openapi: 3.0.0
info:
  title: Authnfactor Configs
  description: 'Authnfactor Config APIs for ID360, to manage authnfactor configurations in your account.'
  version: 1.1.2
servers:
  - url: 'https://id360.manageengine.com/api/v1'
    description: 'API Endpoint'
tags:
  - name: authnfactor-config
    description: 'Authnfactor Config Endpoint'
paths:
  /protection/authnfactor-configs :
    get:
      tags:
        - authnfactor-config
      summary: 'Get All Authnfactor Configs'
      description: 'The Get All Authnfactor Configs API can be used to get the details of all authnfactor configurations in your account.'
      parameters:
        - $ref: '#/components/parameters/acceptHeader'
        - $ref: '#/components/parameters/fields'
      responses:
        '200':
          description: 'OK'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getAuthnfactorConfigsResponse'
        '400':
          description: 'Bad Request'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/invalidParam'
        '401':
          description: 'Unauthorized'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/unauthorized'
        '500':
          description: 'Internal Server Error'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/serverError'
      security:
        - Zoho_Auth:
            - id360.auth.READ
            - id360.auth.ALL
    post:
      tags:
        - authnfactor-config
      summary: 'Create Authnfactor Config'
      description: 'The Create Authnfactor Config API can be used to create a new authnfactor configuration in your account.'
      parameters:
        - $ref: '#/components/parameters/acceptHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/authnfactorConfigResource'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getAuthnfactorConfigResponse'
        '401':
          description: 'Unauthorized'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/unauthorized'
        '500':
          description: 'Internal Server Error'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/serverError'
      security:
        - Zoho_Auth:
            - id360.auth.CREATE
            - id360.auth.WRITE
            - id360.auth.ALL
  /protection/authnfactor-configs/{id}:
    get:
      tags:
        - authnfactor-config
      summary: 'Get Authnfactor Config'
      description: 'The Get Authnfactor Config API can be used to get the details of a specific authnfactor configuration in your account.'
      parameters:
        - $ref: '#/components/parameters/acceptHeader'
        - $ref: '#/components/parameters/id'
      responses:
        '200':
          description: 'OK'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getAuthnfactorConfigResponse'
        '400':
          description: 'Bad Request'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/invalidParam'
        '401':
          description: 'Unauthorized'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/unauthorized'
        '404':
          description: 'Not Found'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authnfactorConfigNotFound'
        '500':
          description: 'Internal Server Error'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/serverError'
      security:
        - Zoho_Auth:
            - id360.auth.READ
            - id360.auth.ALL
    patch:
      tags:
        - authnfactor-config
      summary: 'Update Authnfactor Config'
      description: 'The Update Authnfactor Config API can be used to update the details of a specific authnfactor configuration in your account.'
      parameters:
        - $ref: '#/components/parameters/acceptHeader'
        - $ref: '#/components/parameters/id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/authnfactorConfigResource'
      responses:
        '200':
          description: 'OK'
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/authnfactorConfigResource'
        '401':
          description: 'Unauthorized'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/unauthorized'
        '404':
          description: 'Not Found'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authnfactorConfigNotFound'
        '500':
          description: 'Internal Server Error'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/serverError'
      security:
        - Zoho_Auth:
            - id360.auth.UPDATE
            - id360.auth.WRITE
            - id360.auth.ALL
    delete:
      tags:
        - authnfactor-config
      summary: 'Delete Authnfactor Config'
      description: 'Delete Authnfactor Config API can be used to delete a specific authnfactor configuration in your account.'
