Two Factor APIs - FusionAuth

1. Overview

Enable Two Factor
Disable Two Factor
Send a Two Factor Code
Generate a Secret

2. Enable Two Factor

This API is used to enable Two Factor authentication for a single User. To use this API the User must provide a valid Two Factor verification code.

To enable using TextMessage delivery, you may use the Two Factor Send API to deliver a code to the User, the User will then provide this code as input.

2.1. Request

Enable Two Factor Authentication

URI

POST /api/user/two-factor/{userId}

Table 1. Request Parameters
userId [UUID] Required	The Id of the User to enable Two Factor authentication.

Table 2. Request Headers
X-FusionAuth-TenantId [String] Optional	The unique Id of the tenant used to scope this API request. The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required. Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result. See Making an API request using a Tenant Id for additional information.

Enable Two Factor Authentication

URI

POST /api/user/two-factor

Table 3. Request Headers
X-FusionAuth-TenantId [String] Optional	The unique Id of the tenant used to scope this API request. The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required. Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result. See Making an API request using a Tenant Id for additional information.

Table 4. Request Body
code [String] Required	A valid Two Factor verification code. This value should be provided by the User to verify they are able to produce codes using an application or receive them using their mobile phone.
delivery [String] Required	The User’s preferred delivery for verification codes during a two factor login request. The possible values are: `None` `TextMessage` When using `TextMessage` the User will also need a valid `mobilePhone`. The User’s mobile phone is not validated during this request. Because the `code` is provided on this request it is assumed the User has been able to receive a `code` on their mobile phone when setting the delivery to `TextMessage`.
secret [String] Required	The raw Two Factor secret used to generate the verification code provided on this request. You can technically pass in any value you want here, but in most cases, this is a randomly generate byte array that is Base-64 encoded. If you are bringing over a secret from a third-party system that is Base-32 encoded, you will want to decode that value and Base-64 encode it and pass the Base-64 encoded value in here. You may optionally use value provided in the `secret` field returned by the Two Factor Secret API instead of generating this value yourself. This value is a random byte array that is Base-64 encoded.

Example Request JSON

{
  "code": "435612",
  "delivery": "None",
  "secret": "8MJJfCY4ERBtotvenSc3"
}

2.2. Response

Table 5. Response Codes
Code	Description
200	The request was successful. Two Factor has been enabled for the User.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404	The User does not exist. The response will be empty.
421	The `code` request parameter is not valid. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

3. Disable Two Factor

This API is used to disable Two Factor authentication for a single User. To use this API the User must provide a valid Two Factor verification code.

If the User has configured TextMessage delivery, you may use the Two Factor Send API to deliver a code to the User, the User will then provide this code as input.

3.1. Request

Disable Two Factor Authentication

URI

DELETE /api/user/two-factor/{userId}?code={code}

Table 6. Request Parameters
userId [UUID] Required	The Id of the User to enable Two Factor authentication.
code [String] Required	The time based one time use password, also called a Two Factor verification code.

Table 7. Request Headers
X-FusionAuth-TenantId [String] Optional	The unique Id of the tenant used to scope this API request. The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required. Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result. See Making an API request using a Tenant Id for additional information.

Disable Two Factor Authentication

URI

DELETE /api/user/two-factor?code={code}

Table 8. Request Parameters
code [String] Required	The time based one time use password, also called a Two Factor verification code.

Table 9. Request Headers
X-FusionAuth-TenantId [String] Optional	The unique Id of the tenant used to scope this API request. The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required. Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result. See Making an API request using a Tenant Id for additional information.

3.2. Response

Table 10. Response Codes
Code	Description
200	The request was successful. Two Factor has been disabled for the User.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404	The User does not exist. The response will be empty.
421	The `code` request parameter is not valid. The response will be empty.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

4. Send a Two Factor Code

This API is used to send a Two Factor verification code to a User. This may be useful during Two Factor authentication if the initial code is no longer valid. It may be also used to send a code to a User to assist in enabling or disabling Two Factor authentication.

