Skip to main content

Update Password Reset settings

PUT 
/api/web/v1/settings/passwordreset

Update the password reset settings. Caller requires the SETTINGS:EDIT permission.

Request​

Body

required

    allowIgnoreIpAddressForRba boolean

    Flag indicates if ignore ip address for rba will be allowed or not.

    authenticators string[]

    Possible values: [MACHINE, PASSWORD, EXTERNAL, KBA, TEMP_ACCESS_CODE, OTP, GRID, TOKEN, TOKENPUSH, FIDO, SMARTCREDENTIALPUSH, PASSWORD_AND_SECONDFACTOR, SMART_LOGIN, IDP, PASSKEY, IDP_AND_SECONDFACTOR, USER_CERTIFICATE, FACE]

    The list of second factor authenticator types that can be used during a password reset operation.

    challengeSize int32deprecated

    For a KBA authenticator, it is the number of questions that the user must answer--not supported if these settings are part of a Group Policy (not the Global Policy).

    emailAccount boolean

    Indicates whether an email should be sent to notify the user account has been locked, unlocked, or an attempt of unlock has occurred.

    emailOtpEnabled boolean

    Indicates if OTP can be sent to email.

    enabled boolean

    Indicates whether password reset is enabled.

    groups

    object[]

    deprecated

    Groups that can perform a password reset operation--not supported if these settings are part of a Group Policy (not the Global Policy).

  • Array [

    • created date-time

    When the group was created.

    externalId string

    The externalId of this group.

    id string

    The UUID of this group. This value is generated when the group is created.

    lastModified date-time

    When the group was last modified.

    name stringrequired

    The name of this group.

    type string

    Possible values: [LDAP_AD, MGMT_UI]

    The type of group indicating if this group was synchronized from a directory (LDAP_AD) or was created in Identity as a Service (MGMT_UI).

  • ]

    • twoSecondFactorRequired boolean

    Indicates whether two forms of second factor authentication must be completed before a password reset operation can be done.

    unlockAccount boolean

    Indicates whether the user account should be unlocked after a password reset operation is completed.

    version int32

    Indicates the version of this model.

    wrongAnswersAllowed int32deprecated

    For a KBA authenticator, it is the number of questions that the user could answer incorrectly and still be considered a valid response--not supported if these settings are part of a Group Policy (not the Global Policy).

Responses​

Successful

Loading...