Profile Authentication Methods Management

Overview

Profile authentication methods endpoints allow users to manage their own authentication methods after successful reauthentication.

Note

These endpoints require an active API session and prior confirmation via the /profile/authentication/confirm endpoint which provides a temporary token.

Authentication Flow

1. Reauthenticate to obtain a confirmation token

2. Use the token in the X-Auth-Confirm header for all subsequent operations

3. Token validity: 10 minutes, extended with each use

Data Structures

AuthenticationMethodModel

Attribute	Type	Required	Description
id	string		Read-only. Unique authentication method identifier.
type	string {password, oath, extauth, sshkey, certificate, duo, sms, apikey, fido2}	yes	Immutable. Authentication method type.
user_id	string		Read-only. Protected. Uniqueness is required in the combination with position.
description	string		Optional description of the authentication method.
position	number		Uniqueness is required in the combination with user_id.
external_sync	boolean		Read-only.
secret	string	If type == password | sshkey	Protected. Authentication secret.
external_authentication_type	string	If type == oath | extauth	Read-only; expensive to use. Type of the external authentication backing this method, for example ad. The portal uses it to decide whether a password change is offered.
needs_change	boolean		Read-only.
apikey_device_id	string	If type == apikey	Read-only; expensive to use.
apikey_device_platform	string	If type == apikey	Read-only; expensive to use.
apikey_device_pushid	string	If type == apikey	Read-only; expensive to use.
apikey_key	string	If type == apikey	Protected.
apikey_hint	string	If type == apikey	Read-only; expensive to use. First four and last four characters of the API key.
apikey_expires_at	datetime	If type == apikey	Expiration date and time for the API key. NULL means the key never expires.
certificate_subject	string	If type == certificate	Read-only.
duo_user_id	string	If type == duo	Read-only.
duo_username	string	If type == duo	Read-only.
oath_type	string {HOTP, TOTP}	If type == oath	Immutable. OATH type.
oath_initialized	boolean	If type == oath	Default value true.
oath_secret	string		Protected. Value-regexp: ^[A-Z2-7]+$
oath_tokenlen	number	If type == oath	Immutable. Value-range: [4, 16].
oath_timestep	number {30, 45, 60, 90, 120, 180, 300}	If type == oath & oath_type == TOTP	Immutable.
oath_counter	number	If type == oath	Read-only. Default value 0.
oath_timeshift	number	If type == oath & oath_type == TOTP	Read-only. Default value 0.
oath_reuse	boolean	If type == oath & oath_type == TOTP	Default value false. Allow reuse of TOTP tokens.
oath_url	string	If type == oath	Read-only. Protected.
oath_qrcode	string	If type == oath	Read-only. Protected.
sms_token	string	If type == sms	Protected.
sshkey_user_presence_required	boolean	If type == sshkey	Default value true.
sshkey_verification_required	boolean	If type == sshkey	Default value false.
sshkey_counter	number	If type == sshkey
sshkey_publickey	string	If type == sshkey	Read-only; expensive to use. User’s SSH public key.
fido2_credential_id	string	If type == fido2	Read-only. Base64url-encoded FIDO2 credential ID.
fido2_public_key	string	If type == fido2	Read-only. Base64url-encoded COSE public key.
fido2_counter	number	If type == fido2	Read-only. Signature counter for clone detection.
fido2_aaguid	string	If type == fido2	Read-only. Authenticator Attestation GUID.
fido2_transports	string	If type == fido2	Read-only. Supported transports: usb, nfc, ble, internal, hybrid, smart-card.
created_at	datetime		Read-only.
modified_at	datetime		Read-only.
removed	boolean		Read-only.

Retrieve Available Attributes of the Authentication MethodModel

Request

Method	GET
Path	/api/v2/objspec/authentication_method

To check allowed methods, available URL parameters and possible responses please refer to the API Overview section.

Step 1: Obtain Reauthentication Token

Before accessing authentication methods, you must reauthenticate and obtain a confirmation token.

Request

Method	POST
Path	/api/v2/profile/authentication/confirm
Body	ConfirmModel

Note

See section Authentication Confirmation for the list of available ConfirmModel attributes.

POST /api/v2/profile/authentication/confirm

Example Request

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "method": "password",
    "password": "your_password"
  }' \
  'https://10.33.2.133/api/v2/profile/authentication/confirm'

Response

{
    "userid": "5980780305148018689",
    "username": "admin",
    "user-domain": null,
    "methodid": "5980780305148018690",
    "user-privs": ["account-create", "account-read", ...],
    "result": "success",
    "token": "22d05aff6c39f9de8bdba340c31873edaaa6390dcff30137e91bbe0f23161179"
}

Note

Save the token value for use in subsequent requests. The token is valid for 10 minutes and its validity is extended with each use.

