GET/api/admin/organizations/enforce-mfa-requirementsAuthenticated

Enforce organization MFA requirements (scheduled job)

Enforces the multi-factor authentication requirements of organizations: removes every member whose grace period ended while they still have no verified MFA factor (recording each removal, which the daily admin report lists), starts a grace period for members without MFA who have none yet (and emails them), deletes grace periods of members who enabled MFA or left, and retries the requirement emails that failed. Members past their grace period already lose the use of their membership when it ends; this job removes the membership itself. This is the scheduled job's entry point (a daily Vercel cron, or a host crontab entry for the deploy/ stack): it only accepts the deployment's cron secret, never a session. Administrators run it by hand with POST.

operationId get_api_admin_organizations_enforce_mfa_requirementsAdministration

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user
Notes
Only the deployment's cron secret (Authorization: Bearer <CRON_SECRET>) is accepted; administrator sessions and access tokens are refused (use POST). Always refused while CRON_SECRET is unset.

Responses

application/json
OrganizationMfaEnforcementResult
PropertyTypeDescription
success*true
message*string
data*object
removed_members*object[]

Members removed from their organization by this run (also recorded for the daily admin report)

organization_id*string

minLength: 4maxLength: 32pattern: ^[a-z][a-z0-9_-]+$

uid*string (uuid)
role*string

Membership role in the organization: owner, member, or admin (the virtual role platform administrators hold in the owner organization).

grace_period_reason*"requirement_enabled" | "mfa_removed"

Why the grace period started: requirement_enabled (the organization started requiring MFA) or mfa_removed (the member lost their last MFA factor while a member).

grace_period_ended_at*number

Unix epoch milliseconds the member's grace period ended

grace_periods_started*integer
grace_periods_cleared*integer
notifications_sent*integer
notifications_failed*integer
JSONExample
"success"true
"message""string"
"data"
"removed_members"
"grace_periods_started"1
"grace_periods_cleared"1
"notifications_sent"1
"notifications_failed"1

Example request

bashcurl
curl -X GET 'https://auth.schemavaults.com/api/admin/organizations/enforce-mfa-requirements' \
  -H 'Authorization: Bearer <access_token>'

Other methods on this path