Two Factor APIs

Overview

Enable Two Factor

This API is used to enable Two Factor authentication for a single User. To use this API the User must provide a valid Two Factor verification code.

To enable using TextMessage delivery, you may use the Two Factor Send API to deliver a code to the User, the User will then provide this code as input.

Request

Enable Two Factor Authentication

URI

POST /api/user/two-factor/{userId}

Request Parameters

userId [UUID] Required

The Id of the User to enable Two Factor authentication.

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Enable Two Factor Authentication

URI

POST /api/user/two-factor

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Body

code [String] Required

A valid Two Factor verification code. This value should be provided by the User to verify they are able to produce codes using an application or receive them using their mobile phone.

delivery [String] Required

The User’s preferred delivery for verification codes during a two factor login request.

The possible values are:

  • None

  • TextMessage

    When using TextMessage the User will also need a valid mobilePhone. The User’s mobile phone is not validated during this request. Because the code is provided on this request it is assumed the User has been able to receive a code on their mobile phone when setting the delivery to TextMessage.

secret [String] Required

The raw Two Factor secret used to generate the verification code provided on this request. You can technically pass in any value you want here, but in most cases, this is a randomly generate byte array that is Base-64 encoded. If you are bringing over a secret from a third-party system that is Base-32 encoded, you will want to decode that value and Base-64 encode it and pass the Base-64 encoded value in here.

You may optionally use value provided in the secret field returned by the Two Factor Secret API instead of generating this value yourself. This value is a random byte array that is Base-64 encoded.

Example Request JSON
{
  "code": "435612",
  "delivery": "None",
  "secret": "8MJJfCY4ERBtotvenSc3"
}

Response

Table 1. Response Codes
Code Description

200

The request was successful. Two Factor has been enabled for the User.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

404

The User does not exist. The response will be empty.

421

The code request parameter is not valid. The response will be empty.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Disable Two Factor

This API is used to disable Two Factor authentication for a single User. To use this API the User must provide a valid Two Factor verification code.

If the User has configured TextMessage delivery, you may use the Two Factor Send API to deliver a code to the User, the User will then provide this code as input.

Request

Disable Two Factor Authentication

URI

DELETE /api/user/two-factor/{userId}?code={code}

Request Parameters

userId [UUID] Required

The Id of the User to enable Two Factor authentication.

code [String] Required

The time based one time use password, also called a Two Factor verification code.

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Disable Two Factor Authentication

URI

DELETE /api/user/two-factor?code={code}

Request Parameters

code [String] Required

The time based one time use password, also called a Two Factor verification code.

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Response

Table 2. Response Codes
Code Description

200

The request was successful. Two Factor has been disabled for the User.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

404

The User does not exist. The response will be empty.

421

The code request parameter is not valid. The response will be empty.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Send a Two Factor Code

This API is used to send a Two Factor verification code to a User. This may be useful during Two Factor authentication if the initial code is no longer valid. It may be also used to send a code to a User to assist in enabling or disabling Two Factor authentication.

To send a code to a User that already has Two Factor enabled, it is not required they have TextMessage set as their preferred delivery. As long as the User has a mobile phone defined you may send the User a code.

This API requires that the Twilio integration is enabled and configured properly.

Request

Send a Two Factor code to an existing User by Id

URI

POST /api/two-factor/send

This request is intended to be used to send a Two Factor code to a User that already has enabled Two Factor authentication to assist in disabling Two Factor authentication. The User must already have Two Factor enabled and have a valid mobile phone for this to succeed.

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Body

userId [UUID] Required

The User Id of the User to send a Two Factor verification code. This User is expected to already have Two Factor enabled.

Example Request JSON
{
  "userId": "c075e472-a732-47d6-865a-d385a5fcb525"
}

Send a Two Factor code to a mobile phone

URI

POST /api/two-factor/send

This request is intended to be used to send a Two Factor code to a User to assist in enabling Two Factor authentication.

Request Body

mobilePhone [String] Required

A mobile phone to send the Two Factor verification code.

secret [String] Required

The Two Factor secret used to generate a Two Factor verification code to send to the provided mobile phone.

You may optionally use value provided in the secret field returned by the Two Factor Secret API instead of generating this value yourself.

Example Request JSON
{
  "mobilePhone": "555-555-5555",
  "secret": "8MJJfCY4ERBtotvenSc3"
}

Send a Two Factor code to complete Two Factor Login

URI

POST /api/two-factor/send/{twoFactorId}

This request is intended to send additional messages to the User’s mobile phone during login.

Request Parameters

twoFactorId [String] Required

The twoFactorId returned by the Login API.

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Send a Two Factor code to an authenticated User using a JWT

URI

POST /api/two-factor/send

This request is intended to be used to send a Two Factor code to a User that already has enabled Two Factor authentication to assist in disabling Two Factor authentication. When using JWT authentication the User’s Id is retrieved from the JWT. The User must already have Two Factor enabled and have a valid mobile phone for this to succeed.

Request Headers

X-FusionAuth-TenantId [String] Optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Response

Table 3. Response Codes
Code Description

200

The request was successful.

400

The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Generate a Secret

This API is used to generate a new Two Factor secret for use when enabling Two Factor authentication for a User. This is provided as a helper to assist you in enabling Two Factor authentication.

If this secret will be used with a QR code to allow the User to scan the value it will need utilize the Base32 encoded value returned in the response.

Request

Generate a Two Factor Secret

URI

GET /api/two-factor/secret

Generate a Two Factor Secret

URI

GET /api/two-factor/secret

Response

The response for this API contains the a Two Factor secret.

Table 4. Response Codes
Code Description

200

The request was successful. The response will contain a JSON body.

401

You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

500

There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

503

The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Response Body

secret [String]

A Base64 encoded secret that may be used to enable Two Factor authentication.

secretBase32Encoded [String]

A Base32 encoded form of the provided secret. This useful if you need to provide a QR code to the User to enable Two Factor authentication.

Example Response JSON
{
  "secret": "8MJJfCY4ERBtotvenSc3",
  "secretBase32Encoded": "HBGUUSTGINMTIRKSIJ2G65DWMVXFGYZT"
}