      parameters:
        - $ref: '#/components/parameters/acceptHeader'
        - $ref: '#/components/parameters/id'
      responses:
        '204':
          description: No Content
        '401':
          description: 'Unauthorized'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/unauthorized'
        '404':
          description: 'Not Found'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authnfactorConfigNotFound'
        '500':
          description: 'Internal Server Error'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/serverError'
      security:
        - Zoho_Auth:
            - id360.auth.DELETE
            - id360.auth.WRITE
            - id360.auth.ALL

  /protection/authnfactor-configs/{authnfactor_config_id}/regenerate-saml-signing-cert:
    post:
      tags:
        - authnfactor-config
      summary: 'Regenerate SAML Signing Certificate'
      description: 'The Regenerate SAML Signing Certificate API can be used to regenerate the SAML signing certificate for a specific authnFactor configuration.'
      parameters:
        - $ref: '#/components/parameters/acceptHeader'
        - $ref: '#/components/parameters/authnfactorConfigId'
      responses:
        '200':
          description: 'OK'
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/regenerateSamlSigningCertResource'
        '401':
          description: 'Unauthorized'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/unauthorized'
        '404':
          description: 'Not Found'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authnfactorConfigNotFound'
        '500':
          description: 'Internal Server Error'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/serverError'
      security:
        - Zoho_Auth:
            - id360.auth.WRITE
            - id360.auth.ALL
            - id360.auth.CREATE

  /protection/authnfactor-configs/{authnfactor_config_id}/regenerate-saml-encryption-cert:
    post:
      tags:
        - authnfactor-config
      summary: 'Regenerate SAML Encryption Certificate'
      description: 'The Regenerate SAML encryption Certificate API can be used to regenerate the SAML encryption certificate for a specific authnFactor configuration.'
      parameters:
        - $ref: '#/components/parameters/acceptHeader'
        - $ref: '#/components/parameters/authnfactorConfigId'
      responses:
        '200':
          description: 'OK'
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/regenerateSamlEncryptionCertResource'
        '401':
          description: 'Unauthorized'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/unauthorized'
        '404':
          description: 'Not Found'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authnfactorConfigNotFound'
        '500':
          description: 'Internal Server Error'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/serverError'
      security:
        - Zoho_Auth:
            - id360.auth.WRITE
            - id360.auth.ALL
            - id360.auth.CREATE

components:
  parameters:
    authorization:
      name: Authorization
      in: header
      schema:
        type: string
      description: 'Authorization OAuth token for the API'
      required: true
      example: 'Zoho-oauthtoken 1000.41d**************125f'
    acceptHeader:
      name: Accept
      in: header
      schema:
        type: string
      description: 'Accept header for the API'
      required: false
      example: 'application/json'
    id:
      name: id
      in: path
      required: true
      description: 'The ID of the authnfactor config to be fetched or updated'
      example: 1525000000165354
      schema:
        type: integer
        example: 1525000000165354
    authnfactorConfigId:
      name: authnfactor_config_id
      in: path
      required: true
      description: 'The ID of the authnfactor config'
      example: 1525000000165354
      schema:
        type: integer
        example: 1525000000165354
    fields:
      in: query
      name: fields
      schema:
        type: string
      description: 'Select the fields to be fetched in the response.'
      required: false
      example: 'id,factor_type,is_enabled,factor_logo,notifications'
  schemas:
    gendoc-attributes-schema:
      type: object
      $ref: '#/components/schemas/authnfactorConfigResource'
    getAuthnfactorConfigsResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/authnfactorConfigGetAll'
    getAuthnfactorConfigResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/authnfactorConfigResource'
    # Resource representation for Authenticator Configurations
    authnfactorConfigResource:
      type: object
      properties:
        id:
          type: string
          description: Authenticator config ID, used for identification
          example: "1525000000165354"
          pattern: ^[0-9]+$
          readOnly: true
        ca_policies_usage_count:
          type: integer
          description: Conditional access policy usage count
          example: 5
          readOnly: true
        disableable:
          type: boolean
          description: Indicates if disabling the authenticator is allowed
          example: false
          readOnly: true
        disabled_reason:
          type: string
          description: This param contains the reason for not allowing the disable option for authenticator.
