Inspect the environment’s authentication settings and manage the signed-in user’s passwords, multi-factor factors, passkeys, and active sessions.
The authentication methods the environment allows and the password policy it enforces. Requires a session token.
| query AuthenticationSettings { | |
| authenticationSettings { | |
| mfaEnabled | |
| mfaRequired | |
| passkeyAuthEnabled | |
| passwordAuthEnabled | |
| passwordPolicy { | |
| minimumLength | |
| minimumStrength | |
| rejectsBreachedPasswords | |
| requiresLowercase | |
| requiresNumber | |
| requiresSymbol | |
| requiresUppercase | |
| } | |
| } | |
| } |
| { | |
| "data": { | |
| "authenticationSettings": { | |
| "mfaEnabled": true, | |
| "mfaRequired": true, | |
| "passkeyAuthEnabled": true, | |
| "passwordAuthEnabled": true, | |
| "passwordPolicy": { | |
| "minimumLength": 10, | |
| "minimumStrength": 10, | |
| "rejectsBreachedPasswords": true, | |
| "requiresLowercase": true, | |
| "requiresNumber": true, | |
| "requiresSymbol": true, | |
| "requiresUppercase": true | |
| } | |
| } | |
| } | |
| } |
authenticationSettings
Returns AuthenticationSettings!
Set a password for the authenticated user who does not yet have one (e.g. signed up via OAuth). Validates against the environment password policy.
| mutation CreatePassword($input: CreatePasswordInput!) { | |
| createPassword(input: $input) { | |
| __typename | |
| ... on ElevatedAccessTokenExpired { | |
| message | |
| } | |
| ... on ElevatedAccessTokenInvalid { | |
| message | |
| } | |
| ... on PasswordCreated { | |
| success | |
| } | |
| ... on PasswordPolicyViolation { | |
| code | |
| message | |
| violations { | |
| allowedSymbols | |
| breachOccurrences | |
| characterType | |
| code | |
| maximumLength | |
| message | |
| minimumLength | |
| strengthSuggestions | |
| strengthWarning | |
| } | |
| } | |
| } | |
| } |
| { | |
| "data": { | |
| "createPassword": { | |
| "__typename": "ElevatedAccessTokenExpired", | |
| "message": "message_example" | |
| } | |
| } | |
| } |
createPassword
Parameters CreatePasswordInput!
Returns CreatePasswordResult!
Change the password for the authenticated user. Requires the current password for verification and validates the new password against the environment password policy.
| mutation UpdatePassword($input: UpdatePasswordInput!) { | |
| updatePassword(input: $input) { | |
| __typename | |
| ... on PasswordPolicyViolation { | |
| code | |
| message | |
| violations { | |
| allowedSymbols | |
| breachOccurrences | |
| characterType | |
| code | |
| maximumLength | |
| message | |
| minimumLength | |
| strengthSuggestions | |
| strengthWarning | |
| } | |
| } | |
| ... on PasswordUpdated { | |
| success | |
| } | |
| } | |
| } |
| { | |
| "data": { | |
| "updatePassword": { | |
| "__typename": "IncorrectPassword" | |
| } | |
| } | |
| } |
updatePassword
Parameters UpdatePasswordInput!
Returns UpdatePasswordResult!
Create a TOTP factor and return the secret and QR URI for the user to scan. This is step 1 of TOTP enrollment.
| mutation EnrollTotp($input: EnrollTotpInput!) { | |
| enrollTotp(input: $input) { | |
| __typename | |
| ... on ElevatedAccessTokenExpired { | |
| message | |
| } | |
| ... on ElevatedAccessTokenInvalid { | |
| message | |
| } | |
| ... on TotpFactor { | |
| authenticationChallengeId | |
| authenticationFactorId | |
| qrCode | |
| secret | |
| uri | |
| } | |
| } | |
| } |
| { | |
| "data": { | |
| "enrollTotp": { | |
| "__typename": "ElevatedAccessTokenExpired", | |
| "message": "message_example" | |
| } | |
| } | |
| } |
enrollTotp
Parameters EnrollTotpInput!
