Profile Authentication Methods Management

Overview

Profile authentication methods endpoints allow users to manage their own authentication methods after successful reauthentication.

Note

These endpoints require an active API session and prior confirmation via the /profile/authentication/confirm endpoint which provides a temporary token.

Authentication Flow

1. Reauthenticate to obtain a confirmation token

2. Use the token in the X-Auth-Confirm header for all subsequent operations

3. Token validity: 10 minutes, extended with each use

Data Structures

AuthenticationMethodModel

Attribute	Type	Required	Description
id	string		Read-only. Unique authentication method identifier.
type	string {password, oath, extauth, sshkey, certificate, duo, sms, apikey, fido2}	yes	Immutable. Authentication method type.
user_id	string		Read-only. Protected. Uniqueness is required in the combination with position.
description	string		Optional description of the authentication method.
position	number		Uniqueness is required in the combination with user_id.
external_sync	boolean		Read-only.
secret	string	If type == password | sshkey	Protected. Authentication secret.
external_authentication_type	string	If type == oath | extauth	Read-only; expensive to use. Type of the external authentication backing this method, for example ad. The portal uses it to decide whether a password change is offered.
needs_change	boolean		Read-only.
apikey_device_id	string	If type == apikey	Read-only; expensive to use.
apikey_device_platform	string	If type == apikey	Read-only; expensive to use.
apikey_device_pushid	string	If type == apikey	Read-only; expensive to use.
apikey_key	string	If type == apikey	Protected.
apikey_hint	string	If type == apikey	Read-only; expensive to use. First four and last four characters of the API key.
apikey_expires_at	datetime	If type == apikey	Expiration date and time for the API key. NULL means the key never expires.
certificate_subject	string	If type == certificate	Read-only.
duo_user_id	string	If type == duo	Read-only.
duo_username	string	If type == duo	Read-only.
oath_type	string {HOTP, TOTP}	If type == oath	Immutable. OATH type.
oath_initialized	boolean	If type == oath	Default value true.
oath_secret	string		Protected. Value-regexp: ^[A-Z2-7]+$
oath_tokenlen	number	If type == oath	Immutable. Value-range: [4, 16].
oath_timestep	number {30, 45, 60, 90, 120, 180, 300}	If type == oath & oath_type == TOTP	Immutable.
oath_counter	number	If type == oath	Read-only. Default value 0.
oath_timeshift	number	If type == oath & oath_type == TOTP	Read-only. Default value 0.
oath_reuse	boolean	If type == oath & oath_type == TOTP	Default value false. Allow reuse of TOTP tokens.
oath_url	string	If type == oath	Read-only. Protected.
oath_qrcode	string	If type == oath	Read-only. Protected.
sms_token	string	If type == sms	Protected.
sshkey_user_presence_required	boolean	If type == sshkey	Default value true.
sshkey_verification_required	boolean	If type == sshkey	Default value false.
sshkey_counter	number	If type == sshkey
sshkey_publickey	string	If type == sshkey	Read-only; expensive to use. User’s SSH public key.
fido2_credential_id	string	If type == fido2	Read-only. Base64url-encoded FIDO2 credential ID.
fido2_public_key	string	If type == fido2	Read-only. Base64url-encoded COSE public key.
fido2_counter	number	If type == fido2	Read-only. Signature counter for clone detection.
fido2_aaguid	string	If type == fido2	Read-only. Authenticator Attestation GUID.
fido2_transports	string	If type == fido2	Read-only. Supported transports: usb, nfc, ble, internal, hybrid, smart-card.
created_at	datetime		Read-only.
modified_at	datetime		Read-only.
removed	boolean		Read-only.

Retrieve Available Attributes of the Authentication MethodModel

Request

Method	GET
Path	/api/v2/objspec/authentication_method

To check allowed methods, available URL parameters and possible responses please refer to the API Overview section.

Step 1: Obtain Reauthentication Token

Before accessing authentication methods, you must reauthenticate and obtain a confirmation token.

Request

Method	POST
Path	/api/v2/profile/authentication/confirm
Body	ConfirmModel

Note

See section Authentication Confirmation for the list of available ConfirmModel attributes.

