import * as outputs from "../types/output"; export interface FusionAuthApiKeyPermissionsEndpoint { /** * HTTP DELETE Verb */ delete?: boolean; endpoint: string; /** * HTTP GET Verb */ get?: boolean; /** * HTTP PATCH Verb */ patch?: boolean; /** * HTTP POST Verb */ post?: boolean; /** * HTTP PUT Verb */ put?: boolean; } export interface FusionAuthApplicationAccessControlConfiguration { /** * The Id of the IP Access Control List limiting access to this application. */ uiIpAccessControlListId?: string; } export interface FusionAuthApplicationCleanSpeakConfiguration { /** * An array of UUIDs that map to the CleanSpeak applications for this Application. It is possible that a single Application in FusionAuth might have multiple Applications in CleanSpeak. For example, a FusionAuth Application for a game might have one CleanSpeak Application for usernames and another Application for chat. */ applicationIds?: string[]; usernameModeration?: outputs.FusionAuthApplicationCleanSpeakConfigurationUsernameModeration; } export interface FusionAuthApplicationCleanSpeakConfigurationUsernameModeration { /** * The Id of the CleanSpeak application that usernames are sent to for moderation. */ applicationId?: string; /** * True if CleanSpeak username moderation is enabled. */ enabled?: boolean; } export interface FusionAuthApplicationEmailConfiguration { /** * The Id of the Email Template used to send emails to users when their email address is updated. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ emailUpdateTemplateId?: string; /** * The Id of the Email Template used to send emails to users to verify that their email address is valid. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ emailVerificationTemplateId?: string; /** * The Id of the Email Template used to verify user emails. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ emailVerifiedTemplateId?: string; /** * The Id of the Email Template that is used when a user is sent a forgot password email. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ forgotPasswordTemplateId?: string; /** * The Id of the Email Template used to send emails to users when another user attempts to create an account with their login Id. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ loginIdInUseOnCreateTemplateId?: string; /** * The Id of the Email Template used to send emails to users when another user attempts to update an existing account to use their login Id. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ loginIdInUseOnUpdateTemplateId?: string; /** * The Id of the Email Template used to send emails to users when they log in on a new device. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ loginNewDeviceTemplateId?: string; /** * The Id of the Email Template used to send emails to users when a suspicious login occurs. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ loginSuspiciousTemplateId?: string; /** * The Id of the Email Template used to send emails to users when they have completed a 'forgot password' workflow and their password has been reset. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ passwordResetSuccessTemplateId?: string; /** * The Id of the Email Template used to send emails to users when their password has been updated. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ passwordUpdateTemplateId?: string; /** * The Id of the Passwordless Email Template, sent to users when they start a passwordless login. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ passwordlessEmailTemplateId?: string; /** * The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ setPasswordEmailTemplateId?: string; /** * The Id of the Email Template used to send emails to users when a MFA method has been added to their account. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ twoFactorMethodAddTemplateId?: string; /** * The Id of the Email Template used to send emails to users when a MFA method has been removed from their account. When configured, this value will take precedence over the same configuration from the Tenant when an application context is known. */ twoFactorMethodRemoveTemplateId?: string; } export interface FusionAuthApplicationFormConfiguration { /** * The unique Id of the form to use for the Add and Edit User Registration form when used in the FusionAuth admin UI. */ adminRegistrationFormId: string; selfServiceFormConfiguration?: outputs.FusionAuthApplicationFormConfigurationSelfServiceFormConfiguration; /** * The unique Id of the form to to enable authenticated users to manage their profile on the account page. */ selfServiceFormId?: string; } export interface FusionAuthApplicationFormConfigurationSelfServiceFormConfiguration { /** * When enabled a user will be required to provide their current password when changing their password on a self-service account form. */ requireCurrentPasswordOnPasswordChange?: boolean; } export interface FusionAuthApplicationJwtConfiguration { /** * The Id of the signing key used to sign the access token. */ accessTokenId: string; /** * Indicates if this application is using the JWT configuration defined here or the global JWT configuration defined by the System Configuration. If this is false the signing algorithm configured in the System Configuration will be used. If true the signing algorithm defined in this application will be used. */ enabled?: boolean; /** * The Id of the signing key used to sign the Id token. */ idTokenKeyId: string; /** * The Refresh Token expiration policy. The possible values are: Fixed - the expiration is calculated from the time the token is issued. SlidingWindow - the expiration is calculated from the last time the token was used. SlidingWindowWithMaximumLifetime - the expiration is calculated from the last time the token was used, or until `refreshTokenSlidingWindowMaximumTtlInMinutes` is reached. */ refreshTokenExpirationPolicy?: string; /** * The maximum lifetime of a refresh token when using a refresh token expiration policy of `SlidingWindowWithMaximumLifetime`. Value must be greater than 0. */ refreshTokenSlidingWindowMaximumTtlInMinutes?: number; /** * The length of time in minutes the JWT refresh token will live before it is expired and is not able to be exchanged for a JWT. */ refreshTokenTtlMinutes?: number; /** * The refresh token usage policy. The following are valid values: Reusable - the token does not change after it was issued. OneTimeUse - the token value will be changed each time the token is used to refresh a JWT. The client must store the new value after each usage. Defaults to Reusable. */ refreshTokenUsagePolicy?: string; /** * The length of time in seconds the JWT will live before it is expired and no longer valid. */ ttlSeconds?: number; } export interface FusionAuthApplicationLambdaConfiguration { /** * The Id of the Lambda that will be invoked when an access token is generated for this application. This will be utilized during OAuth2 and OpenID Connect authentication requests as well as when an access token is generated for the Login API. */ accessTokenPopulateId?: string; /** * The Id of the Lambda that will be invoked when an Id token is generated for this application during an OpenID Connect authentication request. */ idTokenPopulateId?: string; /** * The Id of the Lambda that will be invoked when a a SAML response is generated during a SAML authentication request. */ samlv2PopulateId?: string; /** * The unique Id of the lambda that will be used to perform additional validation on registration form steps. */ selfServiceRegistrationValidationId?: string; /** * The Id of the Lambda that will be invoked when a UserInfo response is generated for this application. */ userinfoPopulateId?: string; } export interface FusionAuthApplicationLoginConfiguration { /** * Indicates if a JWT may be refreshed using a Refresh Token for this application. This configuration is separate from issuing new Refresh Tokens which is controlled by the generateRefreshTokens parameter. This configuration indicates specifically if an existing Refresh Token may be used to request a new JWT using the Refresh API. */ allowTokenRefresh?: boolean; /** * Indicates if a Refresh Token should be issued from the Login API */ generateRefreshTokens?: boolean; /** * Indicates if the Login API should require an API key. If you set this value to false and your FusionAuth API is on a public network, anyone may attempt to use the Login API. */ requireAuthentication?: boolean; } export interface FusionAuthApplicationMultiFactorConfiguration { /** * The Id of the email template that is used when notifying a user to complete a multi-factor authentication request. */ emailTemplateId?: string; /** * When enabled and a user has one or more two-factor methods configured, the user will be required to complete a two-factor challenge during login. When disabled, even when a user has configured one or more two-factor methods, the user will not be required to complete a two-factor challenge during login. When required, the user will be required to complete a two-factor challenge during login. Possible values are `Enabled`, `Disabled` or `Required`. */ loginPolicy?: string; /** * The Id of the SMS template that is used when notifying a user to complete a multi-factor authentication request. */ smsTemplateId?: string; /** * When `multi_factor_configuration.login_policy` is set to `Enabled`, this trust policy is utilized when determining if a user must complete a two-factor challenge during login. Possible values are `Any`, `This` or `None`. */ trustPolicy?: string; } export interface FusionAuthApplicationOauthConfiguration { /** * An array of URLs that are the authorized origins for FusionAuth OAuth. */ authorizedOriginUrls?: string[]; /** * An array of URLs that are the authorized redirect URLs for FusionAuth OAuth. */ authorizedRedirectUrls?: string[]; /** * Determines whether wildcard expressions will be allowed in the authorizedRedirectUrls and authorized_origin_urls. */ authorizedUrlValidationPolicy?: string; /** * Determines the client authentication requirements for the OAuth 2.0 Token endpoint. */ clientAuthenticationPolicy?: string; /** * The OAuth 2.0 client id. If you leave this blank during a POST, a client id will be generated for you. If you leave this blank during PUT, the previous value will be maintained. For both POST and PUT you can provide a value and it will be stored. */ clientId: string; /** * The OAuth 2.0 client secret. If you leave this blank during a POST, a secure secret will be generated for you. If you leave this blank during PUT, the previous value will be maintained. For both POST and PUT you can provide a value and it will be stored. */ clientSecret: string; /** * Controls the policy for prompting a user to consent to requested OAuth scopes. This configuration only takes effect when `application.oauthConfiguration.relationship` is `ThirdParty`. The possible values are: * * `AlwaysPrompt` - Always prompt the user for consent. * * `RememberDecision` - Remember previous consents; only prompt if the choice expires or if the requested or required scopes have changed. The duration of this persisted choice is controlled by the Tenant’s `externalIdentifierConfiguration.rememberOAuthScopeConsentChoiceTimeToLiveInSeconds` value. * * `NeverPrompt` - The user will be never be prompted to consent to requested OAuth scopes. Permission will be granted implicitly as if this were a `FirstParty` application. This configuration is meant for testing purposes only and should not be used in production. */ consentMode?: string; /** * Whether or not FusionAuth will log a debug Event Log. This is particular useful for debugging the authorization code exchange with the Token endpoint during an Authorization Code grant." */ debug?: boolean; /** * The device verification URL to be used with the Device Code grant type, this field is required when deviceCode is enabled. */ deviceVerificationUrl?: string; /** * The enabled grants for this application. In order to utilize a particular grant with the OAuth 2.0 endpoints you must have enabled the grant. */ enabledGrants?: string[]; /** * Determines if the OAuth 2.0 Token endpoint will generate a refresh token when the offlineAccess scope is requested. */ generateRefreshTokens?: boolean; /** * Behavior when /oauth2/logout is called. */ logoutBehavior?: string; /** * The logout URL for the Application. FusionAuth will redirect to this URL after the user logs out of OAuth. */ logoutUrl?: string; /** * Determines the PKCE requirements when using the authorization code grant. */ proofKeyForCodeExchangePolicy?: string; /** * Configures which of the default scopes are enabled and required. */ providedScopePolicies: outputs.FusionAuthApplicationOauthConfigurationProvidedScopePolicy[]; /** * The application’s relationship to the OAuth server. The possible values are: * * `FirstParty` - The application has the same owner as the authorization server. Consent to requested OAuth scopes is granted implicitly. * * `ThirdParty` - The application is external to the authorization server. Users will be prompted to consent to requested OAuth scopes based on the application object’s `oauthConfiguration.consentMode` value. Note: An Essentials or Enterprise plan is required to utilize third-party applications. */ relationship?: string; /** * Determines if the OAuth 2.0 Token endpoint requires client authentication. If this is enabled, the client must provide client credentials when using the Token endpoint. The clientId and clientSecret may be provided using a Basic Authorization HTTP header, or by sending these parameters in the request body using POST data. * * @deprecated In version 1.28.0 and beyond, client authentication can be managed via oauth_configuration.client_authentication_policy. */ requireClientAuthentication?: boolean; /** * When enabled the user will be required to be registered, or complete registration before redirecting to the configured callback in the authorization code grant or the implicit grant. This configuration does not currently apply to any other grant. */ requireRegistration?: boolean; /** * Controls the policy for handling of OAuth scopes when populating JWTs and the UserInfo response. The possible values are: * * `Compatibility` - OAuth workflows will populate JWT and UserInfo claims in a manner compatible with versions of FusionAuth before version 1.50.0. * * `Strict` - OAuth workflows will populate token and UserInfo claims according to the OpenID Connect 1.0 specification based on requested and consented scopes. */ scopeHandlingPolicy: string; /** * Controls the policy for handling unknown scopes on an OAuth request. The possible values are: * * `Allow` - Unknown scopes will be allowed on the request, passed through the OAuth workflow, and written to the resulting tokens without consent. * * `Remove` - Unknown scopes will be removed from the OAuth workflow, but the workflow will proceed without them. * * `Reject` - Unknown scopes will be rejected and cause the OAuth workflow to fail with an error. */ unknownScopePolicy: string; } export interface FusionAuthApplicationOauthConfigurationProvidedScopePolicy { address?: outputs.FusionAuthApplicationOauthConfigurationProvidedScopePolicyAddress; email?: outputs.FusionAuthApplicationOauthConfigurationProvidedScopePolicyEmail; phone?: outputs.FusionAuthApplicationOauthConfigurationProvidedScopePolicyPhone; profile?: outputs.FusionAuthApplicationOauthConfigurationProvidedScopePolicyProfile; } export interface FusionAuthApplicationOauthConfigurationProvidedScopePolicyAddress { enabled?: boolean; required?: boolean; } export interface FusionAuthApplicationOauthConfigurationProvidedScopePolicyEmail { enabled?: boolean; required?: boolean; } export interface FusionAuthApplicationOauthConfigurationProvidedScopePolicyPhone { enabled?: boolean; required?: boolean; } export interface FusionAuthApplicationOauthConfigurationProvidedScopePolicyProfile { enabled?: boolean; required?: boolean; } export interface FusionAuthApplicationRegistrationConfiguration { birthDate?: outputs.FusionAuthApplicationRegistrationConfigurationBirthDate; /** * Determines if the password should be confirmed during self service registration, this means that the user will be required to type the password twice. */ confirmPassword?: boolean; /** * Determines if self service registration is enabled for this application. When this value is false, you may still use the Registration API, this only affects if the self service option is available during the OAuth 2.0 login. */ enabled?: boolean; firstName?: outputs.FusionAuthApplicationRegistrationConfigurationFirstName; /** * The Id of an associated Form when using advanced registration configuration type. This field is required when application.registrationConfiguration.type is set to advanced. */ formId?: string; fullName?: outputs.FusionAuthApplicationRegistrationConfigurationFullName; lastName?: outputs.FusionAuthApplicationRegistrationConfigurationLastName; /** * The unique login Id that will be collected during registration, this value can be email or username. Leaving the default value of email is preferred because an email address is globally unique. */ loginIdType?: string; middleName?: outputs.FusionAuthApplicationRegistrationConfigurationMiddleName; mobilePhone?: outputs.FusionAuthApplicationRegistrationConfigurationMobilePhone; preferredLanguages?: outputs.FusionAuthApplicationRegistrationConfigurationPreferredLanguages; /** * The type of registration flow. */ type?: string; } export interface FusionAuthApplicationRegistrationConfigurationBirthDate { enabled?: boolean; required?: boolean; } export interface FusionAuthApplicationRegistrationConfigurationFirstName { enabled?: boolean; required?: boolean; } export interface FusionAuthApplicationRegistrationConfigurationFullName { enabled?: boolean; required?: boolean; } export interface FusionAuthApplicationRegistrationConfigurationLastName { enabled?: boolean; required?: boolean; } export interface FusionAuthApplicationRegistrationConfigurationMiddleName { enabled?: boolean; required?: boolean; } export interface FusionAuthApplicationRegistrationConfigurationMobilePhone { enabled?: boolean; required?: boolean; } export interface FusionAuthApplicationRegistrationConfigurationPreferredLanguages { enabled?: boolean; required?: boolean; } export interface FusionAuthApplicationRegistrationDeletePolicy { /** * Indicates that users without a verified registration for this application will have their registration permanently deleted after application.registrationDeletePolicy.unverified.numberOfDaysToRetain days. */ unverifiedEnabled?: boolean; /** * The number of days from registration a user’s registration will be retained before being deleted for not completing registration verification. This field is required when application.registrationDeletePolicy.enabled is set to true. Value must be greater than 0. */ unverifiedNumberOfDaysToRetain?: number; } export interface FusionAuthApplicationSamlv2Configuration { assertionEncryptionConfiguration?: outputs.FusionAuthApplicationSamlv2ConfigurationAssertionEncryptionConfiguration; /** * The audience for the SAML response sent to back to the service provider from FusionAuth. Some service providers require different audience values than the issuer and this configuration option lets you change the audience in the response. */ audience?: string; /** * An array of URLs that are the authorized redirect URLs for FusionAuth OAuth. */ authorizedRedirectUrls: string[]; /** * The URL of the callback (sometimes called the Assertion Consumer Service or ACS). This is where FusionAuth sends the browser after the user logs in via SAML. * * @deprecated In version 1.20.0 and beyond, Callback URLs can be managed via authorized_redirect_urls. */ callbackUrl: string; /** * Whether or not FusionAuth will log SAML debug messages to the event log. This is useful for debugging purposes. */ debug?: boolean; /** * Default verification key to use for HTTP Redirect Bindings, and for POST Bindings when no key is found in request. */ defaultVerificationKeyId?: string; /** * Whether or not the SAML IdP for this Application is enabled or not. */ enabled?: boolean; initiatedLogin?: outputs.FusionAuthApplicationSamlv2ConfigurationInitiatedLogin; /** * The issuer that identifies the service provider and allows FusionAuth to load the correct Application and SAML configuration. If you don’t know the issuer, you can often times put in anything here and FusionAuth will display an error message with the issuer from the service provider when you test the SAML login. */ issuer: string; /** * The id of the Key used to sign the SAML response. If you do not specify this property, FusionAuth will create a new key and associate it with this Application. */ keyId: string; loginHintConfiguration?: outputs.FusionAuthApplicationSamlv2ConfigurationLoginHintConfiguration; logout: outputs.FusionAuthApplicationSamlv2ConfigurationLogout; /** * The URL that the browser is taken to after the user logs out of the SAML service provider. Often service providers need this URL in order to correctly hook up single-logout. Note that FusionAuth does not support the SAML single-logout profile because most service providers to not support it properly. */ logoutUrl?: string; /** * If set to true, will force verification through the key store. */ requiredSignedRequests?: boolean; /** * The XML signature canonicalization method used when digesting and signing the SAML response. Unfortunately, many service providers do not correctly implement the XML signature specifications and force a specific canonicalization method. This setting allows you to change the canonicalization method to match the service provider. Often, service providers don’t even document their required method. You might need to contact enterprise support at the service provider to figure out what method they use. */ xmlSignatureCanonicalizationMethod?: string; /** * The location to place the XML signature when signing a successful SAML response. */ xmlSignatureLocation?: string; } export interface FusionAuthApplicationSamlv2ConfigurationAssertionEncryptionConfiguration { /** * The message digest algorithm to use when encrypting the symmetric key for transport. The possible values are: SHA1 - SHA-1 hashing algorithm, SHA256 - SHA-256 hashing algorithm, SHA384 - SHA-384 hashing algorithm or SHA512 - SHA-512 hashing algorithm. Using SHA256 or higher is recommended. */ digestAlgorithm?: string; /** * Determines if SAML assertion encryption is enabled for this Application. */ enabled?: boolean; /** * The symmetric key encryption algorithm that will be used to encrypt SAML assertions. A new symmetric key will be generated every time an assertion is encrypted. AES ciphers can operate in Cipher Block Chaining (CBC) or Galois/Counter Mode (GCM). The possible values are: AES128, AES192, AES256, AES128GCM, AES192GCM, AES256GCM or TripleDES. */ encryptionAlgorithm?: string; /** * The location that the encrypted symmetric key information will be placed in the SAML response in relation to the EncryptedData element containing the encrypted assertion value. The possible values are: Child (The EncryptedKey element will be wrapped in a KeyInfo element and added inside the EncryptedData) or Sibling (The EncryptedKey element will be added to the document as a sibling of EncryptedData). */ keyLocation?: string; /** * The encryption algorithm used to encrypt the symmetric key for transport in the SAML response. The possible values are: RSAv15, RSA_OAEP or RSA_OAEP_MGF1P. */ keyTransportAlgorithm?: string; /** * The unique Id of the Key used to encrypt the symmetric key for transport in the SAML response. The selected Key must contain an RSA certificate. This parameter is required when application.samlv2Configuration.assertionEncryptionConfiguration.enabled is set to true. */ keyTransportEncryptionKeyId?: string; /** * The mask generation function and hash function to use for the Optimal Asymmetric Encryption Padding when encrypting a symmetric key for transport. The possible values are: MGF1_SHA1, MGF1_SHA224, MGF1_SHA256, MGF1_SHA384 or MGF1_SHA512. This value is only used when the `application.samlv2Configuration.assertionEncryptionConfiguration.keyTransportAlgorithm` is set to RSA_OAEP. RSAv15 does not require a message digest function, and RSA_OAEP_MGF1P will always use MGF1_SHA1 regardless of this value. */ maskGenerationFunction?: string; } export interface FusionAuthApplicationSamlv2ConfigurationInitiatedLogin { /** * Determines if SAML v2 IdP initiated login is enabled for this application. See application.samlv2Configuration.authorizedRedirectURLs for information on which destination URLs are allowed. */ enabled?: boolean; /** * The value sent in the AuthN response to the SAML v2 Service Provider in the NameID assertion. */ nameIdFormat?: string; } export interface FusionAuthApplicationSamlv2ConfigurationLoginHintConfiguration { /** * When enabled, FusionAuth will accept a username or email address as a login hint on a custom HTTP request parameter. */ enabled?: boolean; /** * The name