GET/api/organizations/{organization_id}/mfa-requirementAuthenticated

Get an organization's MFA requirement

Whether the organization requires its members to use multi-factor authentication, and with which grace period. Organization owners and platform administrators also get the members who have no MFA, with their grace period. Members of the organization and platform administrators may call it.

operationId get_api_organizations_organization_id_mfa_requirementOrganizations

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user
Notes
The caller must be a member of the organization or a platform administrator; members_without_mfa is only listed for owners and platform administrators.

Path parameters

NameTypeDescription
organization_id*string

Organization id (URL-safe slug)

Responses

application/json
PropertyTypeDescription
success*true
message*string
data*object
requirement*OrganizationMfaRequirement
organization_id*string

minLength: 4maxLength: 32pattern: ^[a-z][a-z0-9_-]+$

required*boolean

Whether the organization requires its members to use MFA

grace_period_days*integer | null | null

Grace period of members without MFA, in days; null when MFA is not required

minimum: 1maximum: 90

required_since*number | null | null

Unix epoch milliseconds MFA became required; null when it is not

updated_at*number | null | null

Unix epoch milliseconds the requirement was last changed; null when MFA is not required

caller_has_mfa*boolean

Whether the caller has a verified MFA factor

members_without_mfa*OrganizationMemberWithoutMfa[] | null | null

Members without MFA, soonest grace period end first; empty when MFA is not required. Only listed for organization owners and platform administrators (null for other members).

uid*string (uuid)

The member's user id

email*string (email)
role*string

Membership role in the organization: owner, member, or admin (the virtual role platform administrators hold in the owner organization).

membership_created_at*number

Unix epoch milliseconds the membership was created

status*"pending" | "grace_period" | "expired"

grace_period: the member may still enable MFA until grace_period_ends_at. expired: the grace period ended; the membership grants nothing and the enforcement job removes it. pending: no grace period was started yet (the enforcement job starts one).

grace_period_reason*"requirement_enabled" | "mfa_removed" | null | null

Why the grace period started: requirement_enabled (the organization started requiring MFA) or mfa_removed (the member lost their last MFA factor while a member).

grace_period_ends_at*number | null | null

Unix epoch milliseconds the grace period ends; null while none was started

notified_at*number | null | null

When the member was emailed about the requirement; null until they were

JSONExample
"success"true
"message""string"
"data"
"requirement"
"organization_id""string"
"required"true
"grace_period_days"14
"required_since"1.5
"updated_at"1.5
"caller_has_mfa"true
"members_without_mfa"

Example request

bashcurl
curl -X GET 'https://auth.schemavaults.com/api/organizations/<organization_id>/mfa-requirement' \
  -b 'refresh_token_<auth_server_app_id>=<value>'

Other methods on this path

GET /api/organizations/{organization_id}/mfa-requirement | SchemaVaults Auth API