/api/admin/organizations/enforce-mfa-requirementsAdminEnforce organization MFA requirements (administrators)
Enforces the multi-factor authentication requirements of organizations: removes every member whose grace period ended while they still have no verified MFA factor (recording each removal, which the daily admin report lists), starts a grace period for members without MFA who have none yet (and emails them), deletes grace periods of members who enabled MFA or left, and retries the requirement emails that failed. Members past their grace period already lose the use of their membership when it ends; this job removes the membership itself. Lets a platform administrator run the job by hand; the scheduled job calls GET with the cron secret instead.
post_api_admin_organizations_enforce_mfa_requirementsAdministrationAuthentication & permissionsAdmin
Platform administrators only
- Accepted credentials
- Auth server session (refresh token cookie)
cookie "refresh_token_<auth_server_app_id>" - Access token (cookie)
cookie "access_token_<auth_server_app_id>" - Access token (Bearer)
Authorization: Bearer <JWT>
- Auth server session (refresh token cookie)
- Who may call
- Platform administrators only
- Notes
- Only platform administrators may run the job by hand; the cron secret is not accepted here (it is GET's credential).
Responses
| Property | Type | Description |
|---|---|---|
| success* | true | |
| message* | string | |
| data* | object | |
| removed_members* | object[] | Members removed from their organization by this run (also recorded for the daily admin report) |
| organization_id* | string | minLength: 4maxLength: 32pattern: ^[a-z][a-z0-9_-]+$ |
| uid* | string (uuid) | |
| role* | string | Membership role in the organization: |
| grace_period_reason* | "requirement_enabled" | "mfa_removed" | Why the grace period started: |
| grace_period_ended_at* | number | Unix epoch milliseconds the member's grace period ended |
| grace_periods_started* | integer | |
| grace_periods_cleared* | integer | |
| notifications_sent* | integer | |
| notifications_failed* | integer |
Example request
curl -X POST 'https://auth.schemavaults.com/api/admin/organizations/enforce-mfa-requirements' \
-b 'refresh_token_<auth_server_app_id>=<value>'