1. Docs
  2. API Reference
  3. EnvironmentAuthSettingsResponseDto

EnvironmentAuthSettingsResponseDto

Example

JSON
{
  "environment_slug": "string",
  "mfa_required": false,
  "mfa_grace_period_days": 0,
  "mfa_trusted_device_days": 0,
  "mfa_factor_allowlist": [
    "string"
  ],
  "mfa_after_sso": "exempt",
  "webauthn_rp_id": "string",
  "webauthn_origins": [
    "string"
  ],
  "allow_self_signup": false,
  "self_signup_require_captcha": false,
  "login_require_captcha": false,
  "password_login_enabled": false,
  "email_otp_login_enabled": false,
  "self_signup_daily_cap": 0,
  "access_token_ttl_seconds": 0,
  "refresh_token_ttl_days": 0,
  "m2m_access_token_ttl_seconds": 0,
  "m2m_default_audience": "string",
  "organization_integrations_enabled": false,
  "organization_integration_role_ids": [
    "string"
  ],
  "allowed_web_origins": [
    "string"
  ],
  "sso_return_urls": [
    "string"
  ],
  "idp_arrival_roles": {
    "role_ids": [
      "string"
    ],
    "default_role_id": "string"
  },
  "auth_links_base_url": "string",
  "initiate_login_uri": "string",
  "organizations_create_on_signup": false,
  "organizations_signup_member_role_id": "string",
  "organizations_membership_required": false,
  "identities_without_organization_count": 0
}

Properties

29 properties 14 required

environment_slug string Required

Environment slug the settings belong to

mfa_required boolean Required

Effective MFA enforcement, defaults hydrated

mfa_grace_period_days number Required
mfa_trusted_device_days number Required

How many days a device is remembered after a second-factor challenge answered with `remember_device: true`. 0, the default, disables remembering: the flag is accepted and does nothing. Range 0..90. Exposed to clients as `mfa_trusted_device_days` on `GET /v1/identity/auth/config`.

mfa_factor_allowlist array of string Required
mfa_after_sso enum Required

What an SSO login owes the MFA gate

Enumexemptrequire
webauthn_rp_id string Required

Relying-party id passkeys under this Environment are bound to, or null when they use Canopy's relying party.

nullable
webauthn_origins array of string Required

Origins allowed to run WebAuthn ceremonies under `webauthn_rp_id`. Empty when the Environment uses Canopy's relying party.

allow_self_signup boolean Optional
self_signup_require_captcha boolean Optional
login_require_captcha boolean Optional
password_login_enabled boolean Optional
email_otp_login_enabled boolean Optional
self_signup_daily_cap number Optional
access_token_ttl_seconds number Optional
refresh_token_ttl_days number Optional
m2m_access_token_ttl_seconds number Optional

Lifetime in seconds of a machine client's `client_credentials` token. Absent when unset (the default is 300).

m2m_default_audience string Optional

The audience a machine client's token names when its request names none. Absent when unset.

nullable
organization_integrations_enabled boolean Required

Whether organizations may create their own integrations (machine clients pinned to them).

organization_integration_role_ids array of string Required

The roles an organization's administrators may give its integrations, by id. Empty when none are chosen.

allowed_web_origins array of string Optional
sso_return_urls array of string Optional
idp_arrival_roles object Optional

The roles a customer's identity provider may grant and the one arrivals get, inherited by every organization without a list of its own. `null` when unset, which keeps directory sync closed for those organizations.

nullable
auth_links_base_url string Optional

Bare origin auth-email links point at, when the Environment owns them. Absent when unset.

nullable
initiate_login_uri string Optional

The route in the customer's application that starts a sign-in, offered as **Sign in** on hosted pages that end with nothing to return to. Absent when unset.

nullable
organizations_create_on_signup boolean Required

Whether a self-signup creates an organization with the new identity as its first member.

organizations_signup_member_role_id string Required

The role the creator of a signup-created organization receives, or null when none is chosen.

nullable
organizations_membership_required boolean Required

Whether a session is refused to an identity that belongs to no organization in this Environment.

identities_without_organization_count number Required

How many active members of this Environment belong to no organization in it: the identities `organizations_membership_required` refuses until they are added to one. Zero while the organizations container is off.

Was this page helpful?

Tell us how we can improve this guide.

Canopy