---
title: "Set the org security policy (org_admin): who must pass a second factor, whether the org IdP counts as one, which sign-in methods are accepted"
method: PUT
path: "/api/orgs/{orgId}/security"
tags: ["security"]
---

# Set the org security policy (org_admin): who must pass a second factor, whether the org IdP counts as one, which sign-in methods are accepted

`PUT /api/orgs/{orgId}/security`

## Request

- Base URL: `https://api.wizbi.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.wizbi.ai/api/orgs/{orgId}/security`
- Auth: none declared

Fields left out keep their value. `signIn.open` and `lockedBy` are the platform’s (super_admin, `PUT /api/admin/orgs/{orgId}/sign-in`). A restricted policy is refused with 409 `signin_policy_lockout` when a role has no usable method, or when it would refuse the method the saving admin is signed in with (unless the org SSO is enabled, verified and allowed). A locked policy answers 403. Super admins are never refused by the policy.

## Path parameters

- `orgId` string, required

## Request body

- OrgSecurityInput
  - `mfa` 'admins' | 'all'
  - `mfaTrustIdp` boolean
  - `externalAgentWrite` boolean
  - `signIn` object
    - `methods` string[], nullable
    - `byRole` object
      - `admin` object, nullable
        - `methods` string[], nullable
        - `mfa` object
          - `required` boolean
      - `member` object, nullable
        - `methods` string[], nullable
        - `mfa` object
          - `required` boolean

## Response `200`

OK.

- OrgSecurity
  - `mfa` 'admins' | 'all'
  - `mfaTrustIdp` boolean
  - `signIn` object
    - `methods` string[]
    - `open` boolean
    - `byRole` object
      - `admin` object
        - `methods` string[]
        - `mfa` object
          - `required` boolean
      - `member` object
        - `methods` string[]
        - `mfa` object
          - `required` boolean
  - `externalAgentWrite` boolean
  - `lockedBy` 'platform'
  - `resolved` object, required
    - `admin` object, required
      - `signIn` object, required
        - `allowed` string[], required
        - `unrestricted` boolean, required
        - `disabled` object[], required
          - `method` 'google' | 'microsoft' | 'email_code' | 'phone_code' | 'sso', required
          - `by` 'platform' | 'org' | 'role' | 'module', required
        - `open` boolean, required
      - `mfa` object, required
        - `required` boolean, required
        - `requiredBy` 'platform' | 'org' | 'role' | 'module' | 'null', nullable, required
        - `trustIdp` boolean, required
    - `member` object, required
      - `signIn` object, required
        - `allowed` string[], required
        - `unrestricted` boolean, required
        - `disabled` object[], required
          - `method` 'google' | 'microsoft' | 'email_code' | 'phone_code' | 'sso', required
          - `by` 'platform' | 'org' | 'role' | 'module', required
        - `open` boolean, required
      - `mfa` object, required
        - `required` boolean, required
        - `requiredBy` 'platform' | 'org' | 'role' | 'module' | 'null', nullable, required
        - `trustIdp` boolean, required
  - `offered` string[], required
  - `ssoReady` boolean, required

## Other responses

- `400`: A method the platform does not offer.
- `403`: Insufficient role, or the platform locked this policy.
- `409`: The policy would lock people out (`signin_policy_lockout`).

---

[API](https://skmtc.dev/wizbi/apis/wizbi-core-api.md) · [All operations](https://skmtc.dev/wizbi/apis/wizbi-core-api/llms.txt) · [OpenAPI document](https://skmtc.dev/wizbi/apis/wizbi-core-api/revisions/5a47416c82ec?raw)