of the parameter that will be used to pass the login hint to the SAML v2 IdP. */ parameterName?: string; } export interface FusionAuthApplicationSamlv2ConfigurationLogout { /** * This configuration is functionally equivalent to the Logout Behavior found in the OAuth2 configuration. */ behavior?: string; /** * The unique Id of the Key used to verify the signature if the public key cannot be determined by the KeyInfo element when using POST bindings, or the key used to verify the signature when using HTTP Redirect bindings. */ defaultVerificationKeyId?: string; /** * The unique Id of the Key used to sign the SAML Logout response. */ keyId?: string; /** * Set this parameter equal to true to require the SAML v2 Service Provider to sign the Logout request. When this value is true all Logout requests missing a signature will be rejected. */ requireSignedRequests?: boolean; singleLogout?: outputs.FusionAuthApplicationSamlv2ConfigurationLogoutSingleLogout; /** * The XML signature canonicalization method used when digesting and signing the SAML Logout response. Unfortunately, many service providers do not correctly implement the XML signature specifications and force a specific canonicalization method. This setting allows you to change the canonicalization method to match the service provider. Often, service providers don’t even document their required method. You might need to contact enterprise support at the service provider to figure out what method they use. */ xmlSignatureCanonicalizationMethod?: string; } export interface FusionAuthApplicationSamlv2ConfigurationLogoutSingleLogout { /** * Whether or not SAML Single Logout for this SAML IdP is enabled. */ enabled?: boolean; /** * The unique Id of the Key used to sign the SAML Single Logout response. */ keyId?: string; /** * The URL at which you want to receive the LogoutRequest from FusionAuth. */ url?: string; /** * The XML signature canonicalization method used when digesting and signing the SAML Single Logout response. Unfortunately, many service providers do not correctly implement the XML signature specifications and force a specific canonicalization method. This setting allows you to change the canonicalization method to match the service provider. Often, service providers don’t even document their required method. You might need to contact enterprise support at the service provider to figure out what method they use. */ xmlSignatureCanonicalizationMethod?: string; } export interface FusionAuthApplicationWebauthnConfiguration { /** * Indicates if this application enables WebAuthn workflows based on the configuration defined here or the Tenant WebAuthn configuration. If this is false, WebAuthn workflows will be enabled based on the Tenant configuration. If true, WebAuthn workflows will be enabled according to the configuration of this application. */ bootstrapWorkflowEnabled?: boolean; /** * Whether the WebAuthn bootstrap workflow is enabled for this application. This overrides the tenant configuration. Has no effect if application.webAuthnConfiguration.enabled is false. */ enabled?: boolean; /** * Whether the WebAuthn reauthentication workflow is enabled for this application. This overrides the tenant configuration. Has no effect if application.webAuthnConfiguration.enabled is false. */ reauthenticationWorkflowEnabled?: boolean; } export interface FusionAuthEntityTypeJwtConfiguration { /** * The unique ID of the signing key used to sign the access token. Required when * enabled is set to true. */ accessTokenKeyId?: string; /** * Indicates if this application is using the JWT configuration defined here or the global JWT * configuration defined by the Tenant. If this is false the signing algorithm configured in the Tenant will be used. * If true the signing algorithm defined in this application will be used. */ enabled?: boolean; /** * The length of time in seconds the JWT will live before it is expired and no longer valid. Required when enabled is set to true. */ timeToLiveInSeconds?: number; } export interface FusionAuthFormFieldValidator { /** * Determines if user input should be validated. */ enabled?: boolean; /** * A regular expression used to validate user input. Must be a valid regular expression pattern. */ expression?: string; } export interface FusionAuthFormStep { /** * An ordered list of Form Field Ids assigned to this step. */ fields: string[]; } export interface FusionAuthIdpAppleApplicationConfiguration { /** * ID of the Application to apply this configuration to. */ applicationId?: string; /** * The Apple Bundle identifier found in your Apple Developer Account which has been configured for Sign in with Apple. The Bundle identifier is used to Sign in with Apple from native applications. The request must include `bundleId` or `servicesId` . If `servicesId` is omitted, this field is required. */ bundleId?: string; /** * This is an optional Application specific override for the top level button text. */ buttonText?: string; /** * Determines if a UserRegistration is created for the User automatically or not. If a user doesn’t exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. */ createRegistration?: boolean; /** * Determines if this identity provider is enabled for the Application specified by the applicationId key. */ enabled?: boolean; /** * This is an optional Application specific override for the top level keyId. */ keyId?: string; /** * This is an optional Application specific override for for the top level scope. */ scope?: string; /** * This is an optional Application specific override for for the top level servicesId. */ servicesId?: string; /** * This is an optional Application specific override for for the top level teamId. */ teamId?: string; } export interface FusionAuthIdpAppleTenantConfiguration { /** * When enabled, the number of identity provider links a user may create is enforced by maximumLinks */ limitUserLinkCountEnabled?: boolean; /** * Determines if this provider is enabled. If it is false then it will be disabled globally. */ limitUserLinkCountMaximumLinks?: number; /** * The unique Id of the tenant that this configuration applies to. */ tenantId?: string; } export interface FusionAuthIdpExternalJwtApplicationConfiguration { /** * ID of the Application to apply this configuration to. */ applicationId?: string; /** * Determines if a UserRegistration is created for the User automatically or not. If a user doesn’t exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. */ createRegistration?: boolean; /** * Determines if this identity provider is enabled for the Application specified by the applicationId key. */ enabled?: boolean; } export interface FusionAuthIdpExternalJwtTenantConfiguration { /** * When enabled, the number of identity provider links a user may create is enforced by maximumLinks */ limitUserLinkCountEnabled?: boolean; /** * Determines if this provider is enabled. If it is false then it will be disabled globally. */ limitUserLinkCountMaximumLinks?: number; /** * The unique Id of the tenant that this configuration applies to. */ tenantId?: string; } export interface FusionAuthIdpFacebookApplicationConfiguration { /** * This is an optional Application specific override for the top level `appId`. */ appId?: string; /** * ID of the FusionAuth Application to apply this configuration to. */ applicationId?: string; /** * This is an optional Application specific override for the top level `buttonText`. */ buttonText?: string; /** * This is an optional Application specific override for the top level `clientSecret`. */ clientSecret?: string; /** * Determines if a `UserRegistration` is created for the User automatically or not. If a user doesn’t exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. */ createRegistration?: boolean; /** * Determines if this identity provider is enabled for the Application specified by the `applicationId` property. */ enabled?: boolean; /** * This is an optional Application specific override for the top level `fields`. */ fields?: string; /** * This is an optional Application specific override for the top level `permissions`. */ permissions?: string; } export interface FusionAuthIdpFacebookTenantConfiguration { /** * When enabled, the number of identity provider links a user may create is enforced by maximumLinks */ limitUserLinkCountEnabled?: boolean; /** * Determines if this provider is enabled. If it is false then it will be disabled globally. */ limitUserLinkCountMaximumLinks?: number; /** * The unique Id of the tenant that this configuration applies to. */ tenantId?: string; } export interface FusionAuthIdpGoogleApplicationConfiguration { /** * ID of the Application to apply this configuration to. */ applicationId?: string; /** * This is an optional Application specific override for the top level button text. */ buttonText?: string; /** * This is an optional Application specific override for the top level client id. */ clientId?: string; /** * This is an optional Application specific override for the top level client secret. */ clientSecret?: string; /** * Determines if a UserRegistration is created for the User automatically or not. If a user doesn’t exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. */ createRegistration?: boolean; /** * Determines if this identity provider is enabled for the Application specified by the applicationId key. */ enabled?: boolean; /** * This is an optional Application specific override for the top level properties. */ properties?: outputs.FusionAuthIdpGoogleApplicationConfigurationProperties; /** * This is an optional Application specific override for for the top level scope. */ scope?: string; } export interface FusionAuthIdpGoogleApplicationConfigurationProperties { /** * This is an optional Application specific override for the top level properties.api . If this `loginMethod` is set to UsePopup, or the Application configuration is unset and the top level loginMethod is set to UsePopup, and this value contains the conflicting ux_mode=redirect property, that single property will be replaced with ux_mode=popup. */ api?: string; /** * This is an optional Application specific override for the top level `button`. */ button?: string; } export interface FusionAuthIdpGoogleProperties { /** * Google Identity Services login API configuration in a properties file formatted String. Any attribute from Google's documentation can be added. Properties can be referenced in templates that support Google login to initialize the API via HTML or JavaScript. The properties specified in this field should not include the data- prefix on the property name. If the `loginMethod` is set to UsePopup and this value contains the conflicting ux_mode=redirect property, that single property will be replaced with ux_mode=popup. */ api?: string; /** * Google Identity Services button configuration in a properties file formatted String. Any attribute from Google's documentation can be added. Properties can be referenced in templates that support Google login to render the login button via HTML or JavaScript. The properties specified in this field should not include the data- prefix on the property name. */ button?: string; } export interface FusionAuthIdpGoogleTenantConfiguration { /** * When enabled, the number of identity provider links a user may create is enforced by maximumLinks */ limitUserLinkCountEnabled?: boolean; /** * Determines if this provider is enabled. If it is false then it will be disabled globally. */ limitUserLinkCountMaximumLinks?: number; /** * The unique Id of the tenant that this configuration applies to. */ tenantId?: string; } export interface FusionAuthIdpLinkedInApplicationConfiguration { /** * ID of the FusionAuth Application to apply this configuration to. */ applicationId?: string; /** * This is an optional Application specific override for the top level `buttonText`. */ buttonText?: string; /** * This is an optional Application specific override for the top level `clientId`. */ clientId?: string; /** * This is an optional Application specific override for the top level `clientSecret`. */ clientSecret?: string; /** * Determines if a `UserRegistration` is created for the User automatically or not. If a user doesn’t exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. */ createRegistration?: boolean; /** * Determines if this identity provider is enabled for the Application specified by the `applicationId` property. */ enabled?: boolean; /** * This is an optional Application specific override for the top level `scope`. */ scope?: string; } export interface