---
title: "Require two-step sign-in, limit session age and idle time, shorten the re-authentication window."
method: PATCH
path: "/v1/organizations/current/security-policies"
tags: ["organizations"]
---

# Require two-step sign-in, limit session age and idle time, shorten the re-authentication window.

`PATCH /v1/organizations/current/security-policies`

## Request

- Base URL: `https://api.50heads.com`
- URL: `https://api.50heads.com/v1/organizations/current/security-policies`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://auth.50heads.com/authorize`, token URL `https://auth.50heads.com/token`; client credentials, token URL `https://auth.50heads.com/token`, scopes: `organization:write`)

Organization admins only (403 `organization_admin_required`). Signed in, with a fresh proof in the `x-50h-reauth` header (401 `reauth_required`); with an API key, a connected app or a service account, with the scope named here and no proof, where the organization has machine identities (otherwise 403 `session_required`). The key's or app's person must be an organization admin. Every change is written to the organization's audit, with who made it (a person, a key, an app or a service account). Policies apply to new and existing sessions: a session older than a new maximum ends on its next request (401 `session_ended`), and an OAuth refresh older than it answers `invalid_grant`. With two-step required, sensitive actions answer 403 `two_step_required` until the person adds two-step sign-in or a passkey; adding one is never blocked. Sends a `policy.changed` event.

## Request body

- OrganizationSecurityPoliciesUpdateRequest
  - `requireTwoStep` boolean
  - `maxSessionAgeMinutes` integer, nullable
  - `idleTimeoutMinutes` integer, nullable
  - `reauthWindowMinutes` integer, nullable

## Response `200`

OK

- OrganizationSecurityPoliciesUpdateResponse
  - `policies` object, required
    - `requireTwoStep` boolean, required
    - `maxSessionAgeMinutes` integer, nullable, required
    - `idleTimeoutMinutes` integer, nullable, required
    - `reauthWindowMinutes` integer, nullable, required

## Other responses

- `400`: The request is not valid; `error.details.validation` lists the fixes.
- `401`: No key or token, or it expired or was revoked.
- `403`: The key or token lacks the scope (`insufficient_scope`), or the action is not allowed.
- `429`: Too many requests; wait for Retry-After.

---

[API](https://skmtc.dev/50heads/apis/50heads-api.md) · [All operations](https://skmtc.dev/50heads/apis/50heads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/50heads/apis/50heads-api/revisions/20175e8b00e3?raw)