value must be greater than 0.

Whether family configuration is enabled.

The unique Id of the email template to use when a family request is made.

The maximum age of a child. Value must be greater than 0.

The minimum age to be an owner. Value must be greater than 0.

Whether a parent email is required.

The unique Id of the email template to use for parent registration.

The unique Id of the form to use for the Add and Edit User form when used in the FusionAuth admin UI.

When this parameter is not provided, it will default to the form Id currently assigned to the Default tenant.

Note: A paid edition of FusionAuth is required to utilize custom forms.

Time in seconds until an inactive session will be invalidated. Used when creating a new session in the FusionAuth OAuth frontend.

The named issuer used to sign tokens, this is generally your public fully qualified domain.

Prior to version 1.30.0 this value was required.

The unique id of the signing key used to sign the access token.

Prior to version 1.30.0 this value was required.

The unique id of the signing key used to sign the Id token.

Prior to version 1.30.0 this value was required.

The refresh token expiration policy. The following are valid values:

• Fixed - the expiration is calculated from the time the token is issued.

• SlidingWindow - the expiration is calculated from the last time the token was used.

When enabled, the refresh token will be revoked when a user action, such as locking an account based on a number of failed login attempts, prevents user login.

When enabled, the refresh token will be revoked when a user changes their password.

The length of time in minutes a Refresh Token is valid from the time it was issued. Value must be greater than 0.

Prior to version 1.28.0 this value was required.

The refresh token usage policy. The following are valid values:

• Reusable - the token does not change after it was issued.

• OneTimeUse - the token value will be changed each time the token is used to refresh a JWT. The client must store the new value after each usage.

Prior to version 1.28.0 this value was required.

The length of time in seconds this JWT is valid from the time it was issued. Value must be greater than 0.

Prior to version 1.28.0 this value was required.

The Id of a SCIM User Request Lambda that will be used to convert the SCIM Enterprise User request to a FusionAuth User.

Note: An Enterprise version of FusionAuth is required to utilize SCIM.

Required when tenant.scimServerConfiguration.enabled is true.

The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth Enterprise User to a SCIM Server response.

Note: An Enterprise version of FusionAuth is required to utilize SCIM.

Required when tenant.scimServerConfiguration.enabled is true.

The Id of a SCIM Group Request Lambda that will be used to convert the SCIM Group request to a FusionAuth Group.

Note: An Enterprise version of FusionAuth is required to utilize SCIM.

Required when tenant.scimServerConfiguration.enabled is true.

The Id of a SCIM Group Response Lambda that will be used to convert a FusionAuth Group to a SCIM Server response.

Note: An Enterprise version of FusionAuth is required to utilize SCIM.

Required when tenant.scimServerConfiguration.enabled is true.

The Id of a SCIM User Request Lambda that will be used to convert the SCIM User request to a FusionAuth User.

Note: An Enterprise version of FusionAuth is required to utilize SCIM.

Required when tenant.scimServerConfiguration.enabled is true.

The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth User to a SCIM Server response.

Note: An Enterprise version of FusionAuth is required to utilize SCIM.

Required when tenant.scimServerConfiguration.enabled is true.

The logout redirect URL when sending the user’s browser to the /oauth2/logout URI of the FusionAuth Front End. This value is only used when a logout URL is not defined in your Application.

Indicates whether to require an API key for the Login API when an applicationId is not provided. When an applicationId is provided to the Login API call, the application configuration will take precedence.

In almost all cases, you will want to this to be true.

The logout redirect URL when sending the user’s browser to the /oauth2/logout URI of the FusionAuth Front End. This value is only used when a logout URL is not defined in your Application.

The password maximum age in days. The number of days after which FusionAuth will require a user to change their password. Required when tenant.maximumPasswordAge.enabled is set to true.

Indicates that the maximum password age is enabled and being enforced.

The password minimum age in seconds. When enabled FusionAuth will not allow a password to be changed until it reaches this minimum age. Required when tenant.minimumPasswordAge.enabled is set to true.

Indicates that the minimum password age is enabled and being enforced.

When enabled, users may utilize an authenticator application to complete a multi-factor authentication request. This method uses TOTP (Time-Based One-Time Password) as defined in RFC 6238 and often uses an native mobile app such as Google Authenticator.

When enabled, users may utilize an email address to complete a multi-factor authentication request.

The Id of the email template that is used when notifying a user to complete a multi-factor authentication request. This field is required when tenant.multiFactorConfiguration.email.enabled is set to true.

When set to Enabled and a user has one or more two-factor methods configured, the user will be required to complete a two-factor challenge during login. When set to Disabled, even when a user has configured one or more two-factor methods, the user will not be required to complete a two-factor challenge during login.

Supported values include:

• Enabled - Require a two-factor challenge during login.

• Disabled - Do not require a two-factor challenge during login.

When enabled, users may utilize a mobile phone number to complete a multi-factor authentication request.

The messenger that is used to deliver a SMS multi-factor authentication request. This field is required when tenant.multiFactorConfiguration.sms.enabled is set to true.

The Id of the SMS template that is used when notifying a user to complete a multi-factor authentication request. This field is required when tenant.multiFactorConfiguration.sms.enabled is set to true.

The unique name of the Tenant.

The Id of a lambda that will be called to populate the JWT during a client credentials grant.

Note: A paid edition of FusionAuth is required to utilize client credentials grant.

The default method for encrypting the User’s password. The following encryptors are provided with FusionAuth:

• salted-md5

• salted-sha256

• salted-hmac-sha256

• salted-pbkdf2-hmac-sha256

• salted-pbkdf2-hmac-sha256-512   Available since 1.34.0

• bcrypt

The factor used by the password encryption scheme. If not provided, the PasswordEncryptor provides a default value. Generally this will be used as an iteration count to generate the hash. The actual use of this value is up to the PasswordEncryptor implementation.

When enabled a user’s hash configuration will be modified to match these configured settings. This can be useful to increase a password hash strength over time or upgrade imported users to a more secure encryption scheme after an initial import.

Whether to enable Reactor breach detection. Requires an activated license.