FusionAuthIdpLinkedInTenantConfiguration { /** * When enabled, the number of identity provider links a user may create is enforced by maximumLinks */ limitUserLinkCountEnabled?: boolean; /** * Determines if this provider is enabled. If it is false then it will be disabled globally. */ limitUserLinkCountMaximumLinks?: number; /** * The unique Id of the tenant that this configuration applies to. */ tenantId?: string; } export interface FusionAuthIdpOpenIdConnectApplicationConfiguration { /** * ID of the Application to apply this configuration to. */ applicationId?: string; /** * This is an optional Application specific override for the top level button image URL. */ buttonImageUrl?: string; /** * This is an optional Application specific override for the top level button text. */ buttonText?: string; /** * Determines if a UserRegistration is created for the User automatically or not. If a user doesn’t exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. */ createRegistration?: boolean; /** * Determines if this identity provider is enabled for the Application specified by the applicationId key. */ enabled?: boolean; /** * This is an optional Application specific override for the top level client id. */ oauth2ClientId?: string; /** * This is an optional Application specific override for the top level client secret. */ oauth2ClientSecret?: string; /** * This is an optional Application specific override for the top level scope. */ oauth2Scope?: string; } export interface FusionAuthIdpOpenIdConnectTenantConfiguration { /** * When enabled, the number of identity provider links a user may create is enforced by maximumLinks */ limitUserLinkCountEnabled?: boolean; /** * Determines if this provider is enabled. If it is false then it will be disabled globally. */ limitUserLinkCountMaximumLinks?: number; /** * The unique Id of the tenant that this configuration applies to. */ tenantId?: string; } export interface FusionAuthIdpPsnApplicationConfiguration { /** * ID of the Application to apply this configuration to. */ applicationId?: string; /** * This is an optional Application specific override for the top level button text. */ buttonText?: string; /** * This is an optional Application specific override for the top level client_id. */ clientId?: string; /** * This is an optional Application specific override for the top level client_secret. */ clientSecret?: string; /** * Determines if a UserRegistration is created for the User automatically or not. If a user doesn’t exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. */ createRegistration?: boolean; /** * Determines if this identity provider is enabled for the Application specified by the applicationId key. */ enabled?: boolean; /** * This is an optional Application specific override for the top level scope. */ scope?: string; } export interface FusionAuthIdpPsnTenantConfiguration { /** * When enabled, the number of identity provider links a user may create is enforced by maximumLinks */ limitUserLinkCountEnabled?: boolean; /** * Determines if this provider is enabled. If it is false then it will be disabled globally. */ limitUserLinkCountMaximumLinks?: number; /** * The unique Id of the tenant that this configuration applies to. */ tenantId?: string; } export interface FusionAuthIdpSamlV2IdpInitiatedApplicationConfiguration { applicationId?: string; /** * Determines if a UserRegistration is created for the User automatically or not. If a user doesn’t exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. */ createRegistration?: boolean; /** * Determines if this identity provider is enabled for the Application specified by the applicationId key. */ enabled?: boolean; } export interface FusionAuthIdpSamlV2IdpInitiatedAssertionConfiguration { /** * The decryption configuration for the SAML v2 identity provider. */ decryption?: outputs.FusionAuthIdpSamlV2IdpInitiatedAssertionConfigurationDecryption; } export interface FusionAuthIdpSamlV2IdpInitiatedAssertionConfigurationDecryption { /** * Determines if FusionAuth requires encrypted assertions in SAML responses from the identity provider. When true, SAML responses from the identity provider containing unencrypted assertions will be rejected by FusionAuth. */ enabled?: boolean; /** * The Id of the key stored in Key Master that is used to decrypt the symmetric key on the SAML response sent to FusionAuth from the identity provider. The selected Key must contain an RSA private key. Required when `'enabled` is true. */ keyTransportDecryptionKeyId: string; } export interface FusionAuthIdpSamlV2IdpInitiatedTenantConfiguration { /** * When enabled, the number of identity provider links a user may create is enforced by maximumLinks */ limitUserLinkCountEnabled?: boolean; /** * Determines if this provider is enabled. If it is false then it will be disabled globally. */ limitUserLinkCountMaximumLinks?: number; tenantId?: string; } export interface FusionAuthIdpSamlv2ApplicationConfiguration { /** * ID of the Application to apply this configuration to. */ applicationId?: string; /** * This is an optional Application specific override for the top level button image URL. */ buttonImageUrl?: string; /** * This is an optional Application specific override for the top level button text. */ buttonText?: string; /** * Determines if a UserRegistration is created for the User automatically or not. If a user doesn’t exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. */ createRegistration?: boolean; /** * Determines if this identity provider is enabled for the Application specified by the applicationId key. */ enabled?: boolean; } export interface FusionAuthIdpSamlv2AssertionConfiguration { /** * The configuration for the SAML assertion decryption. */ decryption?: outputs.FusionAuthIdpSamlv2AssertionConfigurationDecryption; /** * The array of URLs that FusionAuth will accept as SAML login destinations if the `policy` setting is AllowAlternates. */ destination?: outputs.FusionAuthIdpSamlv2AssertionConfigurationDestination; } export interface FusionAuthIdpSamlv2AssertionConfigurationDecryption { /** * Determines if FusionAuth requires encrypted assertions in SAML responses from the identity provider. When true, SAML responses from the identity provider containing unencrypted assertions will be rejected by FusionAuth. */ enabled?: boolean; /** * The Id of the key stored in Key Master that is used to decrypt the symmetric key on the SAML response sent to FusionAuth from the identity provider. The selected Key must contain an RSA private key. Required when `enabled` is true. */ keyTransportDecryptionKeyId: string; } export interface FusionAuthIdpSamlv2AssertionConfigurationDestination { /** * The alternate destinations of the assertion. */ alternates?: string[]; /** * The policy to use when performing a destination assertion on the SAML login request. The possible values are `Enabled`, `Disabled`, and `AllowAlternates`. */ policy?: string; } export interface FusionAuthIdpSamlv2IdpInitiatedConfiguration { /** * Determines if FusionAuth will accept IdP initiated login requests from this SAMLv2 Identity Provider. */ enabled?: boolean; /** * The EntityId (unique identifier) of the SAML v2 identity provider. This value should be provided to you. Required when `enabled` is true. */ issuer?: string; } export interface FusionAuthIdpSamlv2LoginHintConfiguration { /** * When enabled and HTTP-Redirect bindings are used, FusionAuth will provide the username or email address when available to the IdP as a login hint using the configured parameter name set by the `parameterName` to initiate the AuthN request. */ enabled?: boolean; /** * The name of the parameter used to pass the username or email as login hint to the IDP when enabled, and HTTP redirect bindings are used to initiate the AuthN request. The default value is `loginHint`. Required when `enabled` is true. */ parameterName?: string; } export interface FusionAuthIdpSamlv2TenantConfiguration { /** * When enabled, the number of identity provider links a user may create is enforced by maximumLinks */ limitUserLinkCountEnabled?: boolean; /** * Determines if this provider is enabled. If it is false then it will be disabled globally. */ limitUserLinkCountMaximumLinks?: number; /** * The unique Id of the tenant that this configuration applies to. */ tenantId?: string; } export interface FusionAuthIdpSteamApplicationConfiguration { /** * This is an optional Application specific override for the top level apiMode. */ apiMode?: string; /** * ID of the Application to apply this configuration to. */ applicationId?: string; /** * This is an optional Application specific override for the top level button text. */ buttonText?: string; /** * This is an optional Application specific override for the top level client_id. */ clientId?: string; /** * Determines if a UserRegistration is created for the User automatically or not. If a user doesn’t exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. */ createRegistration?: boolean; /** * Determines if this identity provider is enabled for the Application specified by the applicationId key. */ enabled?: boolean; /** * This is an optional Application specific override for the top level scope. */ scope?: string; /** * This is an optional Application specific override for the top level webAPIKey. */ webApiKey?: string; } export interface FusionAuthIdpSteamTenantConfiguration { /** * When enabled, the number of identity provider links a user may create is enforced by maximumLinks */ limitUserLinkCountEnabled?: boolean; /** * Determines if this provider is enabled. If it is false then it will be disabled globally. */ limitUserLinkCountMaximumLinks?: number; /** * The unique Id of the tenant that this configuration applies to. */ tenantId?: string; } export interface FusionAuthIdpTwitchApplicationConfiguration { /** * ID of the Application to apply this configuration to. */ applicationId?: string; /** * This is an optional Application specific override for the top level button text. */ buttonText?: string; /** * This is an optional Application specific override for the top level client_id. */ clientId?: string; /** * This is an optional Application specific override for the top level client_secret. */ clientSecret?: string; /** * Determines if a UserRegistration is created for the User automatically or not. If a user doesn’t exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. */ createRegistration?: boolean; /** * Determines if this identity provider is enabled for the Application specified by the applicationId key. */ enabled?: boolean; /** * This is an optional Application specific override for the top level scope. */ scope?: string; } export interface FusionAuthIdpTwitchTenantConfiguration { /** * When enabled, the number of identity provider links a user may create is enforced by maximumLinks */ limitUserLinkCountEnabled?: boolean; /** * Determines if this provider is enabled. If it is false then it will be disabled globally. */ limitUserLinkCountMaximumLinks?: number; /** * The unique Id of the tenant that this configuration applies to. */ tenantId?: string; } export interface FusionAuthIdpXBoxApplicationConfiguration { /** * ID of the Application to apply this configuration to. */ applicationId?: string; /** * This is an optional Application specific override for the top level button text. */ buttonText?: string; /** * This is an optional Application specific override for the top level client_id. */ clientId?: string; /** * This is an optional Application specific override for the top level client_secret. */ clientSecret?: string; /** * Determines if a UserRegistration is created for the User automatically or not. If a user doesn’t exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. */ createRegistration?: boolean; /** * Determines if this identity provider is enabled for the Application specified by the applicationId key. */ enabled?: boolean; /** * This is an optional Application specific override for the top level scope. */ scope?: string; } export interface FusionAuthIdpXBoxTenantConfiguration { /** * When enabled, the number of identity provider links a user may create is enforced by maximumLinks */ limitUserLinkCountEnabled?: boolean; /** * Determines if this provider is enabled. If it is false then it will be disabled globally. */ limitUserLinkCountMaximumLinks?: number; /** * The unique Id of the tenant that this configuration applies to. */ tenantId?: string; } export interface FusionAuthSystemConfigurationAuditLogConfiguration { delete?: outputs.FusionAuthSystemConfigurationAuditLogConfigurationDelete; } export