Pre 1.26 Two Factor APIs (Deprecated)

    Overview

    This documentation is for version 1.25 and earlier. Breaking changes were introduced to this API in 1.26.

    Do not use this API unless you are on a version of FusionAuth earlier than 1.26. You can view the current two factor documentation if you are on version 1.26 or higher.

    Enable Two Factor

    This API is used to enable Two Factor authentication for a single User. To use this API the User must provide a valid Two Factor verification code.

    To enable using TextMessage delivery, you may use the Two Factor Send API to deliver a code to the User, the User will then provide this code as input.

    Request

    Enable Two Factor Authentication

    URI

    POST /api/user/two-factor/{userId}

    Request Parameters

    userId [UUID] Required

    The Id of the User to enable Two Factor authentication.

    Request Headers

    X-FusionAuth-TenantId [String] Optional

    The unique Id of the tenant used to scope this API request.

    The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

    Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

    See Making an API request using a Tenant Id for additional information.

    Enable Two Factor Authentication

    URI

    POST /api/user/two-factor

    Request Headers

    X-FusionAuth-TenantId [String] Optional

    The unique Id of the tenant used to scope this API request.

    The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

    Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

    See Making an API request using a Tenant Id for additional information.

    Request Body

    code [String] Required

    A valid Two Factor verification code. This value should be provided by the User to verify they are able to produce codes using an application or receive them using their mobile phone.

    delivery [String] Required

    The User’s preferred delivery for verification codes during a two factor login request.

    The possible values are:

    • None

    • TextMessage

      When using TextMessage the User will also need a valid mobilePhone. The User’s mobile phone is not validated during this request. Because the code is provided on this request it is assumed the User has been able to receive a code on their mobile phone when setting the delivery to TextMessage.

    secret [String] Optional

    A base64 encoded secret.

    You may optionally use the secret value returned by the Two Factor Secret API instead of generating this value yourself. This value is a secure random byte array that is Base-64 encoded.

    If you omit this field, then secretBase32Encoded is required.

    secretBase32Encoded [String] Optional

    A base32 encoded secret.

    You may optionally use the secretBase32Encoded value returned by the Two Factor Secret API instead of generating this value yourself. This value is a secure random byte array that is Base-32 encoded.

    If you omit this field, then secret is required.

    Example Request JSON
    
{
  "code": "435612",
  "delivery": "None",
  "secret": "8MJJfCY4ERBtotvenSc3"
}

    Response

    Table 1. Response Codes
    Code Description

    200

    The request was successful. Two Factor has been enabled for the User.

    400

    The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

    401

    You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

    404

    The User does not exist. The response will be empty.

    421

    The code request parameter is not valid. The response will be empty.

    500

    There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

    503

    The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

    Disable Two Factor

    This API is used to disable Two Factor authentication for a single User. To use this API the User must provide a valid Two Factor verification code.

    If the User has configured TextMessage delivery, you may use the Two Factor Send API to deliver a code to the User, the User will then provide this code as input.

    Request

    Disable Two Factor Authentication

    URI

    DELETE /api/user/two-factor/{userId}?code={code}

    Request Parameters

    userId [UUID] Required

    The Id of the User to enable Two Factor authentication.

    code [String] Required

    The time based one time use password, also called a Two Factor verification code.

    Request Headers

    X-FusionAuth-TenantId [String] Optional

    The unique Id of the tenant used to scope this API request.

    The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

    Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

    See Making an API request using a Tenant Id for additional information.

    Disable Two Factor Authentication

    URI

    DELETE /api/user/two-factor?code={code}

    Request Parameters

    code [String] Required

    The time based one time use password, also called a Two Factor verification code.

    Request Headers

    X-FusionAuth-TenantId [String] Optional

    The unique Id of the tenant used to scope this API request.

    The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

    Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

    See Making an API request using a Tenant Id for additional information.

    Response

    Table 2. Response Codes
    Code Description

    200

    The request was successful. Two Factor has been disabled for the User.

    400

    The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.

    401

    You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

    404

    The User does not exist. The response will be empty.

    421

    The code request parameter is not valid. The response will be empty.

    500

    There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

    503

    The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

    Send a Two Factor Code

    This API is used to send a Two Factor verification code to a User. This may be useful during Two Factor authentication if the initial code is no longer valid. It may be also used to send a code to a User to assist in enabling or disabling Two Factor authentication.