Returns EnrollTotpResult!
Confirm TOTP enrollment by verifying a code from the authenticator app. Marks the factor as verified.
| mutation VerifyTotp($input: VerifyTotpInput!) { | |
| verifyTotp(input: $input) { | |
| __typename | |
| ... on ElevatedAccessTokenExpired { | |
| message | |
| } | |
| ... on ElevatedAccessTokenInvalid { | |
| message | |
| } | |
| ... on TotpVerified { | |
| success | |
| } | |
| } | |
| } |
| { | |
| "data": { | |
| "verifyTotp": { | |
| "__typename": "ElevatedAccessTokenExpired", | |
| "message": "message_example" | |
| } | |
| } | |
| } |
verifyTotp
Parameters VerifyTotpInput!
Returns VerifyTotpResult!
Delete all TOTP factors for the authenticated user, effectively resetting MFA.
| mutation RemoveMfaFactor($input: RemoveMfaFactorInput!) { | |
| removeMfaFactor(input: $input) { | |
| __typename | |
| ... on ElevatedAccessTokenExpired { | |
| message | |
| } | |
| ... on ElevatedAccessTokenInvalid { | |
| message | |
| } | |
| ... on MfaFactorRemoved { | |
| success | |
| } | |
| } | |
| } |
| { | |
| "data": { | |
| "removeMfaFactor": { | |
| "__typename": "ElevatedAccessTokenExpired", | |
| "message": "message_example" | |
| } | |
| } | |
| } |
removeMfaFactor
Parameters RemoveMfaFactorInput!
Returns RemoveMfaFactorResult!
List registered passkeys for the authenticated user. Requires a session token.
| query Passkeys { | |
| passkeys { | |
| createdAt | |
| id | |
| lastVerifiedAt | |
| updatedAt | |
| } | |
| } |
| { | |
| "data": { | |
| "passkeys": [ | |
| { | |
| "createdAt": "2024-01-01T00:00:00.000Z", | |
| "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY", | |
| "lastVerifiedAt": "2024-01-01T00:00:00.000Z", | |
| "updatedAt": "2024-01-01T00:00:00.000Z" | |
| } | |
| ] | |
| } | |
| } |
passkeys
Returns [Passkey!]!
createdAt: DateTime!
id: ID!
updatedAt: DateTime!
Begin passkey (WebAuthn) registration for the authenticated user by returning the credential creation options. This is step 1 of the registration ceremony; complete it with verifyPasskey.
| mutation RegisterPasskey($input: RegisterPasskeyInput!) { | |
| registerPasskey(input: $input) { | |
| __typename | |
| ... on ElevatedAccessTokenExpired { | |
| message | |
| } | |
| ... on ElevatedAccessTokenInvalid { | |
| message | |
| } | |
| ... on PasskeyRegistrationOptions { | |
| challengeId | |
| options | |
| } | |
| } | |
| } |
| { | |
| "data": { | |
| "registerPasskey": { | |
| "__typename": "ElevatedAccessTokenExpired", | |
| "message": "message_example" | |
| } | |
| } | |
| } |
registerPasskey
Parameters RegisterPasskeyInput!
Returns RegisterPasskeyResult!
Complete passkey (WebAuthn) registration by verifying the credential created by the authenticator. This is step 2 of the registration ceremony started by registerPasskey.
| mutation VerifyPasskey($input: VerifyPasskeyInput!) { | |
| verifyPasskey(input: $input) { | |
| __typename | |
| ... on ElevatedAccessTokenExpired { | |
| message | |
| } | |
| ... on ElevatedAccessTokenInvalid { | |
| message | |
| } | |
| ... on PasskeyVerified { | |
| success | |
| } | |
| } | |
| } |
| { | |
| "data": { | |
| "verifyPasskey": { | |
| "__typename": "ElevatedAccessTokenExpired", | |
| "message": "message_example" | |
| } | |
| } | |
| } |
verifyPasskey
Parameters VerifyPasskeyInput!