          example: "The configuration cannot be disabled as this authenticator is currently used in Conditional Access Policies"
          pattern: ^[A-Za-z0-9]+$
          readOnly: true
        is_enabled:
          type: boolean
          description: Indicates if the authenticator is currently enabled
          example: true
        factor_type:
          type: string
          description: Factor name used for identification.
          example: "EmailAuthenticator"
          enum:
            - EmailAuthenticator
            - FIDOAuthenticator
            - GoogleAuthenticator
            - MicrosoftAuthenticator
            - ZohoOneAuthAuthenticator
            - CustomTOTPAuthenticator
            - SMSAuthenticator
            - DUOAuthenticator
            - SmartCardAuthenticator
            - SQAAuthenticator
            - SAMLAuthenticator
        display_name:
          type: string
          description: Authenticator display name
          example: "Custom TOTP 1"
          pattern: ^[0-9a-zA-Z_\-\.\$@\?\,\:\'\/\!\[\{\]\}\\\|\;\`\~\#\%\^\\*\(\)\+\=&quot;&amp;\P{InBasicLatin}\s]+$
          readOnly: true
        factor_logo:
          type: string
          description: Authenticator logo
          example: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAC0AAAAtCAYAAAA6GuKaAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGYktHRAD/AP8A/6C9p5MAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAAHdElNRQfpBhILAQsKU412AAAL9UlEQVRYw82ZbYxc11nHf885987bzuz7eu21197YOImdNqZ1nLZGshMBbgKh0Da1RUAqSIAC4QsIhAAJEFIlPhS1qB+gVDSV6EuIQBHCoiHBDpSUQIxjmxI72HHc2rG96/V6vbszszNz7zkPH+683JmddVLIB650dM+cc19+53/+57n3PiP8P9n+9NpfA+AxKIKgEMQ8teHwmmOlt0GffggK1VQDYCxy+JX3BO5rc18l9org8Vg8BqcGT1JWXJGMNEAgJsTi+LXNj60PrX/14PdPIQKqyJFX13T9zdyf4dUg4vEpsATUohB67LDHTDk1Ozxml8ds92rmHeYZxZwWPHWX4be2PtK+blCrRu0fjep15sammX7mg3sRewjIgM4Cs6ifR/0CGi8RVyssX1pd+lWNi698BuqLxMcPQlBCB6aJJx7gSjFm0c8Rq7I/+whfqXw2H0ppDIJpVdkJfrdi71XY4ZVNCkOKBB7BIyjm4x55AuxJTLchglS95MemM5uPPfmw5ic/j/rNqb4YkRpIGWQJMbcYed/84NFPzGLC62py17HFObX5eWABkWWg4DSeWdXqPc/XvrF7zEzd45AZh2zwSNFhxGOSGRCLV4NrzQJCDb3boT83kimfvFkvdU9urRoVgV8EDgMlqc1vIloZ7WP3xOCqzao2WwQwgI0xYQ2bL/ugUI5E85HWx7y6nKKoCiDN06R5id590udVWdAKZ/31l08GNx/58OsXK586exwWVpHfex6pVaM/BH67rboIBumL3Ebv5k4Wa3vfHFgKLt2va47vXEtT/QIs+9rV8tXXf2zH3g/9l/7+o16aNpFaNboMTLduUVd4O4Ka9gst3YJLP4B++3dxjACjAYwFXWP38bOfPTdw4eiFcGLoH1C+ilIOgOEW8IKDP7oBL1Wg0QdamgCSKqgm9XX6u9s6x9KnfzKEX5oSDgwJHlARE6nc5yPuw/MxkM04+YP2QjTAc0vwzFITsEdhrwZDcmNVQ6CuA7EuJKkB6Z0HBdxuwJeuKrsLwlgIXoS5YolczZN1ajDys4j+ZdDic8D5OniFIE2sQkjMR+xpDtrXyGqDk9EuXoofpKJ5zLsC1zvPRLPPAPN1uNWA8SABuzY0xEQExcgjGVtEGQyUOCfNNej72MGo5xcyf8uvZ75G0S+D83w6CHnWH+Iz8ZNUtdBXcdJ2WAcyrXKr3l6szRleGCyxJCETdY8EUka5bcA0+kUIaVri/eZNngqfpehWIBaIhSCqc8Qd5ZB/Ge9NX7D1ZuCdSyesiirlgTwL2QK+FoOyCCwZwbg2KJ1RJyMXflDOM+ZuQawQe4gcRB7bqPJgfIpAPeLplJTC5t34vddGPVGnns0wPzSIW3XgdAGxZdNP4TSEcyaBjT1EMTQcNJK9i00PnCJe+wyif+mOKtr+nY7f3hhujI0S1Rza8HPMbKibvsDNk616XnO7uBaNQ6ORAo6oR1m+LftQNXe2gwe8JEVlfXV7PK8tf4uwMDFKLQK/Gs2Wj57yHejUiaZ5MaueN902/jj6eWajcWhE0IgoRwW+ZH+GfzH7se8Y+oTBoMJk9hZFu9oD3n8Bp5UWVW6Pj1CRAFduzEo22wwbXSt6bXh6Tg9xjh18SE6RsXW+E+7mtHk/sQYdhXvOQSEjjoMTJzkwcYrBoMJiY5Djcw/y6o334dPwPaLRUyrDJZbyBZ1YXpyNjCGgazp0zYVav99gJ+fs3YhJZsKq62uJdDj7kclXeXzLMTImwqthOFvmSP4FUPj3ufu7Fl7XgLsebEqjkGNhdKSx9cr1G/VcBtMG7vW0B5NaTFY9oTpCdQQa3zGkqRf2jZzlY1PfIpQYp5aYgIbPYI3n0elX2Dl4GfWy7jXaL5QquDBkfmrjaq3cuFlb9QTa5R+6pvp/83TzathZvMKR6RcZCFZxapOCJSapFzI1Hr3rX1mpF7lRGU2+CtdROmkW5rdPr9zKlxadsamPgOZJZl3od366qQqTmVs8sfV5JnKLxBqsAW7txwu3+eGZVzl6/iCVej75kE2r3LPW5nfOrJz49CfLuLjfQlwPWvqv9rbqQtGucnjri/xA6W0iDXAaJJBpYDrKbxuZZf/WM/zzxQeIne0L3KrWSqXS2Y8eLKI6b7reaVOxNYmvicIlU2XYrhDiIeXDtDIBjsemXmbv6BtEGhBrSERArElJ1+NU/d7J73L/1AVMb/RIESdNZsyr2eZVupWmBdysD9oqj47/Gx8cPE8oMRerW/jm7Ed4uzLZmc7msQc2nOLhyROJFVoK91jD9SjdSh3cv+UCS9USl+a2IEa7QmD70wwpOLX3GPSfukJe2h45afDEphd5ePQ1ACINGcpUKQWrfP17H2VudRSjybffnuEL/MSWb2GMJioT9Adug5uuQdjA84G73qC8WqBeGWmL2BFdSDIldtcIc90hr/UEsur58YlXODByGoeh6vOsuAGW4yLD2TIPT75G0a6i3rC1MMfj244xENaINCTSsG2BqNcOJDPQqQfEaok0IJdrsGfHeYq51eRDN2WTFp5H7r2sd+eN9ngaL/zQ8Hd4bMO3UYRVn6fSLjkqcYHJwiJ7x8+zIbfI41uPsSG/SKMFTAqYNLDtBlablGZ/pAGDg2V2bb9EaOMuWzftgaqZscTjXZ5WL9w3cIkjU8cIxFPxBWo+2ywZaj5L3Weo+wwzpevsG3mdHaUrNDQkVosjaHo67V9zR2skddM+dmh4mYyroVpKLUhpWWQDMJPytLA5e4O9oy9QDFYpuwKrTeB6D3DkQ6Zyc2zNX2+r5po+jnth7wjcGZBvggs2gUw5QNsRREqK7E5nmDgwdoqyLLDiBroUrreAXUjDZxjL3GYqN9+JEtiemGzWKtkPFotvK51km0RNVz6lO/pJoMieoNOqWPFUXJ6az1PvBfYhDZehGFTZVriGIn2ATU+k6LaGXwc+nTltKS1dwEn0aP7eE7QtrVDzGSouT13