---
title: "Update Workspace Sign-in Settings"
method: PATCH
path: "/tenants/{id}/auth-settings"
tags: ["tenants"]
---

# Update Workspace Sign-in Settings

`PATCH /tenants/{id}/auth-settings`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/tenants/{id}/auth-settings`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

Partial update: send only the keys to change; null resets a key to inherit. methods_allowed narrows the sign-in methods offered and accepted (each still has to be set up); the integer keys must sit within the returned limits, and access_ttl_sec, refresh_ttl_sec and max_sessions can only be lowered below the instance's own values. 400 invalid_settings for an unknown key, wrong type or out-of-range value; 400 above_instance_limit for a value above the instance's; 409 lockout when methods_allowed leaves no method set up for the workspace, or none the caller can sign in with; 409 public_workspace for the Public workspace, which always uses the instance's settings. tenant_admin of the workspace, or a platform admin. Audited with before and after values.

## Path parameters

- `id` string, required

## Request body

- EnforcerV3InternalUsecaseAuthsettingsStoredSettings
  - `access_ttl_sec` integer
  - `email_otp_length` integer
  - `email_otp_ttl_sec` integer
  - `max_sessions` integer
  - `methods_allowed` string[]
  - `otp_max_attempts` integer
  - `refresh_ttl_sec` integer

## Response `200`

OK

- InternalDeliveryHttpHandlerAuthSettingsResponse
  - `data` EnforcerV3InternalUsecaseAuthsettingsView
    - `editable` boolean: Editable is false for the Public workspace, which always uses the instance's settings.
    - `effective` EnforcerV3InternalUsecaseAuthsettingsEffectiveSettings
      - `access_ttl_sec` integer
      - `email_otp_length` integer
      - `email_otp_ttl_sec` integer
      - `max_sessions` integer: MaxSessions is the live-session cap per account; 0 = unbounded.
      - `methods_allowed` string[]
      - `otp_max_attempts` integer
      - `refresh_ttl_sec` integer
    - `limits` object: Limits is the range each integer setting may be set to: the column's bounds, the maximum lowered to the instance's own value for access_ttl_sec, refresh_ttl_sec and max_sessions.
    - `methods` string[]: Methods lists every method methods_allowed may name.
    - `sources` object: Sources maps each setting to "workspace", "instance" or "default".
    - `stored` EnforcerV3InternalUsecaseAuthsettingsStoredSettings
      - `access_ttl_sec` integer
      - `email_otp_length` integer
      - `email_otp_ttl_sec` integer
      - `max_sessions` integer
      - `methods_allowed` string[]
      - `otp_max_attempts` integer
      - `refresh_ttl_sec` integer
    - `tenant_id` string
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `409`: Conflict

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)