Returns VerifyPasskeyResult!
Remove the specified passkey from the authenticated user’s account.
| mutation DeletePasskey($input: DeletePasskeyInput!) { | |
| deletePasskey(input: $input) { | |
| __typename | |
| ... on ElevatedAccessTokenExpired { | |
| message | |
| } | |
| ... on ElevatedAccessTokenInvalid { | |
| message | |
| } | |
| ... on PasskeyDeleted { | |
| success | |
| } | |
| } | |
| } |
| { | |
| "data": { | |
| "deletePasskey": { | |
| "__typename": "ElevatedAccessTokenExpired", | |
| "message": "message_example" | |
| } | |
| } | |
| } |
deletePasskey
Parameters DeletePasskeyInput!
Returns DeletePasskeyResult!
List active sessions for the authenticated user. Requires a session token.
| query Sessions { | |
| sessions { | |
| createdAt | |
| currentLocation { | |
| cityName | |
| countryISOCode | |
| } | |
| id | |
| ipAddress | |
| isCurrent | |
| lastActivityAt | |
| organizationId | |
| state { | |
| expiresAt | |
| tag | |
| } | |
| updatedAt | |
| userAgent | |
| } | |
| } |
| { | |
| "data": { | |
| "sessions": [ | |
| { | |
| "createdAt": "2024-01-01T00:00:00.000Z", | |
| "currentLocation": { | |
| "cityName": "cityName_example", | |
| "countryISOCode": "countryISOCode_example" | |
| }, | |
| "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY", | |
| "ipAddress": "ipAddress_example", | |
| "isCurrent": true, | |
| "lastActivityAt": "2024-01-01T00:00:00.000Z", | |
| "organizationId": "organizationId_example", | |
| "state": { | |
| "expiresAt": "2024-01-01T00:00:00.000Z", | |
| "tag": "tag_example" | |
| }, | |
| "updatedAt": "2024-01-01T00:00:00.000Z", | |
| "userAgent": "userAgent_example" | |
| } | |
| ] | |
| } | |
| } |
sessions
Returns [Session!]!
createdAt: DateTime!
id: ID!
ipAddress: String
lastActivityAt: DateTime
organizationId: String
updatedAt: DateTime!
userAgent: String
Revokes a specific session by ID.
| mutation RevokeSession($input: RevokeSessionInput!) { | |
| revokeSession(input: $input) { | |
| __typename | |
| ... on SessionNotFound { | |
| sessionId | |
| } | |
| ... on SessionRevoked { | |
| session { | |
| createdAt | |
| id | |
| ipAddress | |
| isCurrent | |
| lastActivityAt | |
| organizationId | |
| updatedAt | |
| userAgent | |
| } | |
| } | |
| } | |
| } |
| { | |
| "data": { | |
| "revokeSession": { | |
| "__typename": "SessionNotFound", | |
| "sessionId": "sessionId_01EHWNCE74X7JSDV0X3SZ3KJNY" | |
| } | |
| } | |
| } |
revokeSession
Parameters RevokeSessionInput!
Returns RevokeSessionResult!
Revokes all active sessions for the authenticated user except the current one and, if provided, input.currentSessionId.
| mutation RevokeAllSessions($input: RevokeAllSessionsInput) { | |
| revokeAllSessions(input: $input) { | |
| __typename | |
| ... on AllSessionsRevoked { | |
| success | |
| } | |
| } | |
| } |
| { | |
| "data": { | |
| "revokeAllSessions": { | |
| "__typename": "AllSessionsRevoked", | |
| "success": true | |
| } | |
| } | |
| } |