The level of severity where Reactor will consider a breach. The following are valid values:

• High Only requires a password match, this is the most secure and is recommended

• Medium Exact match on username, email address or email sub-address

• Low Exact match on an email or username, or the password is a common breached value

The Id of the email template to use when notifying user of breached password. Required if tenant.passwordValidationRules.breachDetection.onLogin is set to NotifyUser.

The behavior when detecting breaches at time of user login. The following are valid values:

• Off Do not perform breach detection at login

• RecordOnly Only record the result, take no action

• NotifyUser Notify the end user via email

• RequireChange Require immediate password change

The maximum length of a password when a new user is created or a user requests a password change.

The minimum length of a password when a new user is created or a user requests a password change.

The number of previous passwords to remember. Value must be greater than 0.

Whether to prevent a user from using any of their previous passwords.

Whether to force the user to use at least one uppercase and one lowercase character.

Whether to force the user to use at least one non-alphanumeric character.

Whether to force the user to use at least one number.

When enabled the user’s password will be validated during login. If the password does not meet the currently configured validation rules the user will be required to change their password.

Whether rate limiting is enabled for failed login.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

The number of times a user can fail to login within the configured timePeriodInSeconds duration. If a Failed authentication action has been configured then it will take precedence.

Required when enabled is set to true.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

The duration for the number of times a user can fail login before being rate limited.

Required when enabled is set to true.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

Whether rate limiting is enabled for forgot password.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

The number of times a user can request a forgot password email within the configured timePeriodInSeconds duration.

Required when enabled is set to true.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

The duration for the number of times a user can request a forgot password email before being rate limited.

Required when enabled is set to true.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

Whether rate limiting is enabled for send email verification.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

The number of times a user can request a verification email within the configured timePeriodInSeconds duration.

Required when enabled is set to true.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

The duration for the number of times a user can request a verification email before being rate limited.

Required when enabled is set to true.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

Whether rate limiting is enabled for send passwordless.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

The number of times a user can request a passwordless login email within the configured timePeriodInSeconds duration.

Required when enabled is set to true.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

The duration for the number of times a user can request a passwordless login email before being rate limited.

Required when enabled is set to true.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

Whether rate limiting is enabled for send registration verification.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

The number of times a user can request a registration verification email within the configured timePeriodInSeconds duration.

Required when enabled is set to true.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

The duration for the number of times a user can request a registration verification email before being rate limited.

Required when enabled is set to true.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

Whether rate limiting is enabled for send two factor.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

The number of times a user can request a two-factor code by email or SMS within the configured timePeriodInSeconds duration.

Required when enabled is set to true.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

The duration for the number of times a user can request a two-factor code by email or SMS before being rate limited.

Required when enabled is set to true.

Note: A paid edition of FusionAuth is required to utilize rate limiting.

A list of unique domains that are not allowed to register when self service is enabled.

Note: A paid edition of FusionAuth is required to utilize blocked domains.

The Entity Type that will be used to represent SCIM Clients for this tenant.

Note: An Enterprise version of FusionAuth is required to utilize SCIM.

Required when tenant.scimServerConfiguration.enabled is true.

Whether or not this tenant has the SCIM endpoints enabled.

Note: An Enterprise version of FusionAuth is required to utilize SCIM.

JSON formatted as a SCIM Schemas endpoint response. Because the SCIM lambdas may modify the JSON response, ensure the Schema’s response matches that generated by the response lambdas. More about Schema definitions.

When this parameter is not provided, it will default to EnterpriseUser, Group, and User schema definitions as defined by the SCIM core schemas spec.

Note: An Enterprise version of FusionAuth is required to utilize SCIM.

The Entity Type that will be used to represent SCIM Servers for this tenant.

Note: An Enterprise version of FusionAuth is required to utilize SCIM.

Required when tenant.scimServerConfiguration.enabled is true.

The number of seconds before a trusted device is reset. When reset, a user is forced to complete captcha during login and complete two factor authentication if applicable.

The unique Id of the theme to be used to style the login page and other end user templates.

Prior to version 1.30.0 this value was required.

Indicates that users without a verified email address will be permanently deleted after tenant.userDeletePolicy.unverified.numberOfDaysToRetain days.

The number of days from creation users will be retained before being deleted for not completing email verification. This field is required when tenant.userDeletePolicy.unverified.enabled is set to true. Value must be greater than 0.

When true, FusionAuth will handle username collisions by generating a random suffix.

Note: A paid edition of FusionAuth is required to utilize unique usernames.

The maximum number of digits to use when building a unique suffix for a username. A number will be randomly selected and will be 1 or more digits up to this configured value in length. For example, if this value is 5, the suffix will be a number between 00001 and 99999, inclusive. The value of this field must be greater than or equal to 3 and less than or equal to 10.

A single character to use as a separator from the requested username and a unique suffix that is added when a duplicate username is detected. This value can be a single non-alphanumeric ASCII character.

This strategy instructions FusionAuth when to append a unique suffix to the username. The possible values are:

• Always - Always append a unique suffix even when the requested username is not in use.

• OnCollision - Only append a unique suffix when the requested username is in use.

The Id of the IP Access Control List limiting access to this all applications in this tenant.

The type of captcha method to use.

Whether captcha configuration is enabled.

The secret key for this captcha method.

The site key for this captcha method.

The numeric threshold which separates a passing score from a failing one. This value only applies if using either the Google v3 or HCaptcha Enterprise method, otherwise this value is ignored.

Indicates the tenant has been configured. It is always true, except for default tenant when the setup wizard has not been completed, in which case it is false.

A list of Connector policies. Users will be authenticated against Connectors in order. Each Connector can be included in this list at most once and must exist.

The identifier of the Connector to which this policy refers.

An list of email domains to which this connector should apply.

A value of ["*"] indicates this connector applies to all users.

If true, the user’s data will be migrated to FusionAuth at first successful authentication; subsequent authentications will occur against the FusionAuth datastore. If false, the Connector’s source will be treated as authoritative.

An object that can hold any information about the Tenant that should be persisted.

The additional SMTP headers to be added to each outgoing email. Each SMTP header consists of a name and a value.

The default email address that emails will be sent from when a from address is not provided on an individual email template. This is the address part email address (i.e. Jared Dunn <jared@piedpiper.com>).