z1F0LOKThQ+o+QygxdxXeJhBH1PRv+tG8Vr11rJHqb+XzWnk8g+3YQVvArfSbANwTpB+ZDR9S9XkaPtcBdgmwAHcVr5IPajQI+z8svg9rdOelbdseRpOkenf4aD1gABgK0oZ3mqfqckQ+11Q4Q8OHOG/ZPnCFkcwy0brAd7ZGur9X3dYAHIYAi1VB0UTlHl8DJ9ohTxA22M287uepuET1hs8Qe8vm/ByT+XkaqRvHzZu49g1tqm564E0qQph2gn1NHcsWX2KYTDtXqCKoCCiRwAlFfiNoDglVZTrYyP7cBzhfv0nNC7EPyJoGMwPLBOxIgNIZfV27d+v1Icn/KSrt36rd7aM+zz4dJaum/UC8b/52fMvc+vOVsam/t+JOiPobUlmITqA8oCnFvWoylrThe8NQurn1YrPOMb0p3fWuZ9JRQwRp1Bl47gu3g/84/tBzn/rJM/+4/yE28RZSuRk9pvAnKNs77x/SzlD3z0Gv396atRaISitHLenoeudrAcQR2dMvkTv+zBWpVQ5ig0vyF98AIMBzFMMV4BFgzHlvT6288YlyXJuhHWpoL4rkJunV3LtYBFFTCyW4NVx3la0Li6XxlXJRXJzDa9B1cCqkoZ2sp3iPnbtMcPEM0qi9iQ3n03cIsIByBjgTaczwYI6Tt1/OGmufSnwn7f/2Wl5u11XUK2Wv3HBevxc5d74e+7PVOP7v5Ub03Q+fvVi+9z/fKuXr8RhiJsBsBNkEshGVjSATKGMgQyhFVHKQesc3chWRz4GWEdeB1jgAEwPwO29+nn0zW5gYGnw6VvOjXs3d7RiKib2aJY+57jFveeScqpxDuGBEL2cDu/DU555e/eWPHyLEUrSGcVsgF+bAx22LAMlnfmQDIAdSBIaAMZAJYCMwiRABLyB6EhVQm5rL1PblK18kDscJ42Wcze/xan7aYcY95pJXc85jLjrstVgytzNuOYrJNle5ot7jnMdYwcXwuzt+it5NnzycfDk707GHytp6n63l5zXQAF++/nWsOCINQIUAR4V8nz8vDUYUVctvbjnEe7Hp4cNQsqkGgYFF5Avf7B5Av5O/eO3vUGpNAZI/IwX4lalPvidw/9ftfwBQqYYxemiXvgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNS0wNi0xOFQxMTowMTowMyswMDowMLDPh30AAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjUtMDYtMThUMTE6MDE6MDMrMDA6MDDBkj/BAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI1LTA2LTE4VDExOjAxOjExKzAwOjAwzbIPqQAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAAAASUVORK5CYII=
          pattern: ^data:image\/[jpg,jpeg,png]+;base64,[a-zA-Z0-9,+,/]+={0,2}$
        removable:
          type: boolean
          description: Is remove configuration allowed or not
          example: true
          readOnly: true
        notifications:
          type: array
          description: List of notifications for the authenticator
          items:
            type: object
            properties:
              severity:
                type: string
                description: Severity of the notification.
                enum:
                  - info
                  - warning
                  - critical
                example: warning
              type:
                type: string
                description: Type of the notification.