interface FusionAuthSystemConfigurationAuditLogConfigurationDelete { /** * Whether or not FusionAuth should delete the Audit Log based upon this configuration. When true the auditLogConfiguration.delete.numberOfDaysToRetain will be used to identify audit logs that are eligible for deletion. When this value is set to false audit logs will be preserved forever. */ enabled?: boolean; /** * The number of days to retain the Audit Log. */ numberOfDaysToRetain?: number; } export interface FusionAuthSystemConfigurationCorsConfiguration { /** * The Access-Control-Allow-Credentials response header values as described by MDN Access-Control-Allow-Credentials. */ allowCredentials?: boolean; /** * The Access-Control-Allow-Headers response header values as described by MDN Access-Control-Allow-Headers. */ allowedHeaders: string[]; /** * The Access-Control-Allow-Methods response header values as described by MDN Access-Control-Allow-Methods. */ allowedMethods: string[]; /** * The Access-Control-Allow-Origin response header values as described by MDN Access-Control-Allow-Origin. If the wildcard * is specified, no additional domains may be specified. */ allowedOrigins?: string[]; /** * Whether or not FusionAuth will log debug messages to the event log. This is primarily useful for identifying why the FusionAuth CORS filter is rejecting a request and returning an HTTP response status code of 403. */ debug?: boolean; /** * Whether the FusionAuth CORS filter will process requests made to FusionAuth. */ enabled?: boolean; /** * The Access-Control-Expose-Headers response header values as described by MDN Access-Control-Expose-Headers. */ exposedHeaders: string[]; /** * The Access-Control-Max-Age response header values as described by MDN Access-Control-Max-Age. */ preflightMaxAgeInSeconds?: number; } export interface FusionAuthSystemConfigurationEventLogConfiguration { /** * The number of events to retain. Once the the number of event logs exceeds this configured value they will be deleted starting with the oldest event logs. */ numberToRetain?: number; } export interface FusionAuthSystemConfigurationLoginRecordConfiguration { delete?: outputs.FusionAuthSystemConfigurationLoginRecordConfigurationDelete; } export interface FusionAuthSystemConfigurationLoginRecordConfigurationDelete { /** * Whether or not FusionAuth should delete the login records based upon this configuration. When true the loginRecordConfiguration.delete.numberOfDaysToRetain will be used to identify login records that are eligible for deletion. When this value is set to false login records will be preserved forever. */ enabled?: boolean; /** * The number of days to retain login records. */ numberOfDaysToRetain?: number; } export interface FusionAuthSystemConfigurationTrustedProxyConfiguration { /** * This setting is used to resolve the client IP address for use in logging, webhooks, and IP-based access control when an X-Forwarded-For header is provided. Because proxies are free to rewrite the X-Forwarded-For header, an untrusted proxy could write a value that allowed it to bypass IP-based ACLs, or cause an incorrect IP address to be logged or sent to a webhook. Valid values are `All` and `OnlyConfigured`. */ trustPolicy?: string; /** * An array of IP addresses, representing the set of trusted upstream proxies. This value will be accepted but ignored when `trustPolicy` is set to `All`. Values may be specified as IPv4, or IPv6 format, and ranges of addresses are also accepted in CIDR notation. */ trusteds?: string[]; } export interface FusionAuthSystemConfigurationUiConfiguration { /** * A hexadecimal color to override the default menu color in the user interface. */ headerColor?: string; /** * A URL of a logo to override the default FusionAuth logo in the user interface. */ logoUrl?: string; /** * A hexadecimal color to override the default menu font color in the user interface. */ menuFontColor?: string; } export interface FusionAuthSystemConfigurationUsageDataConfiguration { /** * Whether or not FusionAuth collects and sends usage data to improve the product. */ enabled?: boolean; } export interface FusionAuthSystemConfigurationWebhookEventLogConfiguration { delete?: outputs.FusionAuthSystemConfigurationWebhookEventLogConfigurationDelete; } export interface FusionAuthSystemConfigurationWebhookEventLogConfigurationDelete { /** * Whether or not FusionAuth should delete the webhook event logs based upon this configuration. When true the webhookEventLogConfiguration.delete.numberOfDaysToRetain will be used to identify webhook event logs that are eligible for deletion. When this value is set to false webhook event logs will be preserved forever. */ enabled?: boolean; /** * The number of days to retain webhook event logs. */ numberOfDaysToRetain?: number; } export interface FusionAuthTenantAccessControlConfiguration { /** * The Id of the IP Access Control List limiting access to all applications in this tenant. */ uiIpAccessControlListId?: string; } export interface FusionAuthTenantCaptchaConfiguration { /** * The type of captcha method to use. This field is required when tenant.captchaConfiguration.enabled is set to true. */ captchaMethod?: string; /** * Whether captcha configuration is enabled. */ enabled?: boolean; /** * The secret key for this captcha method. This field is required when tenant.captchaConfiguration.enabled is set to true. */ secretKey?: string; /** * The site key for this captcha method. This field is required when tenant.captchaConfiguration.enabled is set to true. */ siteKey?: string; /** * The numeric threshold which separates a passing score from a failing one. This value only applies if using either the Google v3 or HCaptcha Enterprise method, otherwise this value is ignored. */ threshold?: number; } export interface FusionAuthTenantConnectorPolicy { /** * The identifier of the Connector to which this policy refers. */ connectorId?: string; /** * A list of email domains to which this connector should apply. A value of ["*"] indicates this connector applies to all users. */ domains?: string[]; /** * If true, the user’s data will be migrated to FusionAuth at first successful authentication; subsequent authentications will occur against the FusionAuth datastore. If false, the Connector’s source will be treated as authoritative. */ migrate?: boolean; } export interface FusionAuthTenantEmailConfiguration { /** * The additional SMTP headers to be added to each outgoing email. Each SMTP header consists of a name and a value. */ additionalHeaders?: { [key: string]: string; }; /** * Determines if debug should be enabled to create an event log to assist in debugging SMTP errors. */ debug?: boolean; /** * The default email address that emails will be sent from when a from address is not provided on an individual email template. This is the address part email address (i.e. Jared Dunn ). */ defaultFromEmail: string; /** * The default From Name used in sending emails when a from name is not provided on an individual email template. This is the display name part of the email address ( i.e. Jared Dunn ). */ defaultFromName?: string; /** * The Id of the Email Template that is used when a user is sent a forgot password email. */ emailUpdateEmailTemplateId?: string; /** * The Id of the Email Template used to verify user emails. */ emailVerifiedEmailTemplateId?: string; /** * The Id of the Email Template that is used when a user is sent a forgot password email. */ forgotPasswordEmailTemplateId?: string; /** * The host name of the SMTP server that FusionAuth will use. */ host?: string; /** * When set to true, this allows email to be verified as a result of completing a similar email based workflow such as change password. When seto false, the user must explicitly complete the email verification workflow even if the user has already completed a similar email workflow such as change password. */ implicitEmailVerificationAllowed?: boolean; /** * The Id of the Email Template used to send emails to users when another user attempts to create an account with their login Id. */ loginIdInUseOnCreateEmailTemplateId?: string; /** * The Id of the Email Template used to send emails to users when another user attempts to create an account with their login Id. */ loginIdInUseOnUpdateEmailTemplateId?: string; /** * The Id of the Email Template used to send emails to users when they log in on a new device. */ loginNewDeviceEmailTemplateId?: string; /** * The Id of the Email Template used to send emails to users when a suspicious login occurs. */ loginSuspiciousEmailTemplateId?: string; /** * An optional password FusionAuth will use to authenticate with the SMTP server. */ password?: string; /** * The Id of the Email Template used to send emails to users when they have completed a 'forgot password' workflow and their password habeen reset. */ passwordResetSuccessEmailTemplateId?: string; /** * The Id of the Email Template used to send emails to users when they have completed a 'forgot password' workflow and their password has been rese */ passwordUpdateEmailTemplateId?: string; /** * The Id of the Passwordless Email Template. */ passwordlessEmailTemplateId?: string; /** * The port of the SMTP server that FusionAuth will use. */ port?: number; /** * Additional Email Configuration in a properties file formatted String. */ properties?: string; /** * The type of security protocol FusionAuth will use when connecting to the SMTP server. */ security?: string; /** * The Id of the Email Template that is used when a user had their account created for them and they must set their password manually and they are sent an email to set their password. */ setPasswordEmailTemplateId?: string; /** * The Id of the Email Template used to send emails to users when a MFA method has been added to their account. */ twoFactorMethodAddEmailTemplateId?: string; /** * The Id of the Email Template used to send emails to users when a MFA method has been removed from their account. */ twoFactorMethodRemoveEmailTemplateId?: string; unverified: outputs.FusionAuthTenantEmailConfigurationUnverified; /** * An optional username FusionAuth will to authenticate with the SMTP server. */ username?: string; /** * The Id of the Email Template that is used to send the verification emails to users. These emails are used to verify that a user’s email address ivalid. If either the verifyEmail or verifyEmailWhenChanged fields are true this field is required. */ verificationEmailTemplateId?: string; /** * The process by which the user will verify their email address. Possible values are `ClickableLink` or `FormField`. */ verificationStrategy?: string; /** * Whether the user’s email addresses are verified when the registers with your application. */ verifyEmail?: boolean; /** * Whether the user’s email addresses are verified when the user changes them. */ verifyEmailWhenChanged?: boolean; } export interface FusionAuthTenantEmailConfigurationUnverified { /** * When this value is set to true, the user is allowed to change their email address when they are gated because they haven’t verified their email address. */ allowEmailChangeWhenGated?: boolean; /** * = (Optional) The behavior when detecting breaches at time of user login. */ behavior?: string; } export interface FusionAuthTenantEventConfiguration { /** * Whether or not FusionAuth should send these types of events to any configured Webhooks. */ enabled?: boolean; /** * The event type */ event?: string; /** * The transaction type that FusionAuth uses when sending these types of events to any configured Webhooks. */ transactionType?: string; } export interface FusionAuthTenantExternalIdentifierConfiguration { /** * The time in seconds until a OAuth authorization code in no longer valid to be exchanged for an access token. This is essentially the time allowed between the start of an Authorization request during the Authorization code grant and when you request an access token using this authorization code on the Token endpoint. Defaults to 30. */ authorizationGrantIdTimeToLiveInSeconds?: number; changePasswordIdGenerator?: outputs.FusionAuthTenantExternalIdentifierConfigurationChangePasswordIdGenerator; /** * The time in seconds until a change password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0. Defaults to 600. */ changePasswordIdTimeToLiveInSeconds?: number; /** * The time in seconds until a device code Id is no longer valid and cannot be used by the Token API. Value must be greater than 0. Defaults to 300. */ deviceCodeTimeToLiveInSeconds?: number; deviceUserCodeIdGenerator?: outputs.FusionAuthTenantExternalIdentifierConfigurationDeviceUserCodeIdGenerator; emailVerificationIdGenerator?: outputs.FusionAuthTenantExternalIdentifierConfigurationEmailVerificationIdGenerator; /** * The time in seconds until a email verification Id is no longer valid and cannot be used by the Verify Email API. Value must be greater than 0. */ emailVerificationIdTimeToLiveInSeconds: number; emailVerificationOneTimeCodeGenerator?: outputs.FusionAuthTenantExternalIdentifierConfigurationEmailVerificationOneTimeCodeGenerator; /** * The time in seconds until an external authentication Id is no longer valid and cannot be used by the Token API. Value must be greater than 0. Defaults to 300. */ externalAuthenticationIdTimeToLiveInSeconds?: number; /** * The time in seconds until a Login Timeout identifier is no longer valid to complete post-authentication steps in the OAuth workflow. Must be greater than 0. Defaults to 1800. */ loginIntentTimeToLiveInSeconds?: number; /** * The time in seconds until a One Time Password is no longer valid and cannot be used by the Login API. Value must be greater than 0. Defaults to 60. */ oneTimePasswordTimeToLiveInSeconds?: number; passwordlessLoginGenerator?: outputs.FusionAuthTenantExternalIdentifierConfigurationPasswordlessLoginGenerator; /** * The time in seconds until a passwordless code is no longer valid and cannot be used by the Passwordless API. Value must be greater than 0. Defaults to 180. */ passwordlessLoginTimeToLiveInSeconds?: number; /** * The number of seconds before the pending account link identifier is no longer valid to complete an account link request. Value must be greater than 0. Defaults to 3600 */ pendingAccountLinkTimeToLiveInSeconds?: number; registrationVerificationIdGenerator?: outputs.FusionAuthTenantExternalIdentifierConfigurationRegistrationVerificationIdGenerator; /** * The time in seconds until a registration verification Id is no longer valid and cannot be used by the Verify Registration API. Value must be greater than 0. */ registrationVerificationIdTimeToLiveInSeconds: number; registrationVerificationOneTimeCodeGenerator?: outputs.FusionAuthTenantExternalIdentifierConfigurationRegistrationVerificationOneTimeCodeGenerator; /** * The time in seconds until remembered OAuth scope consent choices are no longer valid, and the User will be prompted to consent to requested OAuth scopes even if they have not changed. Applies only when `application.oauthConfiguration.consentMode` is set to RememberDecision. Value must be greater than 0. Note: An Essentials or Enterprise plan is required to utilize advanced OAuth scopes. Defaults to 2592000. */ rememberOauthScopeConsentChoiceTimeToLiveInSeconds?: number; /** * The time in seconds that a SAML AuthN request will be eligible for use to authenticate with FusionAuth. Defaults to 300. */ samlV2AuthnRequestIdTtlSeconds?: number; setupPasswordIdGenerator?: outputs.FusionAuthTenantExternalIdentifierConfigurationSetupPasswordIdGenerator; /** * The time in seconds until a setup password Id is no longer valid and cannot be used by the Change Password API. Value must be greater than 0. */ setupPasswordIdTimeToLiveInSeconds: number; /** * The number of seconds before the Trust Token is no longer valid to complete a request that requires trust. Value must be greater than 0. Defaults to 180 */ trustTokenTimeToLiveInSeconds?: number; /** * The time in seconds until a two factor Id is no longer valid and cannot be used by the Two Factor Login API. Value must be greater than 0. Defaults to 300. */ twoFactorIdTimeToLiveInSeconds?: number; twoFactorOneTimeCodeIdGenerator?: outputs.FusionAuthTenantExternalIdentifierConfigurationTwoFactorOneTimeCodeIdGenerator; /** * The number of seconds before the Two-Factor One Time Code used to enable or disable a two-factor method is no longer valid. Must be greater than 0. Defaults to 60. */ twoFactorOneTimeCodeIdTimeToLiveInSeconds?: number; /** * The time in seconds until an issued Two Factor trust Id is no longer valid and the User will be Optional to complete Two Factor authentication during the next authentication attempt. Value must be greater than 0. */ twoFactorTrustIdTimeToLiveInSeconds: number; /** * The time in seconds until a WebAuthn authentication challenge is no longer valid and the User will be required to restart the WebAuthn authentication ceremony by creating a new challenge. This value also controls the timeout for the client-side WebAuthn navigator.credentials.get API call. Value must be greater than 0. Note: A license is required to utilize WebAuthn. Defaults to 180. */ webauthnAuthenticationChallengeTimeToLiveInSeconds?: number; /** * The time in seconds until a WebAuthn registration challenge is no longer valid and the User will be required to restart the WebAuthn registration ceremony by creating a new challenge. This value also controls the timeout for the client-side WebAuthn navigator.credentials.create API call. Value must be greater than 0. Note: A license is required to utilize WebAuthn. Defaults to 180. */ webauthnRegistrationChallengeTimeToLiveInSeconds?: number; } export interface FusionAuthTenantExternalIdentifierConfigurationChangePasswordIdGenerator { /** * The length of the secure generator used for generating the change password Id. Defaults to 32. */ length?: number; /** * The type of the secure generator used for generating the change password Id. Defaults to randomBytes. */ type?: string; } export interface FusionAuthTenantExternalIdentifierConfigurationDeviceUserCodeIdGenerator { /** * The length of the secure generator used for generating the change password Id. Defaults to 6. */ length?: number; /** * The type of the secure generator used for generating the change password Id. Defaults to randomAlphaNumeric. */ type?: string; } export interface FusionAuthTenantExternalIdentifierConfigurationEmailVerificationIdGenerator { /** * The length of the secure generator used for generating the change password Id. Defaults to 32. */ length?: number; /** * The type of the secure generator used for generating the change password Id. Defaults to randomBytes. */ type?: string; } export interface FusionAuthTenantExternalIdentifierConfigurationEmailVerificationOneTimeCodeGenerator { /** * The length of the secure generator used for generating the email verification one time code. Defaults to 6. */ length?: number; /** * The type of the secure generator used for generating the email verification one time code. Defaults to randomAlphaNumeric. */ type?: string; } export interface FusionAuthTenantExternalIdentifierConfigurationPasswordlessLoginGenerator { /** * The length of the secure generator used for generating the change password Id. Defaults to 32 */ length?: number; /** * The type of the secure generator used for generating the change password Id. Defaults to randomBytes. */ type?: string; } export interface FusionAuthTenantExternalIdentifierConfigurationRegistrationVerificationIdGenerator { /** * The length of the secure generator used for generating the change password Id. Defaults to 32 */ length?: number; /** * The type of the secure generator used for generating the change password Id. Defaults to randomBytes. */ type?: string; } export interface FusionAuthTenantExternalIdentifierConfigurationRegistrationVerificationOneTimeCodeGenerator { /** * The length of the secure generator used for generating the registration verification one time code. Defaults to 6. */ length?: number; /** * The type of the secure generator used for generating the registration verification one time code. Defaults to randomAlphaNumeric. */ type?: string; } export interface FusionAuthTenantExternalIdentifierConfigurationSetupPasswordIdGenerator { /** * The length of the secure generator used for generating the change password Id. Defaults to 32. */ length?: number; /** * The type of the secure generator used for generating the change password Id. Defaults to randomBytes. */ type?: string; } export interface FusionAuthTenantExternalIdentifierConfigurationTwoFactorOneTimeCodeIdGenerator { /** * The length of the secure generator used for generating the the two factor code Id. Defaults to 6 */ length?: number; /** * The type of the secure generator used for generating the two factor one time code Id. Defaults to randomDigits. */ type?: string; } export interface FusionAuthTenantFailedAuthenticationConfiguration { /** * Indicates whether you want the user to be able to self-service unlock their account prior to the action duration by completing a password reset workflow. */ actionCancelPolicyOnPasswordReset?: boolean; /** * The duration of the User Action. This value along with the actionDurationUnit will be used to set the duration of the User Action. Value must be greater than 0. */ actionDuration?: number; /** * The unit of time associated with a duration. */ actionDurationUnit?: string; /** * Indicates you would like to email the user when the user’s account is locked due to this action being taken. This requires the User Action specified by the tenant.failedAuthenticationConfiguration.userActionId to also be configured for email. If the User Action is not configured to be able to email the user, this configuration will be ignored. */ emailUser?: boolean; /** * The length of time in seconds before the failed authentication count will be reset. Value must be greater than 0. */ resetCountInSeconds?: number; /** * The number of failed attempts considered to be too many. Once this threshold is reached the specified User Action will be applied to the user for the duration specified. Value must be greater than 0. */ tooManyAttempts?: number; /** * The Id of the User Action that is applied when the threshold is reached for too many failed authentication attempts. */ userActionId?: string; } export interface FusionAuthTenantFamilyConfiguration { /** * Whether to allow child registrations. */ allowChildRegistrations?: boolean; /** * The unique Id of the email template to use when confirming a child. */ confirmChildEmailTemplateId?: string; /** * Indicates that child users without parental verification will be permanently deleted after tenant.familyConfiguration.deleteOrphanedAccountsDays days. */ deleteOrphanedAccounts?: boolean; /** * The number of days from creation child users will be retained before being deleted for not completing parental verification. Value must be greater than 0. */ deleteOrphanedAccountsDays?: number; /** * Whether family configuration is enabled. */ enabled?: boolean; /** * The unique Id of the email template to use when a family request is made. */ familyRequestEmailTemplateId?: string; /** * The maximum age of a child. Value must be greater than 0. */ maximumChildAge?: number; /** * The minimum age to be an owner. Value must be greater than 0. */ minimumOwnerAge?: number; /** * Whether a parent email is required. */ parentEmailRequired?: boolean; /** * The unique Id of the email template to use for parent registration. */ parentRegistrationEmailTemplateId?: string; } export interface FusionAuthTenantFormConfiguration { /** * The unique Id of the form to use for the Add and Edit User form when used in the FusionAuth admin UI. */ adminUserFormId: string; } export interface FusionAuthTenantJwtConfiguration { /** * The unique id of the signing key used to sign the access token. Required prior to `1.30.0`. */ accessTokenKeyId: string; /** * The unique id of the signing key used to sign the Id token. Required prior to `1.30.0`. */ idTokenKeyId: string; /** * The refresh token expiration policy. */ refreshTokenExpirationPolicy?: string; /** * The length of time specified in seconds that a one-time use token can be reused. This value must be greater than 0 and less than 86400 which is equal to 24 hours. Setting this value to 0 effectively disables the grace period which means a one-time token may not be reused. For security reasons, you should keep this value as small as possible, and only increase past 0 to improve reliability for an asynchronous or clustered integration that may require a brief grace period. Defaults to 0. */ refreshTokenOneTimeUseConfigurationGracePeriodInSeconds?: number; /** * When enabled, the refresh token will be revoked when a user action, such as locking an account based on a number of failed login attempts, prevents user login. */ refreshTokenRevocationPolicyOnLoginPrevented?: boolean; /** * When enabled, all refresh tokens will be revoked when a user enables multi-factor authentication for the first time. This policy will not be applied when adding subsequent multi-factor