The default From Name used in sending emails when a from name is not provided on an individual email template. This is the display name part of the email address ( i.e. Jared Dunn <jared@piedpiper.com>).

The Id of the Email Template used to send emails to users to verify that their email address is valid.

The Id of the Email Template used to send emails to users when their email address is updated.

The Id of the Email Template used to verify user emails.

The Id of the Email Template that is used when a user is sent a forgot password email.

The host name of the SMTP server that FusionAuth will use.

Prior to version 1.28.0 this value was required.

When set to true, this allows email to be verified as a result of completing a similar email based workflow such as change password. When set to false, the user must explicitly complete the email verification workflow even if the user has already completed a similar email workflow such as change password.

The Id of the Email Template used to send emails to users when another user attempts to create an account with their login Id.

The Id of the Email Template used to send emails to users when another user attempts to update an existing account to use their login Id.

The Id of the Email Template used to send emails to users when they log in on a new device.

The Id of the Email Template used to send emails to users when a suspicious login occurs.

An optional password FusionAuth will use to authenticate with the SMTP server.

The Id of the Passwordless Email Template, sent to users when they start a passwordless login.

The Id of the Email Template used to send emails to users when they have completed a 'forgot password' workflow and their password has been reset.

The Id of the Email Template used to send emails to users when their password has been updated.

The port of the SMTP server that FusionAuth will use.

Prior to version 1.28.0 this value was required.

Additional Email Configuration in a properties file formatted String.

The type of security protocol FusionAuth will use when connecting to the SMTP server. The possible values are:

• NONE - no security will be used. All communications will be sent plaintext.

• SSL - SSL will be used to connect to the SMTP server. This protocol is not recommended unless it is the only one your SMTP server supports.

• TLS - TLS will be used to connect to the SMTP server. This is the preferred protocol for all SMTP servers.

The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password.

The Id of the Email Template used to send emails to users when a MFA method has been added to their account.

The Id of the Email Template used to send emails to users when a MFA method has been removed from their account.

When this value is set to true, the user is allowed to change their email address when they are gated because they haven’t verified their email address.

The desired behavior during login for a user that does not have a verified email. The possible values are:

• Allow - the user will be allowed to complete login.

• Gated - verification is required before a user can complete login. The use of this value will require a paid edition of FusionAuth.

An optional username FusionAuth will to authenticate with the SMTP server.

The Id of the Email Template used to send emails to users to verify that their email address is valid. If either the verifyEmail or verifyEmailWhenChanged fields are true, this field is required.

The process by which the user will verify their email address. The possible values are:

• ClickableLink - send the user a code with a clickable link.

• FormField - send the user a short code intended to be manually entered into a form field. This is only available when tenant.emailConfiguration.unverified.behavior has the Gated value.

Whether the user’s email addresses are verified when the registers with your application.

Whether the user’s email addresses are verified when the user changes them.

A mapping of the configuration for each event type that FusionAuth sends. The event types that are the keys into this Object are:

• audit-log.create - When an audit log is created Available since 1.30.0

• event-log.create - When an event log is created Available since 1.30.0

• jwt.public-key.update - When a JWT RSA Public / Private keypair may have been changed

• jwt.refresh - When an access token is refreshed using a refresh token Available since 1.16.0

• jwt.refresh-token.revoke - When a JWT Refresh Token is revoked

• kickstart.success - When kickstart has successfully completed Available since 1.30.0

• user.action - When a user action is triggered

• user.bulk.create - When multiple users are created in bulk (i.e. during an import)

• user.create - When a user is created

• user.create.complete - When a user create transaction has completed Available since 1.30.0

• user.deactivate - When a user is deactivated

• user.delete - When a user is deleted

• user.delete.complete - When a user delete transaction has completed Available since 1.30.0

• user.email.update - When a user updates their email address Available since 1.30.0

• user.email.verified - When a user verifies their email address Available since 1.8.0

• user.identity-provider.link - When a link is created from a user to an Identity Provider Available since 1.36.0

• user.identity-provider.unlink - When an existing Identity Provider link is removed from a User Available since 1.36.0

• user.loginId.duplicate.create - When a request to create a user with a login Id (email or username) which is already in use has been received Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.loginId.duplicate.update - When a request to update a user and change their login Id (email or username) to one that is already in use has been received Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.login.failed - When a user fails a login request Available since 1.6.0

• user.login.new-device - When a user begins a login request with a new device Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.login.success - When a user completes a login request Available since 1.6.0

• user.login.suspicious - When a user logs in and is considered to be a potential threat (requires an activated Enterprise license) Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.password.breach - When Reactor detects a user is using a potentially breached password (requires an activated license) Available since 1.15.0

  Note: A paid edition of FusionAuth is required to utilize this event.

• user.password.reset.send - When a forgot password email has been sent to a user Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.password.reset.start - When the process to reset a user password has started Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.password.reset.success - When a user has successfully reset their password Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.password.update - When a user has updated their password Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.reactivate - When a user is reactivated

• user.registration.create - When a user registration is created Available since 1.6.0

• user.registration.create.complete - When a user registration create transaction has completed Available since 1.30.0

• user.registration.delete - When a user registration is deleted Available since 1.6.0

• user.registration.delete.complete - When a user registration delete transaction has completed Available since 1.30.0

• user.registration.update - When a user registration is updated Available since 1.6.0

• user.registration.update.complete - When a user registration update transaction has completed Available since 1.30.0

• user.registration.verified - When a user completes registration verification Available since 1.8.0

• user.two-factor.method.add - When a user has added a two-factor method Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.two-factor.method.remove - When a user has removed a two-factor method Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.update - When a user is updated

• user.update.complete - When a user update transaction has completed Available since 1.30.0

Whether or not FusionAuth should send these types of events to any configured Webhooks.

The transaction type that FusionAuth uses when sending these types of events to any configured Webhooks. The transaction types are:

• None - No Webhooks are required to succeed for the FusionAuth transaction to be committed.

• Any - Only a single Webhook is required to succeed for the FusionAuth transaction to be committed.

• SimpleMajority - A simple majority (50% or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.

• SuperMajority - A super majority (2/3 or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.

• AbsoluteMajority - Every Webhook must succeed for the FusionAuth transaction to be committed.