                enum:
                  - CertificateExpiringSoon
                  - CertificateExpired
                example: CertificateExpiringSoon
              message:
                type: string
                description: Notification message
                example: "Signing Certificate will expire in 2 days"
        #            example:
        #              - severity: warning
        #                type: CertificateExpiringSoon
        #                message: "Signing Certificate will expire in 2 days"
        #              - severity: critical
        #                type: CertificateExpired
        #                message: "Encryption Certificate expired"


        #        authenticator_notification:
        #          type: string
        #          description: Notification for the authenticator.
        #          enum:
        #            - SoonToExpireCertificate
        #            - CertificateExpired
        #          example: SoonToExpireCertificate
        #        authenticator_notification_details:
        #          type: string
        #          description: Reason for the notification of the authenticator
        #          example: Signing certificate going to expire in 2 days
        factor_settings:
          $ref: '#/components/schemas/factorSettingsResource'
          description: List of factor configuration settings
    factorSettingsResource:
      type: object
      description: Settings and configurations for the specific factor
      properties:
        max_nos_enrollment_per_user:
          type: integer
          description: Maximum number of enrollment per user
          example: 5
          minimum: 1
          maximum: 5
        otp_length:
          type: integer
          description: Verification Code length
          example: 7
          minimum: 6
          maximum: 10
        is_secondary_emailid_registration_enabled:
          type: boolean
          description: is secondary email enrollment allowed
          example: true
        secondary_emailid_registration_settings:
          type: object
          description: Secondary Email ID registration properties.
          properties:
            is_forced:
              type: boolean
              description: Enforces registration of a secondary email ID
              example: false
            format_restriction_type:
              type: string
              description: secondary email domain format restriction flag.
              enum:
                - all_allowed
                - blacklist
                - whitelist
              example: all_allowed
            formats:
              type: array
              description: Whitelisted/Blacklisted secondary email domain formats
              example: [ "example.com", "hu.ki" ]
              items:
                type: string
                pattern: "^((?!-)[A-Za-z0-9_-]{1,63}(?<!-)\\.)+[A-Za-z]{2,64}$"
        is_secondary_mobileno_registration_enabled:
          type: boolean
          description: is secondary mobile number enrollment enabled
          example: true
        secondary_mobileno_registration_settings:
          type: object
          description: Secondary Mobile number registration properties.
          properties:
            is_forced:
              type: boolean
              description: Enforces registration of a secondary mobile number
              example: false
            country_code_restriction_type:
              type: string
              description: secondary mobile number country code restriction flag.
              enum:
                - all_allowed
                - blacklist
                - whitelist
              example: all_allowed
            country_codes:
              type: array
              description: List of allowed country codes for secondary mobile numbers
              example: [ "IN", "JP" ]
              items:
                type: string
                pattern: ^[0-9]+$
        username_format:
          type: object
          description: Username format
          properties:
            name:
              type: string
              pattern: "^[0-9]+$"
              example: "firstName"
              description: Username format name
            type:
              type: string
              description: Username format type
              enum:
                - attribute
                - naming_format
              example: naming_format
        oath_type:
          type: string
          description: Custom TOTP's OTP Method.
          enum:
            - totp
            - hotp
          example: "hotp"
        token_type:
          type: string
          description: Custom TOTP's Token type
          enum:
            - software
            - hardware
          example: software
        hash_algorithm:
          type: string
          description: Hashing Algorithm to generate TOTP.
          enum:
            - SHA1
            - SHA256
            - SHA512
          example: "SHA1"
        totp_time_step:
          type: integer
          description: Custom TOTP's OTP validity.
          enum:
            - 10
            - 15
            - 20
            - 25
            - 30
            - 35
            - 40
            - 45
            - 50
            - 55
            - 60
          example: 30
        issuer_text:
          type: string
          description: Used as the Issuer for the enrollment by the Authenticator app.