POST /api/v2/profile/authentication/confirm

Example Request

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "method": "password",
    "password": "your_password"
  }' \
  'https://10.33.2.133/api/v2/profile/authentication/confirm'

Response

{
    "userid": "5980780305148018689",
    "username": "admin",
    "user-domain": null,
    "methodid": "5980780305148018690",
    "user-privs": ["account-create", "account-read", ...],
    "result": "success",
    "token": "22d05aff6c39f9de8bdba340c31873edaaa6390dcff30137e91bbe0f23161179"
}

Note

Save the token value for use in subsequent requests. The token is valid for 10 minutes and its validity is extended with each use.

Step 2: List User’s Authentication Methods

Request

Method	GET
Path	/api/v2/profile/authentication

GET /api/v2/profile/authentication

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  -H 'X-Auth-Confirm: 22d05aff6c39f9de8bdba340c31873edaaa6390dcff30137e91bbe0f23161179' \
  'https://10.33.2.133/api/v2/profile/authentication'

Response

{
    "result": "success",
    "authentication_method": [
        {
            "id": "5980780305148018689",
            "type": "password",
            "position": 0,
            "external_sync": false,
            "needs_change": false,
            "created_at": "2026-06-03 12:11:03.338262-07",
            "modified_at": "2026-06-03 12:11:15.629025-07"
        },
        {
            "id": "5980780305148018691",
            "type": "apikey",
            "position": 2,
            "external_sync": false,
            "needs_change": false,
            "created_at": "2026-06-03 12:11:16.0128-07",
            "modified_at": "2026-06-03 12:11:16.0128-07"
        },
        {
            "id": "5980780305148018698",
            "type": "oath",
            "position": 3,
            "external_sync": false,
            "needs_change": false,
            "oath_type": "TOTP",
            "oath_initialized": true,
            "oath_tokenlen": 6,
            "oath_timestep": 30,
            "oath_counter": 0,
            "oath_timeshift": 0,
            "oath_reuse": true,
            "created_at": "2026-06-05 00:37:05.628794-07",
            "modified_at": "2026-06-05 00:37:05.629827-07"
        }
    ]
}

Create Authentication Method

Request

Method	POST
Path	/api/v2/profile/authentication
Body	AuthenticationMethodModel

POST /api/v2/profile/authentication

Example Request - Create OATH/TOTP

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  -H 'X-Auth-Confirm: 22d05aff6c39f9de8bdba340c31873edaaa6390dcff30137e91bbe0f23161179' \
  -H 'Content-Type: application/json' \
  -d '{
    "type": "oath",
    "description": "Test OATH TOTP",
    "oath_type": "TOTP",
    "oath_initialized": true,
    "oath_tokenlen": 6,
    "oath_timestep": 30,
    "oath_reuse": false,
    "secret": "JBSWY3DPEHPK3PXP"
  }' \
  'https://10.33.2.133/api/v2/profile/authentication'

Response

{
    "result": "success",
    "authentication_method": {
        "id": "5980780305148018705",
        "oath_url": "otpauth://totp/admin?secret=XWHOXB6YRLMBPMWM5MG4FUHIHVX3SYSI&issuer=Fudo%20Security",
        "oath_qrcode": "Qk1kbyUy..."
    }
}

Note

When creating an OATH method, the response includes oath_url for authenticator apps and oath_qrcode as a base64-encoded QR code image.

Get Authentication Method by ID

Request

Method	GET
Path	/api/v2/profile/authentication/<id>

GET /api/v2/profile/authentication/<id>

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  -H 'X-Auth-Confirm: 22d05aff6c39f9de8bdba340c31873edaaa6390dcff30137e91bbe0f23161179' \
  'https://10.33.2.133/api/v2/profile/authentication/5980780305148018705'

Response

{
    "result": "success",
    "authentication_method": {
        "id": "5980780305148018705",
        "type": "oath",
        "description": "Test OATH TOTP",
        "position": 4,
        "external_sync": false,
        "needs_change": false,
        "oath_type": "TOTP",
        "oath_initialized": true,
        "oath_tokenlen": 6,
        "oath_timestep": 30,
        "oath_counter": 0,
        "oath_timeshift": 0,
        "oath_reuse": false,
        "created_at": "2026-06-08 06:32:32.470217-07",
        "modified_at": "2026-06-08 06:32:32.470217-07"
    }
}