The time in seconds until an OAuth authorization code is no longer valid to be exchanged for an access token. This is essentially the time allowed between the start of an Authorization request during the Authorization code grant and when you request an access token using this authorization code on the Token endpoint.

Value must be greater than 0 and less than or equal to 600.

The length of the secure generator used for generating the change password Id.

If the changePasswordIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the changePasswordIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the change password Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds until a change password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.

The time in seconds until a device code Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.

The length of the secure generator used for generating the device code Id.

If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the device code Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The length of the secure generator used for generating the the email verification Id.

If the emailVerificationIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the email verification Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds until an email verification Id is no longer valid and cannot be used by the Verify Email API. Value must be greater than 0.

The length of the secure generator used for generating the email verification one time code.

If the emailVerificationIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the email verification one time code. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds until an external authentication Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.

The time in seconds until a One Time Password is no longer valid and cannot be used by the Login API. Value must be greater than 0.

The length of the secure generator used for generating the passwordless login.

If the passwordlessLoginGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the passwordlessLoginGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the passwordless login. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds until a passwordless code is no longer valid and cannot be used by the Passwordless API. Value must be greater than 0.

The number of seconds before the pending account link identifier is no longer valid to complete an account link request.

The length of the secure generator used for generating the registration verification Id.

If the registrationVerificationIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the registration verification Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds until a registration verification Id is no longer valid and cannot be used by the Verify Registration API. Value must be greater than 0.

The length of the secure generator used for generating the registration verification one time code.

If the registrationVerificationIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the registration verification one time code. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds that a SAML AuthN request Id returned by the Start SAML v2 Login Request API will be eligible to be used to complete a SAML v2 Login request.

The length of the secure generator used for generating the setup password Id.

If the setupPasswordIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the setupPasswordIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the setup password Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds until a setup password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.

The number of seconds before the Trust Token is no longer valid to complete a request that requires trust. Value must be greater than 0.

The time in seconds until a two factor Id is no longer valid and cannot be used by the Two Factor Login API. Value must be greater than 0.

The length of the secure generator used for generating the the two factor one time code Id.

If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the two factor code Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The number of seconds before the Two-Factor One Time Code used to enable or disable a two-factor method is no longer valid. Must be greater than 0.

The time in seconds until an issued Two Factor trust Id is no longer valid and the User will be required to complete Two Factor authentication during the next authentication attempt. Value must be greater than 0.

The duration of the User Action. This value along with the actionDurationUnit will be used to set the duration of the User Action. Value must be greater than 0.

The unit of time associated with a duration. The possible values are:

• MINUTES

• HOURS

• DAYS

• WEEKS

• MONTHS

• YEARS

The length of time in seconds before the failed authentication count will be reset. Value must be greater than 0.

For example, if tooManyAttempts is set to 5 and you fail to authenticate 4 times in a row, waiting for the duration specified here will cause your fifth attempt to start back at 1.

The number of failed attempts considered to be too many. Once this threshold is reached the specified User Action will be applied to the user for the duration specified. Value must be greater than 0.

The Id of the User Action that is applied when the threshold is reached for too many failed authentication attempts.

Whether to allow child registrations.

The unique Id of the email template to use when confirming a child.

Indicates that child users without parental verification will be permanently deleted after tenant.familyConfiguration.deleteOrphanedAccountsDays days.

The number of days from creation child users will be retained before being deleted for not completing parental verification. Value must be greater than 0.

Whether family configuration is enabled.

The unique Id of the email template to use when a family request is made.

The maximum age of a child. Value must be greater than 0.

The minimum age to be an owner. Value must be greater than 0.

Whether a parent email is required.

The unique Id of the email template to use for parent registration.

The unique Id of the form to use for the Add and Edit User form when used in the FusionAuth admin UI.

Time in seconds until an inactive session will be invalidated. Used when creating a new session in the FusionAuth OAuth frontend.

The unique identifier for this Tenant.

The instant that the Tenant was added to the FusionAuth database.

The named issuer used to sign tokens, this is generally your public fully qualified domain.

The unique id of the signing key used to sign the access token.

The unique id of the signing key used to sign the Id token.

The refresh token expiration policy. The following are valid values:

• Fixed - the expiration is calculated from the time the token is issued.

• SlidingWindow - the expiration is calculated from the last time the token was used.

When enabled, the refresh token will be revoked when a user action, such as locking an account based on a number of failed login attempts, prevents user login.

When enabled, the refresh token will be revoked when a user changes their password.

The length of time in minutes a Refresh Token is valid from the time it was issued. Value must be greater than 0.

The refresh token usage policy. The following are valid values:

• Reusable - the token does not change after it was issued.

• OneTimeUse - the token value will be changed each time the token is used to refresh a JWT. The client must store the new value after each usage.

The length of time in seconds this JWT is valid from the time it was issued. Value must be greater than 0.

The Id of a SCIM User Request Lambda that will be used to convert the SCIM Enterprise User request to a FusionAuth User.

The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth Enterprise User to a SCIM Server response.

The Id of a SCIM Group Request Lambda that will be used to convert the SCIM Group request to a FusionAuth Group.

The Id of a SCIM GroupResponse Lambda that will be used to convert a FusionAuth Group to a SCIM Server response.

The Id of a SCIM User Request Lambda that will be used to convert the SCIM User request to a FusionAuth User.

The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth User to a SCIM Server response.

The instant that the Tenant was last updated in the FusionAuth database.

Indicates whether to require an API key for the Login API when an applicationId is not provided. When an applicationId is provided to the Login API call, the application configuration will take precedence.

The logout redirect URL when sending the user’s browser to the /oauth2/logout URI of the FusionAuth Front End. This value is only used when a logout URL is not defined in your Application.

The password maximum age in days. The number of days after which FusionAuth will require a user to change their password. Required when tenant.maximumPasswordAge.enabled is set to true.

Indicates that the maximum password age is enabled and being enforced.

The password minimum age in seconds. When enabled FusionAuth will not allow a password to be changed until it reaches this minimum age. Required when tenant.minimumPasswordAge.enabled is set to true.

Indicates that the minimum password age is enabled and being enforced.

The algorithm used by the TOTP authenticator. This value is HmacSHA1 and read only.

The length of the code generated by the TOTP. This value is 6 and read only.

