OPopenobserve
Organizations

Get the password policy

Returns the authentication policy enforced for native users across the whole deployment: password complexity, rotation, reuse prevention and account lockout. Requires Root or Admin on the meta organization, because the full policy includes lockout thresholds and history depth; callers who only need the password requirements should use /{org_id}/password_complexity. An instance that has never configured a policy returns the built-in defaults rather than an error, so this endpoint never 404s.

get/api/{org_id}/settings/password_policy

Request

Path parameters

org_idstring required

Organization name (must be meta org; caller must be Root or Admin)

Response

Success

apply_to_rootboolean

Whether root is held to rotation and lockout like every other native user.

Default false, which is the documented exemption: root is the only account that can repair a misconfigured policy, and the only one whose lockout has no remedy from inside the product. Complexity and reuse already apply to root at password-set time whatever this says; the tightening sweep never touches root either way, so root is never mass-flagged.

cookie_max_age_secsinteger

How long a sign-in cookie stays valid, in seconds. 0 defers to ZO_COOKIE_MAX_AGE.

This is the browser's copy of the credential, not a server-side session: shortening it makes the browser stop sending the cookie sooner, and does nothing to a copy taken from it. It applies from the next sign-in — cookies already issued keep the lifetime they were given.

history_countinteger

0 disables reuse prevention.

history_max_retainedinteger

Hashes retained per user; kept at or above history_count so a later increase to history_count has history to check against.

max_lengthinteger

Between min_length and 128; a stored legacy 0 still reads as unbounded.

min_lengthinteger
require_digitboolean
require_lowercaseboolean
require_specialboolean
require_uppercaseboolean
rotation_daysinteger

0 disables rotation enforcement.

rotation_warning_daysinteger

Days before expiry to start warning. 0 = never warn; equal to rotation_days = warn on every request, since no live password is then outside the window.

special_char_setstring

Empty means any non-alphanumeric character counts as special.

Changes

No recorded changes to this operation across all 1 revision of this API.