---
title: "Require two-factor authentication for every member, with a grace period (owner, session signed in within 5 minutes)"
method: PUT
path: "/orgs/{orgId}/security"
tags: ["Teams"]
---

# Require two-factor authentication for every member, with a grace period (owner, session signed in within 5 minutes)

`PUT /orgs/{orgId}/security`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/orgs/{orgId}/security`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `orgId` string, uuid, required

## Request body

- object
  - `requireMfa` boolean, required
  - `graceDays` integer: days members get to set up two-factor authentication

## Response `200`

Policy

- object
  - `role` 'owner' | 'admin' | 'developer' | 'viewer' | 'billing' | 'editor', required: `editor` is a legacy role: existing members keep it, it can no longer be assigned
  - `policy` object, required
    - `requireMfa` boolean, required
    - `mfaEnforcedAt` string, nullable, required: end of the grace period: members without two-factor authentication lose access from here
    - `updatedAt` string, nullable, required: ISO-8601 timestamp
  - `sso` object, required
    - `configured` boolean, required
    - `enabled` boolean, required
    - `enforced` boolean, required
    - `protocol` 'oidc' | 'saml' | 'null', nullable, required
    - `provider` string, nullable, required
  - `you` object, required
    - `mfaEnabled` boolean, required
    - `ssoSession` boolean, required: this session came from the team's SSO connection
    - `mfaDeadline` string, nullable, required: set when the policy applies to you and you have not set up two-factor authentication
  - `membersWithoutMfa` object[], nullable, required: owners/admins only
    - `userId` string, uuid, required
    - `name` string, required
    - `email` string, required
    - `role` 'owner' | 'admin' | 'developer' | 'viewer' | 'billing' | 'editor', required: `editor` is a legacy role: existing members keep it, it can no longer be assigned
    - `ssoManaged` boolean, required: signs in through the team's IdP, which handles two-factor authentication

## Other responses

- `400`: Invalid request (code invalid_request; details.reason names a policy rule)
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Not permitted (code forbidden). details.sessionRequired: changes need a dashboard session; details.reauthenticate: sign in again (changes need a session younger than 5 minutes); details.policy: the team requires mfa/sso. Code ip_not_allowed: the team's IP allow-list does not include your address (details.clientIp)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicts with the team state, e.g. the last owner (code conflict)
- `429`: Too many requests (code rate_limited); see Retry-After

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)