methods to the user. */ refreshTokenRevocationPolicyOnMultiFactorEnable?: boolean; /** * When enabled, if a one-time use refresh token is reused, the token will be revoked. This does not cause all refresh tokens to be revoked, only the reused token is revoked. */ refreshTokenRevocationPolicyOnOneTimeTokenReuse?: boolean; /** * When enabled, the refresh token will be revoked when a user changes their password." */ refreshTokenRevocationPolicyOnPasswordChange?: boolean; /** * The maximum lifetime of a refresh token when using a refresh token expiration policy of SlidingWindowWithMaximumLifetime. Value must be greater than 0. */ refreshTokenSlidingWindowMaximumTimeToLiveInMinutes?: number; /** * The length of time in minutes a Refresh Token is valid from the time it was issued. Value must be greater than 0. */ refreshTokenTimeToLiveInMinutes?: number; /** * The refresh token usage policy. */ refreshTokenUsagePolicy?: string; /** * The length of time in seconds this JWT is valid from the time it was issued. Value must be greater than 0. */ timeToLiveInSeconds?: number; } export interface FusionAuthTenantLambdaConfiguration { /** * The Id of the lambda that will be invoked at the end of a successful login request in order to extend custom validation of a login request. */ loginValidationId: string; /** * The Id of a SCIM User Request lambda that will be used to convert the SCIM Enterprise User request to a FusionAuth User. Note: An Enterprise plan is required to utilize SCIM. Required when `scim_server_configuration.enabled` is true. */ scimEnterpriseUserRequestConverterId: string; /** * The Id of a SCIM User Response lambda that will be used to convert a FusionAuth Enterprise User to a SCIM Server response. Note: An Enterprise plan is required to utilize SCIM. Required when `scim_server_configuration.enabled` is true. */ scimEnterpriseUserResponseConverterId: string; /** * The Id of a SCIM Group Request lambda that will be used to convert the SCIM Group request to a FusionAuth Group. Note: An Enterprise plan is required to utilize SCIM. Required when `scim_server_configuration.enabled` is true. */ scimGroupRequestConverterId: string; /** * The Id of a SCIM Group Response lambda that will be used to convert a FusionAuth Group to a SCIM Server response. Note: An Enterprise plan is required to utilize SCIM. Required when `scim_server_configuration.enabled` is true. */ scimGroupResponseConverterId: string; /** * The Id of a SCIM User Request lambda that will be used to convert the SCIM User request to a FusionAuth User. Note: An Enterprise plan is required to utilize SCIM. Required when `scim_server_configuration.enabled` is true. */ scimUserRequestConverterId: string; /** * The Id of a SCIM User Response lambda that will be used to convert a FusionAuth User to a SCIM Server response. Note: An Enterprise plan is required to utilize SCIM. Required when `scim_server_configuration.enabled` is true. */ scimUserResponseConverterId: string; } export interface FusionAuthTenantLoginConfiguration { /** * Indicates whether to require an API key for the Login API when an `applicationId` is not provided. When an `applicationId` is provided to the Login API call, the application configuration will take precedence. In almost all cases, you will want to this to be `true`. */ requireAuthentication: boolean; } export interface FusionAuthTenantMaximumPasswordAge { /** * The password maximum age in days. The number of days after which FusionAuth will require a user to change their password. Required when systemConfiguration.maximumPasswordAge.enabled is set to true. */ days?: number; /** * Indicates that the maximum password age is enabled and being enforced. */ enabled?: boolean; } export interface FusionAuthTenantMinimumPasswordAge { /** * Indicates that the minimum password age is enabled and being enforced. */ enabled?: boolean; /** * The password minimum age in seconds. When enabled FusionAuth will not allow a password to be changed until it reaches this minimum age. Required when systemConfiguration.minimumPasswordAge.enabled is set to true. */ seconds?: number; } export interface FusionAuthTenantMultiFactorConfiguration { authenticator?: outputs.FusionAuthTenantMultiFactorConfigurationAuthenticator; email: outputs.FusionAuthTenantMultiFactorConfigurationEmail; /** * When set to `Enabled` and a user has one or more two-factor methods configured, the user will be required to complete a two-factor challenge during login. When set to `Disabled`, even when a user has configured one or more two-factor methods, the user will not be required to complete a two-factor challenge during login. When the login policy is to `Required`, a two-factor challenge will be required during login. If a user does not have configured two-factor methods, they will not be able to log in. */ loginPolicy?: string; sms: outputs.FusionAuthTenantMultiFactorConfigurationSms; } export interface FusionAuthTenantMultiFactorConfigurationAuthenticator { /** * When enabled, users may utilize an authenticator application to complete a multi-factor authentication request. This method uses TOTP (Time-Based One-Time Password) as defined in RFC 6238 and often uses an native mobile app such as Google Authenticator. */ enabled: boolean; } export interface FusionAuthTenantMultiFactorConfigurationEmail { /** * When enabled, users may utilize an email address to complete a multi-factor authentication request. */ enabled?: boolean; /** * The Id of the email template that is used when notifying a user to complete a multi-factor authentication request. */ templateId?: string; } export interface FusionAuthTenantMultiFactorConfigurationSms { /** * When enabled, users may utilize a mobile phone number to complete a multi-factor authentication request. */ enabled?: boolean; /** * The messenger that is used to deliver a SMS multi-factor authentication request. */ messengerId?: string; /** * The Id of the SMS template that is used when notifying a user to complete a multi-factor authentication request. */ templateId?: string; } export interface FusionAuthTenantOauthConfiguration { /** * The Id of a lambda that will be called to populate the JWT during a client credentials grant. **Note:** A paid edition of FusionAuth is required to utilize client credentials grant. */ clientCredentialsAccessTokenPopulateLambdaId?: string; } export interface FusionAuthTenantPasswordEncryptionConfiguration { /** * The default method for encrypting the User’s password. */ encryptionScheme?: string; /** * The factor used by the password encryption scheme. If not provided, the PasswordEncryptor provides a default value. Generally this will be used as an iteration count to generate the hash. The actual use of this value is up to the PasswordEncryptor implementation. */ encryptionSchemeFactor?: number; /** * When enabled a user’s hash configuration will be modified to match these configured settings. This can be useful to increase a password hash strength over time or upgrade imported users to a more secure encryption scheme after an initial import. */ modifyEncryptionSchemeOnLogin?: boolean; } export interface FusionAuthTenantPasswordValidationRules { breachDetection: outputs.FusionAuthTenantPasswordValidationRulesBreachDetection; /** * The maximum length of a password when a new user is created or a user requests a password change. This value must be greater than 0 and less than or equal to 256. When `passwordEncryptionConfiguration.encryptionScheme` is equal to `bcrypt`, the maximum will be limited to 50. */ maxLength?: number; /** * The minimum length of a password when a new user is created or a user requests a password change. */ minLength?: number; rememberPreviousPasswords?: outputs.FusionAuthTenantPasswordValidationRulesRememberPreviousPasswords; /** * Whether to force the user to use at least one non-alphanumeric character. */ requireNonAlpha?: boolean; /** * Whether to force the user to use at least one number. */ requireNumber?: boolean; /** * Whether to force the user to use at least one uppercase and one lowercase character. */ requiredMixedCase?: boolean; /** * When enabled the user’s password will be validated during login. If the password does not meet the currently configured validation rules the user will be required to change their password. */ validateOnLogin?: boolean; } export interface FusionAuthTenantPasswordValidationRulesBreachDetection { /** * Whether to enable Reactor breach detection. Requires an activated license. */ enabled?: boolean; /** * The level of severity where Reactor will consider a breach. */ matchMode?: string; /** * The Id of the email template to use when notifying user of breached password. Required if tenant.passwordValidationRules.breachDetection.onLogin is set to NotifyUser. */ notifyUserEmailTemplateId?: string; /** * The behavior when detecting breaches at time of user login */ onLogin?: string; } export interface FusionAuthTenantPasswordValidationRulesRememberPreviousPasswords { /** * The number of previous passwords to remember. Value must be greater than 0. */ count?: number; /** * Whether to prevent a user from using any of their previous passwords. */ enabled?: boolean; } export interface FusionAuthTenantRateLimitConfiguration { failedLogin: outputs.FusionAuthTenantRateLimitConfigurationFailedLogin; forgotPassword: outputs.FusionAuthTenantRateLimitConfigurationForgotPassword; sendEmailVerification: outputs.FusionAuthTenantRateLimitConfigurationSendEmailVerification; sendPasswordless: outputs.FusionAuthTenantRateLimitConfigurationSendPasswordless; sendRegistrationVerification: outputs.FusionAuthTenantRateLimitConfigurationSendRegistrationVerification; sendTwoFactor: outputs.FusionAuthTenantRateLimitConfigurationSendTwoFactor; } export interface FusionAuthTenantRateLimitConfigurationFailedLogin { /** * Whether rate limiting is enabled for failed login. */ enabled?: boolean; /** * The number of times a user can fail to login within the configured `timePeriodInSeconds` duration. If a Failed authentication action has been configured then it will take precedence. */ limit?: number; /** * The duration for the number of times a user can fail login before being rate limited. */ timePeriodInSeconds?: number; } export interface FusionAuthTenantRateLimitConfigurationForgotPassword { /** * Whether rate limiting is enabled for forgot password. */ enabled?: boolean; /** * The number of times a user can request a forgot password email within the configured `timePeriodInSeconds` duration. */ limit?: number; /** * The duration for the number of times a user can request a forgot password email before being rate limited. */ timePeriodInSeconds?: number; } export interface FusionAuthTenantRateLimitConfigurationSendEmailVerification { /** * Whether rate limiting is enabled for send email verification. */ enabled?: boolean; /** * The number of times a user can request a verification email within the configured `timePeriodInSeconds` duration. */ limit?: number; /** * The duration for the number of times a user can request a verification email before being rate limited. */ timePeriodInSeconds?: number; } export interface FusionAuthTenantRateLimitConfigurationSendPasswordless { /** * Whether rate limiting is enabled for send passwordless. */ enabled?: boolean; /** * The number of times a user can request a passwordless login email within the configured `timePeriodInSeconds` duration. */ limit?: number; /** * The duration for the number of times a user can request a passwordless login email before being rate limited. */ timePeriodInSeconds?: number; } export interface FusionAuthTenantRateLimitConfigurationSendRegistrationVerification { /** * Whether rate limiting is enabled for send registration verification. */ enabled?: boolean; /** * The number of times a user can request a registration verification email within the configured `timePeriodInSeconds` duration. */ limit?: number; /** * The duration for the number of times a user can request a registration verification email before being rate limited. */ timePeriodInSeconds?: number; } export interface FusionAuthTenantRateLimitConfigurationSendTwoFactor { /** * Whether rate limiting is enabled for send two factor. */ enabled?: boolean; /** * The number of times a user can request a two-factor code by email or SMS within the configured `timePeriodInSeconds` duration. */ limit?: number; /** * The duration for the number of times a user can request a two-factor code by email or SMS before being rate limited. */ timePeriodInSeconds?: number; } export interface