Update the authentication methods configuration for an organization. This allows admins to configure single or multi-factor authentication.

Validation Rules:

• Minimum 1 step, maximum 3 steps
• Each step must have a unique order. order is only checked to be a number and is stored as sent; sign-in runs the steps in ascending order
• No duplicate methods within the same step
• No method can appear in multiple steps
• Each step must have at least one allowed method
• samlSso and oauth were removed in 1.0 and are refused; use microsoft in place of azureAd

The two rules that compare steps with each other (unique order, a method in only one step) are not expressed in the request schema below; the API refuses a request that breaks them with 400 VALIDATION_ERROR naming body.authMethod.

Unknown fields, at any level of the body, and any query string are dropped by the validator, not refused.

Available Methods:

• password: Email/password authentication
• otp: One-time password via email
• google: Google OAuth 2.0
• microsoft: Microsoft OAuth 2.0

Example - Single Factor (Password or Google):

{
  "authMethod": [
    { "order": 1, "allowedMethods": [{ "type": "password" }, { "type": "google" }] }
  ]
}

Example - Two Factor (Password + OTP):

{
  "authMethod": [
    { "order": 1, "allowedMethods": [{ "type": "password" }] },
    { "order": 2, "allowedMethods": [{ "type": "otp" }] }
  ]
}

Admin Access Required: Only organization admins can update auth configuration.

{
  "message": "Auth method updated"
}