When enabled, users may utilize an authenticator application to complete a multi-factor authentication request. This method uses TOTP (Time-Based One-Time Password) as defined in RFC 6238 and often uses an native mobile app such as Google Authenticator.

The time-step size in seconds. This value is 30 and read only.

When enabled, users may utilize an email address to complete a two-factor authentication request.

The Id of the email template that is used when notifying a user to complete a two-factor authentication request.

When enabled, users may utilize a mobile phone number to complete a two-factor authentication request.

The messenger that is used to deliver a SMS two-factor authentication request.

The Id of the SMS template that is used when notifying a user to complete a two-factor authentication request.

The unique name of the Tenant.

The Id of a lambda that will be called to populate the JWT during a client credentials grant.

The default method for encrypting the User’s password. The following encryptors are provided with FusionAuth:

• salted-md5

• salted-sha256

• salted-hmac-sha256

• salted-pbkdf2-hmac-sha256

• salted-pbkdf2-hmac-sha256-512   Available since 1.34.0

• bcrypt

The factor used by the password encryption scheme. If not provided, the PasswordEncryptor provides a default value. Generally this will be used as an iteration count to generate the hash. The actual use of this value is up to the PasswordEncryptor implementation.

When enabled a user’s hash configuration will be modified to match these configured settings. This can be useful to increase a password hash strength over time or upgrade imported users to a more secure encryption scheme after an initial import.

Whether to enable Reactor breach detection. Requires an activated license.

The level of severity where Reactor will consider a breach. The following are valid values:

• High Only requires a password match, this is the most secure and is recommended

• Medium Exact match on username, email address or email sub-address

• Low Exact match on an email or username, or the password is a common breached value

The Id of the email template to use when notifying a user of a breached password.

The behavior when detecting breaches at time of user login. The following are valid values:

• Off Do not perform breach detection at login

• RecordOnly Only record the result, take no action

• NotifyUser Notify the end user via email

• RequireChange Require immediate password change

The maximum length of a password when a new user is created or a user requests a password change.

The minimum length of a password when a new user is created or a user requests a password change.

The number of previous passwords to remember. Value must be greater than 0.

Whether to prevent a user from using any of their previous passwords.

Whether to force the user to use at least one uppercase and one lowercase character.

Whether to force the user to use at least one non-alphanumeric character.

Whether to force the user to use at least one number.

When enabled the user’s password will be validated during login. If the password does not meet the currently configured validation rules the user will be required to change their password.

The number of times a user can fail to login within the configured timePeriodInSeconds duration. If a Failed authentication action has been configured then it will take precedence.

The duration for the number of times a user can fail login before being rate limited.

The number of times a user can request a forgot password email within the configured timePeriodInSeconds duration.

The duration for the number of times a user can request a forgot password email before being rate limited.

The number of times a user can request a verification email within the configured timePeriodInSeconds duration.

The duration for the number of times a user can request a verification email before being rate limited.

The number of times a user can request a passwordless login email within the configured timePeriodInSeconds duration.

The duration for the number of times a user can request a passwordless login email before being rate limited.

The number of times a user can request a registration verification email within the configured timePeriodInSeconds duration.

The duration for the number of times a user can request a registration verification email before being rate limited.

The number of times a user can request a two-factor code by email or SMS within the configured timePeriodInSeconds duration.

The duration for the number of times a user can request a two-factor code by email or SMS before being rate limited.

A list of unique domains that are not allowed to register when self service is enabled.

The Entity Type that will be used to represent SCIM Clients for this tenant.

Whether or not this tenant has the SCIM endpoints enabled.

JSON formatted as a SCIM Schemas endpoint response. Because the SCIM lambdas may modify the JSON response, ensure the Schema’s response matches that generated by the response lambdas. More about Schema definitions.

The Entity Type that will be used to represent SCIM Servers for this tenant.

The number of seconds before a trusted device is reset. When reset, a user is forced to complete captcha during login and complete two factor authentication if applicable.

The current state of the tenant. The following are valid values:

• Active - The tenant is active.

• PendingDelete - A delete request has been requested and is being processed.

The unique Id of the theme to be used to style the login page and other end user templates.

Indicates that users without a verified email address will be permanently deleted after tenant.userDeletePolicy.unverified.numberOfDaysToRetain days.

The number of days from creation users will be retained before being deleted for not completing email verification. Value must be greater than 0.

When true, FusionAuth will handle username collisions by generating a random suffix. Users with colliding usernames will be able to use the same one, but in the admin and API interfaces, a unique username will be displayed.

The maximum number of digits to use when building a unique suffix for a username. A number will be randomly selected and will be 1 or more digits up to this configured value in length. For example, if this value is 5, the suffix will be a number between 00001 and 99999, inclusive.

A single character to use as a separator from the requested username and a unique suffix that is added when a duplicate username is detected. This value can be a single non alphanumeric ASCII character.

This strategy instructions FusionAuth when to append a unique suffix to the username. The possible values are:

• Always - Always append a unique suffix even when the requested username is not in use.

• OnCollision - Only append a unique suffix when the requested username is in use.

The unique Id of the Tenant to retrieve.

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

The Id of the IP Access Control List limiting access to this all applications in this tenant.

The type of captcha method to use.

Whether captcha configuration is enabled.

The secret key for this captcha method.

The site key for this captcha method.

The numeric threshold which separates a passing score from a failing one. This value only applies if using either the Google v3 or HCaptcha Enterprise method, otherwise this value is ignored.

Indicates the tenant has been configured. It is always true, except for default tenant when the setup wizard has not been completed, in which case it is false.

A list of Connector policies. Users will be authenticated against Connectors in order. Each Connector can be included in this list at most once and must exist.

The identifier of the Connector to which this policy refers.

An list of email domains to which this connector should apply.

A value of ["*"] indicates this connector applies to all users.

If true, the user’s data will be migrated to FusionAuth at first successful authentication; subsequent authentications will occur against the FusionAuth datastore. If false, the Connector’s source will be treated as authoritative.

An object that can hold any information about the Tenant that should be persisted.

The additional SMTP headers to be added to each outgoing email. Each SMTP header consists of a name and a value.

