---
title: "Mint a one-time admin-relayed onboarding password for a provisioned IdP user"
method: POST
path: "/organizations/{organizationId}/idp-users/{email}/onboarding-password"
tags: ["Organizations"]
---

# Mint a one-time admin-relayed onboarding password for a provisioned IdP user

`POST /organizations/{organizationId}/idp-users/{email}/onboarding-password`

## Request

- Base URL: `https://api.xfa.tech`
- URL: `https://api.xfa.tech/organizations/{organizationId}/idp-users/{email}/onboarding-password`
- Auth: HTTP bearer

Mints a high-entropy onboarding password for a provisioned IdP user who has no reusable MFA factor yet, so a brand-new device can bootstrap first-device passwordless IdP onboarding. The plaintext is returned exactly once (only its digest is stored); an admin relays it to the user out of band. Requires an organization administrator (RBAC). Returns 404 when the user is not a provisioned IdP user (no existence leak) and 409 when the user already has a reusable MFA factor.

## Path parameters

- `organizationId` string, required
- `email` string, required

## Response `200`

Onboarding password minted

- object: A one-time admin-relayed onboarding password, returned exactly once
  - `password` string, required: The generated onboarding password. Only its digest is stored, so it cannot be retrieved again.
  - `expiresAt` integer, required: Unix epoch seconds after which the password stops working

## Other responses

- `403`: Not authorized
- `404`: not_provisioned (IdP user not found)
- `409`: already_enrolled (user already has a reusable MFA factor)

---

[API](https://skmtc.dev/xfa/apis/xfa-api.md) · [All operations](https://skmtc.dev/xfa/apis/xfa-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xfa/apis/xfa-api/revisions/1a1be0e8972b?raw)