    To send a code to a User that already has Two Factor enabled, it is not required they have TextMessage set as their preferred delivery. As long as the User has a mobile phone defined you may send the User a code.

    This API requires that the Twilio integration is enabled and configured properly.

    Request

    Send a Two Factor code to an existing User by Id

    URI

    POST /api/two-factor/send

    This request is intended to be used to send a Two Factor code to a User that already has enabled Two Factor authentication to assist in disabling Two Factor authentication. The User must already have Two Factor enabled and have a valid mobile phone for this to succeed.

    Request Headers

    X-FusionAuth-TenantId [String] Optional

    The unique Id of the tenant used to scope this API request.

    The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

    Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

    See Making an API request using a Tenant Id for additional information.

    Request Body

    userId [UUID] Required

    The User Id of the User to send a Two Factor verification code. This User is expected to already have Two Factor enabled.

    Example Request JSON
    
{
  "userId": "c075e472-a732-47d6-865a-d385a5fcb525"
}

    Send a Two Factor code to a mobile phone

    URI

    POST /api/two-factor/send

    This request is intended to be used to send a Two Factor code to a User to assist in enabling Two Factor authentication.

    Request Body

    mobilePhone [String] Required

    A mobile phone to send the Two Factor verification code.

    secret [String] Required

    The Two Factor secret used to generate a Two Factor verification code to send to the provided mobile phone.

    You may optionally use value provided in the secret field returned by the Two Factor Secret API instead of generating this value yourself.

    Example Request JSON
    
{
  "mobilePhone": "555-555-5555",
  "secret": "8MJJfCY4ERBtotvenSc3"
}

    Send a Two Factor code to complete Two Factor Login

    URI

    POST /api/two-factor/send/{twoFactorId}

    This request is intended to send additional messages to the User’s mobile phone during login.

    Request Parameters

    twoFactorId [String] Required

    The twoFactorId returned by the Login API.

    Request Headers

    X-FusionAuth-TenantId [String] Optional

    The unique Id of the tenant used to scope this API request.

    The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

    Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

    See Making an API request using a Tenant Id for additional information.

    Send a Two Factor code to an authenticated User using a JWT

    URI

    POST /api/two-factor/send

    This request is intended to be used to send a Two Factor code to a User that already has enabled Two Factor authentication to assist in disabling Two Factor authentication. When using JWT authentication the User’s Id is retrieved from the JWT. The User must already have Two Factor enabled and have a valid mobile phone for this to succeed.

    Request Headers

    X-FusionAuth-TenantId [String] Optional

    The unique Id of the tenant used to scope this API request.

    The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

    Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

    See Making an API request using a Tenant Id for additional information.

    Response

    Table 3. Response Codes
    Code Description

    200

    The request was successful.

    400

    The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.

    401

    You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

    500

    There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

    503

    The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

    Generate a Secret

    This API is used to generate a new Two Factor secret for use when enabling Two Factor authentication for a User. This is provided as a helper to assist you in enabling Two Factor authentication.

    If this secret will be used with a QR code to allow the User to scan the value it will need utilize the Base32 encoded value returned in the response.

    Request

    Generate a Two Factor Secret

    URI

    GET /api/two-factor/secret

    Generate a Two Factor Secret

    URI

    GET /api/two-factor/secret

    Response

    The response for this API contains the a Two Factor secret.

    Table 4. Response Codes
    Code Description

    200

    The request was successful. The response will contain a JSON body.

    401

    You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.

    500

    There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

    503

    The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

    Response Body

    secret [String]

    A Base64 encoded secret that may be used to enable Two Factor authentication.

    secretBase32Encoded [String]

    A Base32 encoded form of the provided secret. This useful if you need to provide a QR code to the User to enable Two Factor authentication.

    Example Response JSON
    
{
  "secret": "8MJJfCY4ERBtotvenSc3",
  "secretBase32Encoded": "HBGUUSTGINMTIRKSIJ2G65DWMVXFGYZT"
}

    Feedback

    How helpful was this page?

    See a problem?

    File an issue in our docs repo

    Have a question or comment to share?

    Visit the FusionAuth community forum.