The default email address that emails will be sent from when a from address is not provided on an individual email template. This is the address part email address (i.e. Jared Dunn <jared@piedpiper.com>).

The default From Name used in sending emails when a from name is not provided on an individual email template. This is the display name part of the email address ( i.e. Jared Dunn <jared@piedpiper.com>).

The Id of the Email Template used to send emails to users to verify that their email address is valid.

The Id of the Email Template used to send emails to users when their email address is updated.

The Id of the Email Template used to verify user emails.

The Id of the Email Template that is used when a user is sent a forgot password email.

The host name of the SMTP server that FusionAuth will use.

Prior to version 1.28.0 this value was required.

When set to true, this allows email to be verified as a result of completing a similar email based workflow such as change password. When set to false, the user must explicitly complete the email verification workflow even if the user has already completed a similar email workflow such as change password.

The Id of the Email Template used to send emails to users when another user attempts to create an account with their login Id.

The Id of the Email Template used to send emails to users when another user attempts to update an existing account to use their login Id.

The Id of the Email Template used to send emails to users when they log in on a new device.

The Id of the Email Template used to send emails to users when a suspicious login occurs.

An optional password FusionAuth will use to authenticate with the SMTP server.

The Id of the Passwordless Email Template, sent to users when they start a passwordless login.

The Id of the Email Template used to send emails to users when they have completed a 'forgot password' workflow and their password has been reset.

The Id of the Email Template used to send emails to users when their password has been updated.

The port of the SMTP server that FusionAuth will use.

Prior to version 1.28.0 this value was required.

Additional Email Configuration in a properties file formatted String.

The type of security protocol FusionAuth will use when connecting to the SMTP server. The possible values are:

• NONE - no security will be used. All communications will be sent plaintext.

• SSL - SSL will be used to connect to the SMTP server. This protocol is not recommended unless it is the only one your SMTP server supports.

• TLS - TLS will be used to connect to the SMTP server. This is the preferred protocol for all SMTP servers.

The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password.

The Id of the Email Template used to send emails to users when a MFA method has been added to their account.

The Id of the Email Template used to send emails to users when a MFA method has been removed from their account.

When this value is set to true, the user is allowed to change their email address when they are gated because they haven’t verified their email address.

The desired behavior during login for a user that does not have a verified email. The possible values are:

• Allow - the user will be allowed to complete login.

• Gated - verification is required before a user can complete login. The use of this value will require a paid edition of FusionAuth.

An optional username FusionAuth will to authenticate with the SMTP server.

The Id of the Email Template used to send emails to users to verify that their email address is valid. If either the verifyEmail or verifyEmailWhenChanged fields are true, this field is required.

The process by which the user will verify their email address. The possible values are:

• ClickableLink - send the user a code with a clickable link.

• FormField - send the user a short code intended to be manually entered into a form field. This is only available when tenant.emailConfiguration.unverified.behavior has the Gated value.

Whether the user’s email addresses are verified when the registers with your application.

Whether the user’s email addresses are verified when the user changes them.

A mapping of the configuration for each event type that FusionAuth sends. The event types that are the keys into this Object are:

• audit-log.create - When an audit log is created Available since 1.30.0

• event-log.create - When an event log is created Available since 1.30.0

• jwt.public-key.update - When a JWT RSA Public / Private keypair may have been changed

• jwt.refresh - When an access token is refreshed using a refresh token Available since 1.16.0

• jwt.refresh-token.revoke - When a JWT Refresh Token is revoked

• kickstart.success - When kickstart has successfully completed Available since 1.30.0

• user.action - When a user action is triggered

• user.bulk.create - When multiple users are created in bulk (i.e. during an import)

• user.create - When a user is created

• user.create.complete - When a user create transaction has completed Available since 1.30.0

• user.deactivate - When a user is deactivated

• user.delete - When a user is deleted

• user.delete.complete - When a user delete transaction has completed Available since 1.30.0

• user.email.update - When a user updates their email address Available since 1.30.0

• user.email.verified - When a user verifies their email address Available since 1.8.0

• user.identity-provider.link - When a link is created from a user to an Identity Provider Available since 1.36.0

• user.identity-provider.unlink - When an existing Identity Provider link is removed from a User Available since 1.36.0

• user.loginId.duplicate.create - When a request to create a user with a login Id (email or username) which is already in use has been received Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.loginId.duplicate.update - When a request to update a user and change their login Id (email or username) to one that is already in use has been received Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.login.failed - When a user fails a login request Available since 1.6.0

• user.login.new-device - When a user begins a login request with a new device Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.login.success - When a user completes a login request Available since 1.6.0

• user.login.suspicious - When a user logs in and is considered to be a potential threat (requires an activated Enterprise license) Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.password.breach - When Reactor detects a user is using a potentially breached password (requires an activated license) Available since 1.15.0

  Note: A paid edition of FusionAuth is required to utilize this event.

• user.password.reset.send - When a forgot password email has been sent to a user Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.password.reset.start - When the process to reset a user password has started Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.password.reset.success - When a user has successfully reset their password Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.password.update - When a user has updated their password Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.reactivate - When a user is reactivated

• user.registration.create - When a user registration is created Available since 1.6.0

• user.registration.create.complete - When a user registration create transaction has completed Available since 1.30.0

• user.registration.delete - When a user registration is deleted Available since 1.6.0

• user.registration.delete.complete - When a user registration delete transaction has completed Available since 1.30.0

• user.registration.update - When a user registration is updated Available since 1.6.0

• user.registration.update.complete - When a user registration update transaction has completed Available since 1.30.0

• user.registration.verified - When a user completes registration verification Available since 1.8.0

• user.two-factor.method.add - When a user has added a two-factor method Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.two-factor.method.remove - When a user has removed a two-factor method Available since 1.30.0

  Note: An Enterprise version of FusionAuth is required to utilize this event.

• user.update - When a user is updated

• user.update.complete - When a user update transaction has completed Available since 1.30.0

Whether or not FusionAuth should send these types of events to any configured Webhooks.

The transaction type that FusionAuth uses when sending these types of events to any configured Webhooks. The transaction types are:

• None - No Webhooks are required to succeed for the FusionAuth transaction to be committed.

• Any - Only a single Webhook is required to succeed for the FusionAuth transaction to be committed.

