Logo / Docs

Pre 1.26 Two Factor APIs (Deprecated)

Overview

This documentation is for version 1.25 and earlier. Breaking changes were introduced to this API in 1.26.

Do not use this API unless you are on a version of FusionAuth earlier than 1.26. You can view the current two factor documentation if you are on version 1.26 or higher.

Enable Two Factor

This API is used to enable Two Factor authentication for a single User. To use this API the User must provide a valid Two Factor verification code.

To enable using TextMessage delivery, you may use the Two Factor Send API to deliver a code to the User, the User will then provide this code as input.

Request

API Key Authentication
Enable Two Factor Authentication
POST /api/user/two-factor/{userId}

Request Parameters

userIdUUIDrequired

The Id of the User to enable Two Factor authentication.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.


JWT Authentication
Enable Two Factor Authentication
POST /api/user/two-factor

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Body

codeStringrequired

A valid Two Factor verification code. This value should be provided by the User to verify they are able to produce codes using an application or receive them using their mobile phone.

deliveryStringrequired

The User’s preferred delivery for verification codes during a two factor login request.

The possible values are:

  • None
  • TextMessage

When using TextMessage the User will also need a valid mobilePhone. The User’s mobile phone is not validated during this request. Because the code is provided on this request it is assumed the User has been able to receive a code on their mobile phone when setting the delivery to TextMessage.

secretString

A base64 encoded secret.

You may optionally use the secret value returned by the Two Factor Secret API instead of generating this value yourself. This value is a secure random byte array that is Base-64 encoded.

If you omit this field, then secretBase32Encoded is required.

secretBase32EncodedString

A base32 encoded secret.

You may optionally use the secretBase32Encoded value returned by the Two Factor Secret API instead of generating this value yourself. This value is a secure random byte array that is Base-32 encoded.

If you omit this field, then secret is required.

Example Request JSON

{
  "code": "435612",
  "delivery": "None",
  "secret": "8MJJfCY4ERBtotvenSc3"
}

Response

Response Codes

CodeDescription
200The request was successful. Two Factor has been enabled for the User.
400The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
401You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404The User does not exist. The response will be empty.
421The code request parameter is not valid. The response will be empty.
500There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Disable Two Factor

This API is used to disable Two Factor authentication for a single User. To use this API the User must provide a valid Two Factor verification code.

If the User has configured TextMessage delivery, you may use the Two Factor Send API to deliver a code to the User, the User will then provide this code as input.

Request

API Key Authentication
Disable Two Factor Authentication
DELETE /api/user/two-factor/{userId}?code={code}

Request Parameters

userIdUUIDrequired

The Id of the User to enable Two Factor authentication.

codeStringrequired

The time based one time use password, also called a Two Factor verification code.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.


JWT Authentication
Disable Two Factor Authentication
DELETE /api/user/two-factor?code={code}

Request Parameters

codeStringrequired

The time based one time use password, also called a Two Factor verification code.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Response

Response Codes

CodeDescription
200The request was successful. Two Factor has been disabled for the User.
400The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors.
401You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404The User does not exist. The response will be empty.
421The code request parameter is not valid. The response will be empty.
500There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Send a Two Factor Code

This API is used to send a Two Factor verification code to a User. This may be useful during Two Factor authentication if the initial code is no longer valid. It may be also used to send a code to a User to assist in enabling or disabling Two Factor authentication.

To send a code to a User that already has Two Factor enabled, it is not required they have TextMessage set as their preferred delivery. As long as the User has a mobile phone defined you may send the User a code.

This API requires that the Twilio integration is enabled and configured properly.

Request

API Key Authentication
Send a Two Factor code to an existing User by Id
POST /api/two-factor/send

This request is intended to be used to send a Two Factor code to a User that already has enabled Two Factor authentication to assist in disabling Two Factor authentication. The User must already have Two Factor enabled and have a valid mobile phone for this to succeed.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Request Body

userIdUUIDrequired

The User Id of the User to send a Two Factor verification code. This User is expected to already have Two Factor enabled.

Example Request JSON

{
  "userId": "c075e472-a732-47d6-865a-d385a5fcb525"
}
API Key Authentication
Send a Two Factor code to a mobile phone
POST /api/two-factor/send

This request is intended to be used to send a Two Factor code to a User to assist in enabling Two Factor authentication.

Request Body

mobilePhoneStringrequired

A mobile phone to send the Two Factor verification code.

secretStringrequired

The Two Factor secret used to generate a Two Factor verification code to send to the provided mobile phone.

You may optionally use value provided in the secret field returned by the Two Factor Secret API instead of generating this value yourself.

Example Request JSON

{
  "mobilePhone": "555-555-5555",
  "secret": "8MJJfCY4ERBtotvenSc3"
}
No Authentication Required
Send a Two Factor code to complete Two Factor Login
POST /api/two-factor/send/{twoFactorId}

This request is intended to send additional messages to the User’s mobile phone during login.

Request Parameters

twoFactorIdStringrequired

The twoFactorId returned by the Login API.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.


JWT Authentication
Send a Two Factor code to an authenticated User using a JWT
POST /api/two-factor/send

This request is intended to be used to send a Two Factor code to a User that already has enabled Two Factor authentication to assist in disabling Two Factor authentication. When using JWT authentication the User’s Id is retrieved from the JWT. The User must already have Two Factor enabled and have a valid mobile phone for this to succeed.

Request Headers

X-FusionAuth-TenantIdString

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Response

Response Codes
Code Description
200 The request was successful.
400 The request was invalid and/or malformed. The response will contain an Errors JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.
401 You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500 There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503 The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Generate a Secret

This API is used to generate a new Two Factor secret for use when enabling Two Factor authentication for a User. This is provided as a helper to assist you in enabling Two Factor authentication.

If this secret will be used with a QR code to allow the User to scan the value it will need utilize the Base32 encoded value returned in the response.

Request

API Key Authentication
Generate a Two Factor Secret
GET /api/two-factor/secret
JWT Authentication
Generate a Two Factor Secret
GET /api/two-factor/secret

Response

The response for this API contains the a Two Factor secret.

Response Codes
Code Description
200 The request was successful. The response will contain a JSON body.
401 You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
500 There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503 The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Response Body

secretString

A Base64 encoded secret that may be used to enable Two Factor authentication.

secretBase32EncodedString

A Base32 encoded form of the provided secret. This useful if you need to provide a QR code to the User to enable Two Factor authentication.

Example Response JSON

{
  "secret": "8MJJfCY4ERBtotvenSc3",
  "secretBase32Encoded": "HBGUUSTGINMTIRKSIJ2G65DWMVXFGYZT"
}