To send a code to a User that already has Two Factor enabled, it is not required they have TextMessage set as their preferred delivery. As long as the User has a mobile phone defined you may send the User a code.

This API requires that the Twilio integration is enabled and configured properly.

4.1. Request

Send a Two Factor code to an existing User by Id

URI

POST /api/two-factor/send

This request is intended to be used to send a Two Factor code to a User that already has enabled Two Factor authentication to assist in disabling Two Factor authentication. The User must already have Two Factor enabled and have a valid mobile phone for this to succeed.

Table 11. Request Headers
X-FusionAuth-TenantId [String] Optional	The unique Id of the tenant used to scope this API request. The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required. Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result. See Making an API request using a Tenant Id for additional information.

Table 12. Request Body
userId [UUID] Required	The User Id of the User to send a Two Factor verification code. This User is expected to already have Two Factor enabled.

Example Request JSON

{
  "userId": "c075e472-a732-47d6-865a-d385a5fcb525"
}

Send a Two Factor code to a mobile phone

URI

POST /api/two-factor/send

This request is intended to be used to send a Two Factor code to a User to assist in enabling Two Factor authentication.

Table 13. Request Body
mobilePhone [String] Required	A mobile phone to send the Two Factor verification code.
secret [String] Required	The Two Factor secret used to generate a Two Factor verification code to send to the provided mobile phone. You may optionally use value provided in the `secret` field returned by the Two Factor Secret API instead of generating this value yourself.

Example Request JSON

{
  "mobilePhone": "555-555-5555",
  "secret": "8MJJfCY4ERBtotvenSc3"
}

Send a Two Factor code to complete Two Factor Login

URI

POST /api/two-factor/send/{twoFactorId}

This request is intended to send additional messages to the User’s mobile phone during login.

Table 14. Request Parameters
twoFactorId [String] Required	The `twoFactorId` returned by the Login API.

Table 15. Request Headers
X-FusionAuth-TenantId [String] Optional	The unique Id of the tenant used to scope this API request. The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required. Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result. See Making an API request using a Tenant Id for additional information.

Send a Two Factor code to an authenticated User using a JWT

URI

POST /api/two-factor/send

This request is intended to be used to send a Two Factor code to a User that already has enabled Two Factor authentication to assist in disabling Two Factor authentication. When using JWT authentication the User’s Id is retrieved from the JWT. The User must already have Two Factor enabled and have a valid mobile phone for this to succeed.

Table 16. Request Headers
X-FusionAuth-TenantId [String] Optional	The unique Id of the tenant used to scope this API request. The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required. Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result. See Making an API request using a Tenant Id for additional information.

4.2. Response

Table 17. Response Codes
Code	Description
200	The request was successful.
400	The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

5. Generate a Secret

This API is used to generate a new Two Factor secret for use when enabling Two Factor authentication for a User. This is provided as a helper to assist you in enabling Two Factor authentication.

If this secret will be used with a QR code to allow the User to scan the value it will need utilize the Base32 encoded value returned in the response.

5.1. Request

Generate a Two Factor Secret

URI

GET /api/two-factor/secret

Generate a Two Factor Secret

URI

GET /api/two-factor/secret

5.2. Response

The response for this API contains the a Two Factor secret.

Table 18. Response Codes
Code	Description
200	The request was successful. The response will contain a JSON body.
401	You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500	There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503	The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Table 19. Response Body
secret [String]	A Base64 encoded secret that may be used to enable Two Factor authentication.
secretBase32Encoded [String]	A Base32 encoded form of the provided secret. This useful if you need to provide a QR code to the User to enable Two Factor authentication.

Example Response JSON

{
  "secret": "8MJJfCY4ERBtotvenSc3",
  "secretBase32Encoded": "HBGUUSTGINMTIRKSIJ2G65DWMVXFGYZT"
}