FusionAuthTenantRegistrationConfiguration { /** * A list of unique domains that are not allowed to register when self service is enabled. */ blockedDomains?: string[]; } export interface FusionAuthTenantScimServerConfiguration { /** * The Entity Type that will be used to represent SCIM Clients for this tenant. Note: An Enterprise plan is required to utilize SCIM. Required when `scim_server_configuration.enabled` is true. */ clientEntityTypeId: string; /** * Whether or not this tenant has the SCIM endpoints enabled. Note: An Enterprise plan is required to utilize SCIM. */ enabled?: boolean; /** * SON formatted as a SCIM Schemas endpoint response. Because the SCIM lambdas may modify the JSON response, ensure the Schema's response matches that generated by the response lambdas. More about Schema definitions. When this parameter is not provided, it will default to EnterpriseUser, Group, and User schema definitions as defined by the SCIM core schemas spec. Note: An Enterprise plan is required to utilize SCIM. */ schemas: string; /** * The Entity Type that will be used to represent SCIM Servers for this tenant. Note: An Enterprise plan is required to utilize SCIM. Required when `scim_server_configuration.enabled` is true. */ serverEntityTypeId: string; } export interface FusionAuthTenantSsoConfiguration { /** * The number of seconds before a trusted device is reset. When reset, a user is forced to complete captcha during login and complete two factor authentication if applicable. */ deviceTrustTimeToLiveInSeconds?: number; } export interface FusionAuthTenantUserDeletePolicy { /** * Indicates that users without a verified email address will be permanently deleted after tenant.userDeletePolicy.unverified.numberOfDaysToRetain days. */ unverifiedEnabled?: boolean; /** * The number of days from creation users will be retained before being deleted for not completing email verification. This field is required when tenant.userDeletePolicy.unverified.enabled is set to true. Value must be greater than 0. */ unverifiedNumberOfDaysToRetain?: number; } export interface FusionAuthTenantUsernameConfiguration { /** * Indicates that users without a verified email address will be permanently deleted after tenant.userDeletePolicy.unverified.numberOfDaysToRetain days. */ unique?: outputs.FusionAuthTenantUsernameConfigurationUnique; } export interface FusionAuthTenantUsernameConfigurationUnique { /** * When true, FusionAuth will handle username collisions by generating a random suffix. */ enabled?: boolean; /** * The maximum number of digits to use when building a unique suffix for a username. A number will be randomly selected and will be 1 or more digits up to this configured value in length. For example, if this value is 5, the suffix will be a number between 00001 and 99999, inclusive. */ numberOfDigits?: number; /** * A single character to use as a separator from the requested username and a unique suffix that is added when a duplicate username is detected. This value can be a single non-alphanumeric ASCII character. */ separator?: string; /** * When enabled the user’s password will be validated during login. If the password does not meet the currently configured validation rules the user will be required to change their password. */ strategy?: string; } export interface FusionAuthTenantWebauthnConfiguration { /** * The Bootstrap Workflow configuration. */ bootstrapWorkflow?: outputs.FusionAuthTenantWebauthnConfigurationBootstrapWorkflow; /** * Determines if debug should be enabled for this tenant to create an event log to assist in debugging WebAuthn errors. Note: A license is required to utilize WebAuthn.. */ debug?: boolean; /** * Whether or not this tenant has WebAuthn enabled globally.. Note: A license is required to utilize WebAuthn.. */ enabled?: boolean; /** * The Reauthentication Workflow configuration. */ reauthenticationWorkflow?: outputs.FusionAuthTenantWebauthnConfigurationReauthenticationWorkflow; /** * The value this tenant will use for the Relying Party Id in WebAuthn ceremonies. Passkeys can only be used to authenticate on sites using the same Relying Party Id they were registered with. This value must match the browser origin or be a registrable domain suffix of the browser origin. For example, if your domain is auth.piedpiper.com, you could use auth.piedpiper.com or piedpiper.com but not m.auth.piedpiper.com or com. When this parameter is omitted, FusionAuth will use null for the Relying Party Id in passkey creation and request options. A null value in the WebAuthn JavaScript API will use the browser origin. Note: A license is required to utilize WebAuthn. */ relyingPartyId?: string; /** * The value this tenant will use for the Relying Party name in WebAuthn ceremonies. This value may be displayed by browser or operating system dialogs during WebAuthn ceremonies. When this parameter is omitted, FusionAuth will use the tenant.issuer value. Note: A license is required to utilize WebAuthn. */ relyingPartyName?: string; } export interface FusionAuthTenantWebauthnConfigurationBootstrapWorkflow { /** * Determines the authenticator attachment requirement for WebAuthn passkey registration when using the bootstrap workflow. The possible values are: Any, CrossPlatform and Platform. Note: A license is required to utilize WebAuthn and an Enterprise plan is required to utilize WebAuthn cross-platform authenticators.. */ authenticatorAttachmentPreference?: string; /** * Whether or not this tenant has the WebAuthn bootstrap workflow enabled. The bootstrap workflow is used when the user must "bootstrap" the authentication process by identifying themselves prior to the WebAuthn ceremony and can be used to authenticate from a new device using WebAuthn. Note: A license is required to utilize WebAuthn.. */ enabled?: boolean; /** * Determines the user verification requirement for WebAuthn passkey registration when using the bootstrap workflow. The possible values are: Discouraged, Preferred and Required. Note: A license is required to utilize WebAuthn.. */ userVerificationRequirement?: string; } export interface FusionAuthTenantWebauthnConfigurationReauthenticationWorkflow { /** * Determines the authenticator attachment requirement for WebAuthn passkey registration when using the reauthentication workflow. The possible values are:: Any, CrossPlatform and Platform. Note: A license is required to utilize WebAuthn and an Enterprise plan is required to utilize WebAuthn cross-platform authenticators.. */ authenticatorAttachmentPreference?: string; /** * Whether or not this tenant has the WebAuthn reauthentication workflow enabled. The reauthentication workflow will automatically prompt a user to authenticate using WebAuthn for repeated logins from the same device. Note: A license is required to utilize WebAuthn.. */ enabled?: boolean; /** * Determines the user verification requirement for WebAuthn passkey registration when using the bootstrap workflow. The possible values are: Discouraged, Preferred and Required. Note: A license is required to utilize WebAuthn.. */ userVerificationRequirement?: string; } export interface FusionAuthUserActionOption { /** * A mapping of localized names for this User Action Option. The key is the Locale and the value is the name of the User Action Option for that language. */ localizedNames?: { [key: string]: string; }; /** * The name of this User Action Option. */ name: string; } export interface FusionAuthUserTwoFactorMethod { /** * The algorithm used by the TOTP authenticator. With the current implementation, this will always be HmacSHA1. */ authenticatorAlgorithm: string; /** * The length of code generated by the TOTP. With the current implementation, this will always be 6. */ authenticatorCodeLength: number; /** * The time-step size in seconds. With the current implementation, this will always be 30. */ authenticatorTimeStep: number; /** * The value of the email address for this method. */ email?: string; /** * The type of this method. There will also be an object with the same value containing additional information about this method. */ method?: string; /** * The value of the mobile phone for this method. */ mobilePhone?: string; /** * A base64 encoded secret */ secret?: string; /** * The unique Id of the method. */ twoFactorMethodId: string; } export interface FusionAuthWebhookEventsEnabled { /** * When an audit log is created */ auditLogCreate?: boolean; /** * When an event log is created */ eventLogCreate?: boolean; /** * When a JWT RSA Public / Private keypair may have been changed */ jwtPublicKeyUpdate?: boolean; /** * When an access token is refreshed using a refresh token */ jwtRefresh?: boolean; /** * When a JWT Refresh Token is revoked */ jwtRefreshTokenRevoke?: boolean; /** * When kickstart has successfully completed */ kickstartSuccess?: boolean; /** * When a user action is triggered */ userAction?: boolean; /** * When multiple users are created in bulk (i.e. during an import) */ userBulkCreate?: boolean; /** * When a user is created */ userCreate?: boolean; /** * When a user create transaction has completed */ userCreateComplete?: boolean; /** * When a user is deactivated */ userDeactivate?: boolean; /** * When a user is deleted */ userDelete?: boolean; /** * When a user delete transaction has completed */ userDeleteComplete?: boolean; /** * When a user updates their email address */ userEmailUpdate?: boolean; /** * When a user verifies their email address */ userEmailVerified?: boolean; /** * When a user is linked to an identity provider */ userIdentityProviderLink?: boolean; /** * When a link to an identity provider is removed */ userIdentityProviderUnlink?: boolean; /** * When a user fails a login request */ userLoginFailed?: boolean; /** * When a request to create a user with a login Id (email or username) which is already in use has been received */ userLoginIdDuplicateCreate?: boolean; /** * When a request to update a user and change their login Id (email or username) to one that is already in use has been received */ userLoginIdDuplicateUpdate?: boolean; /** * When a user begins a login request with a new device */ userLoginNewDevice?: boolean; /** * When a user completes a login request */ userLoginSuccess?: boolean; /** * When a user logs in and is considered to be a potential threat */ userLoginSuspicious?: boolean; /** * When Reactor detects a user is using a potentially breached password (requires an activated license) */ userPasswordBreach?: boolean; /** * When a forgot password email has been sent to a user */ userPasswordResetSend?: boolean; /** * When the process to reset a user password has started */ userPasswordResetStart?: boolean; /** * When a user has successfully reset their password */ userPasswordResetSuccess?: boolean; /** * When a user has updated their password */ userPasswordUpdate?: boolean; /** * When a user is reactivated */ userReactivate?: boolean; /** * When a user registration is created */ userRegistrationCreate?: boolean; /** * When a user registration create transaction has completed */ userRegistrationCreateComplete?: boolean; /** * When a user registration is deleted */ userRegistrationDelete?: boolean; /** * When a user registration delete transaction has completed */ userRegistrationDeleteComplete?: boolean; /** * When a user registration is updated */ userRegistrationUpdate?: boolean; /** * When a user registration update transaction has completed */ userRegistrationUpdateComplete?: boolean; /** * When a user completes registration verification */ userRegistrationVerified?: boolean; /** * When a user has added a two-factor method */ userTwoFactorMethodAdd?: boolean; /** * When a user has removed a two-factor method */ userTwoFactorMethodRemove?: boolean; /** * When a user is updated */ userUpdate?: boolean; /** * When a user update transaction has completed */ userUpdateComplete?: boolean; } export interface FusionAuthWebhookSignatureConfiguration { /** * Wether or not webhook signing is enabled */ enabled?: boolean; /** * The UUID key used for signing the Webhook */ signingKeyId?: string; } export interface GetApplicationWebauthnConfiguration { bootstrapWorkflowEnabled: boolean; enabled: boolean; reauthenticationWorkflowEnabled: boolean; } export interface GetFormFieldValidator { /** * Determines if user input should be validated. */ enabled?: boolean; /** * A regular expression used to validate user input. Must be a valid regular expression pattern. */ expression?: string; } export interface GetFormStep { /** * An ordered list of Form Field Ids assigned to this step. */ fields: string[]; }