Update Authentication Method

Request

Method	PATCH
Path	/api/v2/profile/authentication/<id>
Body	AuthenticationMethodModel

PATCH /api/v2/profile/authentication/<id>

Example Request

curl -s -k -X PATCH \
  -H 'Authorization: <token>' \
  -H 'X-Auth-Confirm: 22d05aff6c39f9de8bdba340c31873edaaa6390dcff30137e91bbe0f23161179' \
  -H 'Content-Type: application/json' \
  -d '{
    "description": "Updated OATH Description",
    "oath_reuse": true
  }' \
  'https://10.33.2.133/api/v2/profile/authentication/5980780305148018705'

Response

{
    "result": "success"
}

Delete Authentication Method

Request

Method	DELETE
Path	/api/v2/profile/authentication/<id>

DELETE /api/v2/profile/authentication/<id>

Example Request

curl -s -k -X DELETE \
  -H 'Authorization: <token>' \
  -H 'X-Auth-Confirm: 22d05aff6c39f9de8bdba340c31873edaaa6390dcff30137e91bbe0f23161179' \
  'https://10.33.2.133/api/v2/profile/authentication/5980780305148018705'

Response

{
    "result": "success"
}

Pair Fudo Officer 🆕

This endpoint completes the Fudo Officer pairing that an administrator initiated for the calling user (see User Mobile Access (Fudo Officer)) and returns the QR code that the Fudo Officer mobile application scans. The request requires the reauthentication token and a request body, which can be an empty JSON object.

The request fails in the following cases:

• Mobile application support (Call Home) is disabled. The mobile_supported attribute of the current user identity shows whether it is enabled.

• No administrator initiated the pairing for the user (HTTP status 403).

• The Fudo Officer application is already paired.

Request

Method	POST
Path	/api/v2/profile/authentication/fudo-officer/qrcode
Headers	X-Auth-Confirm: <token>

POST /api/v2/profile/authentication/fudo-officer/qrcode

Example Request

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  -H 'X-Auth-Confirm: cd908171638f288daac584abd4a71c7eaa3bea91ad4d0f603b8f7c17f740e55c' \
  -H 'Content-Type: application/json' \
  -d '{}' \
  'https://10.33.4.95/api/v2/profile/authentication/fudo-officer/qrcode'

Response

The response contains the identifier of the Fudo Officer authentication method and the mobile_qrcode object: qrcode_json holds the pairing data encoded in the QR code, and qrcode_image the QR code as a base64-encoded BMP image. Both values are shortened in the example.

{
    "result": "success",
    "authentication_method": {
        "id": "5890708312600608773"
    },
    "mobile_qrcode": {
        "qrcode_json": "{\n    \"created_on\": \"80154212\",\n    \"user\": {\n ...",
        "qrcode_image": "Qk0AAAAAAAAAAD4AAAAoAAAAZAEAAJz+//8BAAEAAAAAAMBCAAAAAAAAAAAA..."
    }
}

Unpair Fudo Officer 🆕

This endpoint removes the Fudo Officer pairing of the calling user. It requires the reauthentication token and works also when mobile application support is disabled.

Request

Method	DELETE
Path	/api/v2/profile/authentication/fudo-officer
Headers	X-Auth-Confirm: <token>

DELETE /api/v2/profile/authentication/fudo-officer

Example Request

curl -s -k -X DELETE \
  -H 'Authorization: <token>' \
  -H 'X-Auth-Confirm: cd908171638f288daac584abd4a71c7eaa3bea91ad4d0f603b8f7c17f740e55c' \
  'https://10.33.4.95/api/v2/profile/authentication/fudo-officer'

Response

{
    "result": "success"
}

Invalidate Reauthentication Token

Request

Method	POST
Path	/api/v2/profile/authentication/invalidate
Body	ConfirmModel

POST /api/v2/profile/authentication/invalidate

Example Request

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "method": "password",
    "password": "user_password"
  }' \
  'https://10.33.2.133/api/v2/profile/authentication/invalidate'

Response

{
    "result": "success"
}