• SimpleMajority - A simple majority (50% or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.

• SuperMajority - A super majority (2/3 or more) of Webhooks are required to succeed for the FusionAuth transaction to be committed.

• AbsoluteMajority - Every Webhook must succeed for the FusionAuth transaction to be committed.

The time in seconds until an OAuth authorization code is no longer valid to be exchanged for an access token. This is essentially the time allowed between the start of an Authorization request during the Authorization code grant and when you request an access token using this authorization code on the Token endpoint.

Value must be greater than 0 and less than or equal to 600.

The length of the secure generator used for generating the change password Id.

If the changePasswordIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the changePasswordIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the changePasswordIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the change password Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds until a change password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.

The time in seconds until a device code Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.

The length of the secure generator used for generating the device code Id.

If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the deviceCodeTimeToLiveInSeconds.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the device code Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The length of the secure generator used for generating the the email verification Id.

If the emailVerificationIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the email verification Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds until an email verification Id is no longer valid and cannot be used by the Verify Email API. Value must be greater than 0.

The length of the secure generator used for generating the email verification one time code.

If the emailVerificationIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the emailVerificationIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the emailVerificationIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the email verification one time code. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds until an external authentication Id is no longer valid and cannot be used by the Token API. Value must be greater than 0.

The time in seconds until a One Time Password is no longer valid and cannot be used by the Login API. Value must be greater than 0.

The length of the secure generator used for generating the passwordless login.

If the passwordlessLoginGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the passwordlessLoginGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the passwordlessLoginGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the passwordless login. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds until a passwordless code is no longer valid and cannot be used by the Passwordless API. Value must be greater than 0.

The number of seconds before the pending account link identifier is no longer valid to complete an account link request.

The length of the secure generator used for generating the registration verification Id.

If the registrationVerificationIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the registration verification Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds until a registration verification Id is no longer valid and cannot be used by the Verify Registration API. Value must be greater than 0.

The length of the secure generator used for generating the registration verification one time code.

If the registrationVerificationIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the registrationVerificationIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the registrationVerificationIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the registration verification one time code. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds that a SAML AuthN request Id returned by the Start SAML v2 Login Request API will be eligible to be used to complete a SAML v2 Login request.

The length of the secure generator used for generating the setup password Id.

If the setupPasswordIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the setupPasswordIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the setupPasswordIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the setup password Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The time in seconds until a setup password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0.

The number of seconds before the Trust Token is no longer valid to complete a request that requires trust. Value must be greater than 0.

The time in seconds until a two factor Id is no longer valid and cannot be used by the Two Factor Login API. Value must be greater than 0.

The length of the secure generator used for generating the the two factor one time code Id.

If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlpha then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomAlphaNumeric then the length must be greater or equal to 4 and less than or equal to 12.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomBytes then the length must be greater or equal to 16 and less than or equal to 128.
If the twoFactorOneTimeCodeIdGenerator.type is equal to randomDigits then the length must be greater or equal to 4 and less than or equal to 12.

The type of the secure generator used for generating the two factor code Id. Possible values are:

• randomAlpha

• randomAlphaNumeric

• randomBytes

• randomDigits

The number of seconds before the Two-Factor One Time Code used to enable or disable a two-factor method is no longer valid. Must be greater than 0.

The time in seconds until an issued Two Factor trust Id is no longer valid and the User will be required to complete Two Factor authentication during the next authentication attempt. Value must be greater than 0.

The duration of the User Action. This value along with the actionDurationUnit will be used to set the duration of the User Action. Value must be greater than 0.

The unit of time associated with a duration. The possible values are:

• MINUTES

• HOURS

• DAYS

• WEEKS

• MONTHS

• YEARS

The length of time in seconds before the failed authentication count will be reset. Value must be greater than 0.

For example, if tooManyAttempts is set to 5 and you fail to authenticate 4 times in a row, waiting for the duration specified here will cause your fifth attempt to start back at 1.

The number of failed attempts considered to be too many. Once this threshold is reached the specified User Action will be applied to the user for the duration specified. Value must be greater than 0.

The Id of the User Action that is applied when the threshold is reached for too many failed authentication attempts.

Whether to allow child registrations.

The unique Id of the email template to use when confirming a child.

Indicates that child users without parental verification will be permanently deleted after tenant.familyConfiguration.deleteOrphanedAccountsDays days.

The number of days from creation child users will be retained before being deleted for not completing parental verification. Value must be greater than 0.

Whether family configuration is enabled.

The unique Id of the email template to use when a family request is made.

The maximum age of a child. Value must be greater than 0.

The minimum age to be an owner. Value must be greater than 0.

Whether a parent email is required.

The unique Id of the email template to use for parent registration.

The unique Id of the form to use for the Add and Edit User form when used in the FusionAuth admin UI.

Time in seconds until an inactive session will be invalidated. Used when creating a new session in the FusionAuth OAuth frontend.

The unique identifier for this Tenant.

The instant that the Tenant was added to the FusionAuth database.

The named issuer used to sign tokens, this is generally your public fully qualified domain.

The unique id of the signing key used to sign the access token.

The unique id of the signing key used to sign the Id token.

The refresh token expiration policy. The following are valid values:

• Fixed - the expiration is calculated from the time the token is issued.

• SlidingWindow - the expiration is calculated from the last time the token was used.

When enabled, the refresh token will be revoked when a user action, such as locking an account based on a number of failed login attempts, prevents user login.

When enabled, the refresh token will be revoked when a user changes their password.

The length of time in minutes a Refresh Token is valid from the time it was issued. Value must be greater than 0.

The refresh token usage policy. The following are valid values:

• Reusable - the token does not change after it was issued.

• OneTimeUse - the token value will be changed each time the token is used to refresh a JWT. The client must store the new value after each usage.

The length of time in seconds this JWT is valid from the time it was issued. Value must be greater than 0.

The Id of a SCIM User Request Lambda that will be used to convert the SCIM Enterprise User request to a FusionAuth User.

The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth Enterprise User to a SCIM Server response.

The Id of a SCIM Group Request Lambda that will be used to convert the SCIM Group request to a FusionAuth Group.

The Id of a SCIM GroupResponse Lambda that will be used to convert a FusionAuth Group to a SCIM Server response.

