---
title: "POST /v1/accounts/{accountId}/resources/{resourceId}/authenticationpolicy"
method: POST
path: "/v1/accounts/{accountId}/resources/{resourceId}/authenticationpolicy"
---

# POST /v1/accounts/{accountId}/resources/{resourceId}/authenticationpolicy

`POST /v1/accounts/{accountId}/resources/{resourceId}/authenticationpolicy`

## Request

- Base URL: `https://api.usa.cloud.watchguard.com/rest/authpoint/authentication`
- URL: `https://api.usa.cloud.watchguard.com/rest/authpoint/authentication/v1/accounts/{accountId}/resources/{resourceId}/authenticationpolicy`
- Auth: API key in header `WatchGuard-API-Key` and HTTP bearer
- TypeScript: <https://skmtc.dev/watchguard/apis/authpoint-authentication-api/docs/v1/accounts/:accountId/resources/:resourceId/authenticationpolicy/post.ts> (a function with typed inputs; its response is checked against the schema)

Returns whether the user can authenticate and which authentication methods they can use (Push, QR code, and OTP).

## Path parameters

- `accountId` string, required
- `resourceId` number, required

## Request body

- AuthenticationPolicyRequest: The body to request the authentication policy
  - `login` string, required: Identifies the user to validate. This must be the email address or the user name of the user to validate.
  - `originIpAddress` string: The end user IP address. The IP address must be in IPv4 format.

## Response `200`

Successful request of the authentication policies

- AuthenticationPolicyResponse: The authentication policy response
  - `username` string: The user name of the user to validate.
  - `email` string: The email address of the user to validate.
  - `hasPolicy` boolean: Indicates if the user belongs to a group that has an access policy for this RESTful API Client resource.
  - `isAllowedToAuthenticate` boolean: Indicates if the user can authenticate.
  - `isInSafeLocation` boolean: Indicates if the user is in a safe location based on the originIpAddress sent in the request body and the safe locations configured for the user's AuthPoint group.
  - `isInForgotToken` boolean: Indicates if the user has the Forgot Token feature activated.
  - `isBlocked` boolean: Indicates if the user is blocked. Blocked users cannot authenticate.
  - `isOverallocated` boolean: Indicates if the user is overallocated. Overallocated users cannot authenticate.
  - `isInQuarantine` boolean: Indicates if the user is quarantined. Quarantined users cannot authenticate.
  - `policyResponse` PolicyResponse: The available authentication methods determined by the access policy for the RESTful API Client resource.
    - `password` boolean: Indicates if the user is allowed to authenticate with a password. If additional authentication methods are available, the user must authenticate with their password and another authentication method.
    - `otp` boolean: Indicates if the user is allowed to authenticate with a one-time password (OTP).
    - `qrCode` boolean: Indicates if the user is allowed to authenticate with a QR code.
    - `push` boolean: Indicates if the user is allowed to authenticate with a push notification.

## Other responses

- `400`: Bad request
- `403`: Operation not authorized
- `404`: Resource or user not found

---

[API](https://skmtc.dev/watchguard/apis/authpoint-authentication-api.md) - [All operations](https://skmtc.dev/watchguard/apis/authpoint-authentication-api/llms.txt) - [OpenAPI document](https://skmtc.dev/watchguard/apis/authpoint-authentication-api/revisions/d0a6623e53ce?raw)