Authentication

Query User Authenticators

Changed on
post/api/web/v2/authentication/users

Request

  • Base URL: https://customer.region.trustedauth.com
  • URL: https://customer.region.trustedauth.com/api/web/v2/authentication/users
  • Auth: none declared

Request body

applicationIdstring required

Unique identifier of the Identity as a Service Authentication API application

authRequestKeystring

Unique identifier of the client authentication request in the OIDC application's JWT IDaaS grant type use case.

authTokenstring

Authentication token.

clientIpstring

Provided client IP address.

ignoreIPAddressForRBAboolean

Setting defines if IP Address is ignored for RBA or not. Default value is false and will not ignore IP Address for RBA.

maxAgeinteger

Maximum Authentication Age. If an authentication token is supplied, the maximum authentication age used to determine whether authentication is required or not is based on the current system time or a supplied request time.

offlineTVSboolean

A flag indicating if the offline QR code token verification is used. Used only if a challenge is required for authentication when returnDefaultChallenge is true.

originstring

The origin of the client. This field is deprecated, use rpId instead.

priorityinteger

The priority for push transactions where queuing is enabled. Default is 0 and allowed values are 0-9. Used only if a challenge is required for authentication when returnDefaultChallenge is true.

pushMessageIdentifierstring

Defines an identifier to retrieve customized SDK push message configuration. Used only if a challenge is required for authentication when returnDefaultChallenge is true.

pushMutualChallengeEnabledboolean

A flag indicating if push mutual authentication is supported for tokens or Face Biometric. Used only if a challenge is required for authentication when returnDefaultChallenge is true.

requestAcrsstring

The request acrs.

requestTimeinteger

The request start time in milliseconds. If an authentication token and a maximum authentication age are supplied, determining whether authentication is required or not is based on the current system time if this value is not provided.

responsestring

Password response used for combined user ID and password login.

returnDefaultChallengeboolean

Flag indicating whether the service should include in the response the default challenge.

rpIdstring

The Relying Party ID associated with the passkey. This identifies the domain or origin for which the passkey is registered. This field is mandatory if domain is outside of the IDaaS hostname.

summarystring

The push authentication challenge that appears in the user's mobile application. Used only if a challenge is required for authentication when returnDefaultChallenge is true.

supportChoosingOtpDeliveryboolean

Deprecated : Clients who support choosing OTP delivery can still work without having to supply this flag.Flag indicating whether client supports choosing OTP delivery contact attribute.If the client doesn't support it and default OTP delivery is set to NONE, OTP won't be available as an authenticator.

tokenPushMutualChallengeEnabledboolean

A flag indicating if the token push mutual authentication is supported. Used only if a challenge is required for authentication when returnDefaultChallenge is true.

userIdstring required

User ID (containing the user ID or a user alias) of the Identity as a Service user completing the authentication challenge.

Example request

{
  "applicationId": "6781549d-433c-44ea-a42f-4705c26f3245",
  "machineAuthenticator": {
    "fingerprint": "{\"platform\":\"web\",\"version\":\"2.0.0\",\"attributes\":{\"osName\":\"Mac OS\"}}",
    "machineNonce": "07ZeToA3YfoATTxoU6h2x==",
    "sequenceNonce": "03ReToA37851tyVU8f3y=="
  },
  "offlineTVS": true,
  "origin": "https://mycompany.example.com:443",
  "pushMessageIdentifier": "generic",
  "pushMutualChallengeEnabled": true,
  "requestDetail": {
    "browser": "Chrome 67.0.3396.99",
    "os": "Windows 8.1"
  },
  "returnDefaultChallenge": true,
  "rpId": "mycompany.example.com",
  "summary": "You have requested to authenticate for a SAML Service Provider.",
  "supportChoosingOtpDelivery": true,
  "tokenPushMutualChallengeEnabled": true,
  "transactionDetails": [
    {
      "detail": "Amount",
      "usage": [
        "RBA"
      ],
      "value": "$10,001"
    }
  ],
  "userId": "user"
}

Response

Authenticators retrieved successfully

authenticationCompletedboolean

Flag to indicate if access to the application is allowed with the current JWT.

authenticationTypesstring[]

List of authenticator types available for the user.

availableSecondFactorstring[]

Lists authenticator types available to complete second factor challenge (if enabled).

deviceCertAuthDesiredboolean

Flag to indicate if the user has to attempt device certificate authentication.

expiresinteger
otpDeliveryType'EMAIL' | 'SMS' | 'VOICE' | 'WECHAT' | 'WHATSAPP'

The OTP delivery type used.

passwordResetAllowedboolean

Flag to indicate if the user can initiate a password reset flow.

pushMutualChallengestring

Push authentication mutual challenge for token or Face Biometric.

registrationRequiredboolean

Flag to indicate if the user has to register authenticators.

supportsSignatureboolean

Flag to indicate if the user has a token that supports signature.

timeinteger
tokenstring
tokenDetailsstring[]

For a token or token push authenticator challenge, provides a list of serial numbers of the tokens that can be used to authenticate.

tokenPushMutualChallengestring

The token push authentication mutual challenge.

verificationRequiredboolean

Flag to indicate if the user has to verify.

Example response

{
  "authenticatorLockoutStatus": [
    {
      "lockoutDate": "2019-02-19T13:15:27Z",
      "lockoutExpiryDate": "2019-02-20T13:15:27Z",
      "type": "OTP"
    }
  ],
  "gridChallenge": {
    "gridInfo": [
      {
        "expiryDate": "2019-02-19T13:15:27Z"
      }
    ]
  },
  "machineAuthenticator": {
    "fingerprint": "{\"platform\":\"web\",\"version\":\"2.0.0\",\"attributes\":{\"osName\":\"Mac OS\"}}",
    "machineNonce": "07ZeToA3YfoATTxoU6h2x==",
    "sequenceNonce": "03ReToA37851tyVU8f3y=="
  },
  "organizations": [
    {
      "logoUri": "https://account.mycompany.com/images/logo.png"
    }
  ],
  "otpDeliveryInfo": {
    "otpContactValues": [
      {
        "name": "alternativeEmail",
        "type": "EMAIL",
        "value": "*******@mycompany.com"
      }
    ],
    "otpDeliveryAttribute": "Alternative Email"
  },
  "tokenChallenge": {
    "token": [
      {
        "label": "PENDING"
      }
    ]
  },
  "userMachineSettings": {
    "userMachineAuthenticators": [
      {
        "expiryTime": "2019-02-19T13:15:27Z",
        "lastUsedTime": "2019-02-19T13:15:27Z",
        "registrationTime": "2019-02-19T13:15:27Z"
      }
    ]
  }
}

Changes

  • 99ca2c65312fRevision changes
    • info

      added the new optional request property

  • 75415cfc6c70Revision changes
    • info

      added the optional property // to the response with the status

    • info

      added the required property / to the response with the status