Step 2: List User’s Authentication Methods

Request

Method	GET
Path	/api/v2/profile/authentication

GET /api/v2/profile/authentication

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  -H 'X-Auth-Confirm: 22d05aff6c39f9de8bdba340c31873edaaa6390dcff30137e91bbe0f23161179' \
  'https://10.33.2.133/api/v2/profile/authentication'

Response

{
    "result": "success",
    "authentication_method": [
        {
            "id": "5980780305148018689",
            "type": "password",
            "position": 0,
            "external_sync": false,
            "needs_change": false,
            "created_at": "2026-06-03 12:11:03.338262-07",
            "modified_at": "2026-06-03 12:11:15.629025-07"
        },
        {
            "id": "5980780305148018691",
            "type": "apikey",
            "position": 2,
            "external_sync": false,
            "needs_change": false,
            "created_at": "2026-06-03 12:11:16.0128-07",
            "modified_at": "2026-06-03 12:11:16.0128-07"
        },
        {
            "id": "5980780305148018698",
            "type": "oath",
            "position": 3,
            "external_sync": false,
            "needs_change": false,
            "oath_type": "TOTP",
            "oath_initialized": true,
            "oath_tokenlen": 6,
            "oath_timestep": 30,
            "oath_counter": 0,
            "oath_timeshift": 0,
            "oath_reuse": true,
            "created_at": "2026-06-05 00:37:05.628794-07",
            "modified_at": "2026-06-05 00:37:05.629827-07"
        }
    ]
}

Create Authentication Method

Request

Method	POST
Path	/api/v2/profile/authentication
Body	AuthenticationMethodModel

POST /api/v2/profile/authentication

Example Request - Create OATH/TOTP

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  -H 'X-Auth-Confirm: 22d05aff6c39f9de8bdba340c31873edaaa6390dcff30137e91bbe0f23161179' \
  -H 'Content-Type: application/json' \
  -d '{
    "type": "oath",
    "description": "Test OATH TOTP",
    "oath_type": "TOTP",
    "oath_initialized": true,
    "oath_tokenlen": 6,
    "oath_timestep": 30,
    "oath_reuse": false,
    "secret": "JBSWY3DPEHPK3PXP"
  }' \
  'https://10.33.2.133/api/v2/profile/authentication'

Response

{
    "result": "success",
    "authentication_method": {
        "id": "5980780305148018705",
        "oath_url": "otpauth://totp/admin?secret=XWHOXB6YRLMBPMWM5MG4FUHIHVX3SYSI&issuer=Fudo%20Security",
        "oath_qrcode": "Qk1kbyUy..."
    }
}

Note

When creating an OATH method, the response includes oath_url for authenticator apps and oath_qrcode as a base64-encoded QR code image.

Get Authentication Method by ID

Request

Method	GET
Path	/api/v2/profile/authentication/<id>

GET /api/v2/profile/authentication/<id>

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  -H 'X-Auth-Confirm: 22d05aff6c39f9de8bdba340c31873edaaa6390dcff30137e91bbe0f23161179' \
  'https://10.33.2.133/api/v2/profile/authentication/5980780305148018705'

Response

{
    "result": "success",
    "authentication_method": {
        "id": "5980780305148018705",
        "type": "oath",
        "description": "Test OATH TOTP",
        "position": 4,
        "external_sync": false,
        "needs_change": false,
        "oath_type": "TOTP",
        "oath_initialized": true,
        "oath_tokenlen": 6,
        "oath_timestep": 30,
        "oath_counter": 0,
        "oath_timeshift": 0,
        "oath_reuse": false,
        "created_at": "2026-06-08 06:32:32.470217-07",
        "modified_at": "2026-06-08 06:32:32.470217-07"
    }
}

Update Authentication Method

Request

Method	PATCH
Path	/api/v2/profile/authentication/<id>
Body	AuthenticationMethodModel

PATCH /api/v2/profile/authentication/<id>

Example Request

curl -s -k -X PATCH \
  -H 'Authorization: <token>' \
  -H 'X-Auth-Confirm: 22d05aff6c39f9de8bdba340c31873edaaa6390dcff30137e91bbe0f23161179' \
  -H 'Content-Type: application/json' \
  -d '{
    "description": "Updated OATH Description",
    "oath_reuse": true
  }' \
  'https://10.33.2.133/api/v2/profile/authentication/5980780305148018705'

Response

{
    "result": "success"
}

Delete Authentication Method

Request

Method	DELETE
Path	/api/v2/profile/authentication/<id>

DELETE /api/v2/profile/authentication/<id>

Example Request

curl -s -k -X DELETE \
  -H 'Authorization: <token>' \
  -H 'X-Auth-Confirm: 22d05aff6c39f9de8bdba340c31873edaaa6390dcff30137e91bbe0f23161179' \
  'https://10.33.2.133/api/v2/profile/authentication/5980780305148018705'

Response

{
    "result": "success"
}

Invalidate Reauthentication Token

Request

Method	POST
Path	/api/v2/profile/authentication/invalidate
Body	ConfirmModel

POST /api/v2/profile/authentication/invalidate

Example Request

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "method": "password",
    "password": "user_password"
  }' \
  'https://10.33.2.133/api/v2/profile/authentication/invalidate'

Response

{
    "result": "success"
}