The Id of a SCIM User Request Lambda that will be used to convert the SCIM User request to a FusionAuth User.

The Id of a SCIM User Response Lambda that will be used to convert a FusionAuth User to a SCIM Server response.

The instant that the Tenant was last updated in the FusionAuth database.

Indicates whether to require an API key for the Login API when an applicationId is not provided. When an applicationId is provided to the Login API call, the application configuration will take precedence.

The logout redirect URL when sending the user’s browser to the /oauth2/logout URI of the FusionAuth Front End. This value is only used when a logout URL is not defined in your Application.

The password maximum age in days. The number of days after which FusionAuth will require a user to change their password. Required when tenant.maximumPasswordAge.enabled is set to true.

Indicates that the maximum password age is enabled and being enforced.

The password minimum age in seconds. When enabled FusionAuth will not allow a password to be changed until it reaches this minimum age. Required when tenant.minimumPasswordAge.enabled is set to true.

Indicates that the minimum password age is enabled and being enforced.

The algorithm used by the TOTP authenticator. This value is HmacSHA1 and read only.

The length of the code generated by the TOTP. This value is 6 and read only.

When enabled, users may utilize an authenticator application to complete a multi-factor authentication request. This method uses TOTP (Time-Based One-Time Password) as defined in RFC 6238 and often uses an native mobile app such as Google Authenticator.

The time-step size in seconds. This value is 30 and read only.

When enabled, users may utilize an email address to complete a two-factor authentication request.

The Id of the email template that is used when notifying a user to complete a two-factor authentication request.

When enabled, users may utilize a mobile phone number to complete a two-factor authentication request.

The messenger that is used to deliver a SMS two-factor authentication request.

The Id of the SMS template that is used when notifying a user to complete a two-factor authentication request.

The unique name of the Tenant.

The Id of a lambda that will be called to populate the JWT during a client credentials grant.

The default method for encrypting the User’s password. The following encryptors are provided with FusionAuth:

• salted-md5

• salted-sha256

• salted-hmac-sha256

• salted-pbkdf2-hmac-sha256

• salted-pbkdf2-hmac-sha256-512   Available since 1.34.0

• bcrypt

The factor used by the password encryption scheme. If not provided, the PasswordEncryptor provides a default value. Generally this will be used as an iteration count to generate the hash. The actual use of this value is up to the PasswordEncryptor implementation.

When enabled a user’s hash configuration will be modified to match these configured settings. This can be useful to increase a password hash strength over time or upgrade imported users to a more secure encryption scheme after an initial import.

Whether to enable Reactor breach detection. Requires an activated license.

The level of severity where Reactor will consider a breach. The following are valid values:

• High Only requires a password match, this is the most secure and is recommended

• Medium Exact match on username, email address or email sub-address

• Low Exact match on an email or username, or the password is a common breached value

The Id of the email template to use when notifying a user of a breached password.

The behavior when detecting breaches at time of user login. The following are valid values:

• Off Do not perform breach detection at login

• RecordOnly Only record the result, take no action

• NotifyUser Notify the end user via email

• RequireChange Require immediate password change

The maximum length of a password when a new user is created or a user requests a password change.

The minimum length of a password when a new user is created or a user requests a password change.

The number of previous passwords to remember. Value must be greater than 0.

Whether to prevent a user from using any of their previous passwords.

Whether to force the user to use at least one uppercase and one lowercase character.

Whether to force the user to use at least one non-alphanumeric character.

Whether to force the user to use at least one number.

When enabled the user’s password will be validated during login. If the password does not meet the currently configured validation rules the user will be required to change their password.

The number of times a user can fail to login within the configured timePeriodInSeconds duration. If a Failed authentication action has been configured then it will take precedence.

The duration for the number of times a user can fail login before being rate limited.

The number of times a user can request a forgot password email within the configured timePeriodInSeconds duration.

The duration for the number of times a user can request a forgot password email before being rate limited.

The number of times a user can request a verification email within the configured timePeriodInSeconds duration.

The duration for the number of times a user can request a verification email before being rate limited.

The number of times a user can request a passwordless login email within the configured timePeriodInSeconds duration.

The duration for the number of times a user can request a passwordless login email before being rate limited.

The number of times a user can request a registration verification email within the configured timePeriodInSeconds duration.

The duration for the number of times a user can request a registration verification email before being rate limited.

The number of times a user can request a two-factor code by email or SMS within the configured timePeriodInSeconds duration.

The duration for the number of times a user can request a two-factor code by email or SMS before being rate limited.

A list of unique domains that are not allowed to register when self service is enabled.

The Entity Type that will be used to represent SCIM Clients for this tenant.

Whether or not this tenant has the SCIM endpoints enabled.

JSON formatted as a SCIM Schemas endpoint response. Because the SCIM lambdas may modify the JSON response, ensure the Schema’s response matches that generated by the response lambdas. More about Schema definitions.

The Entity Type that will be used to represent SCIM Servers for this tenant.

The number of seconds before a trusted device is reset. When reset, a user is forced to complete captcha during login and complete two factor authentication if applicable.

The current state of the tenant. The following are valid values:

• Active - The tenant is active.

• PendingDelete - A delete request has been requested and is being processed.

The unique Id of the theme to be used to style the login page and other end user templates.

Indicates that users without a verified email address will be permanently deleted after tenant.userDeletePolicy.unverified.numberOfDaysToRetain days.

The number of days from creation users will be retained before being deleted for not completing email verification. Value must be greater than 0.

When true, FusionAuth will handle username collisions by generating a random suffix. Users with colliding usernames will be able to use the same one, but in the admin and API interfaces, a unique username will be displayed.

The maximum number of digits to use when building a unique suffix for a username. A number will be randomly selected and will be 1 or more digits up to this configured value in length. For example, if this value is 5, the suffix will be a number between 00001 and 99999, inclusive.

A single character to use as a separator from the requested username and a unique suffix that is added when a duplicate username is detected. This value can be a single non alphanumeric ASCII character.

This strategy instructions FusionAuth when to append a unique suffix to the username. The possible values are:

• Always - Always append a unique suffix even when the requested username is not in use.

• OnCollision - Only append a unique suffix when the requested username is in use.