          example: "Identity360"
          pattern: ^([^:]+)$
        totp_length:
          type: integer
          description: totp length
          example: 6
          minimum: 6
          maximum: 8
        clock_drift_factor:
          type: integer
          description: Custom TOTP's Variance
          example: 5
          minimum: 0
          maximum: 5
        api_hostname:
          type: string
          description: Duo Web SDK api hostname
          example: "api-d361021d.duosecurity.com"
          pattern: ^[a-zA-Z0-9-]+\.duosecurity\.com$
        websdk_client_id:
          type: string
          description: Duo Web SDK Client Id
          example: "DIGIG3B5K0UA4GPZ4MQ6"
          pattern: ^[A-Za-z0-9]+$
        websdk_client_secret:
          type: string
          description: Duo Web SDK Client Secret
          example: "xHgNCG1HqbtHzQwjOktB9w8fhOxz6cuD4KSYjil0"
          pattern: ^[A-Za-z0-9]+$
        dmp_client_id:
          type: string
          description: Duo DMP Client id
          example: "DI093J791C98JYGB24X0"
          pattern: ^[A-Za-z0-9]+$
        dmp_client_secret:
          type: string
          description: Duo DMP Client Secret
          example: "9xzBgtk5RtOBGfcK2f1VruvqgAizrkWbjVHMOSqd"
          pattern: ^[A-Za-z0-9]+$
        authapi_secret_key:
          type: string
          description: Duo authapi Client id
          example: "cOgtuAii3O4rzJkpwHPizOnovU7I5cLB1ZsC9xnv"
          pattern: ^[A-Za-z0-9]+$
        authapi_integ_key:
          type: string
          description: Duo authapi Client secret
          example: "DIBC9B5II50KNZNOK39E"
          pattern: ^[A-Za-z0-9]+$
        fido_types:
          type: string
          description: Allowed FIDO Passkey Type.
          enum:
            - all
            - platform
            - cross_platform
          example: all
        user_verification_requirement:
          type: string
          description: user verification requirement.
          enum:
            - discouraged
            - preferred
            - required
          example: discouraged
        is_synced_passkey_allowed:
          type: boolean
          description: is synced passkey allowed
          example: false
        predefined_ques_count:
          type: integer
          description: Number of predefined questions a user must select during enrollment.
          example: 2
        user_defined_ques_count:
          type: integer
          description: Number of questions the user is allowed to enroll on their own.
          example: 1
        min_ques_length:
          type: integer
          description: Minimum number of characters required in a question.
          example: 10
        min_ans_length:
          type: integer
          description: Minimum number of characters required in an answer.
          example: 6
        is_username_in_ans_denied:
          type: boolean
          description: Prevents the user from using their own username as an answer.
          example: true
        is_duplicate_ans_denied:
          type: boolean
          description: Ensures that the same answer is not used for multiple questions.
          example: true
        is_ques_word_as_ans_denied:
          type: boolean
          description: Blocks answers that contain the question’s keywords.
          example: true
        is_multibyte_chars_in_ans_denied:
          type: boolean
          description: Disallows characters outside the ASCII range in answers (e.g., emojis, special foreign scripts)
          example: true
        # Will be added in the future.
        #        verify_ques_prompt_type:
        #          type: string
        #          description: Controls how questions are shown.
        #          example: display_all
        #          enum: [ display_all, one_by_one ]
        #        verify_ans_ignore_case:
        #          type: boolean
        #          description: Enables case-insensitive answer validation (e.g., "Apple" = "apple").
        #          example: true
        #        verify_ans_hide_default:
        #          type: boolean
        #          description: Hides the answer input by default
        #          example: true
        #        verify_random_ques_count:
        #          type: integer
        #          description: Specifies how many random questions should be presented for verification.
        #          example: 2
        enabled_predefined_questions:
          type: array
          description: question_id is_mandatory action question_text
          items:
            $ref: '#/components/schemas/enabledPredefinedQuestionResource'
        saml_provider:
          type: string
          description: Name of the custom SAML identity provider.
          enum:
            - okta
            - rsa cloud
            - onelogin
            - adfs
            - line works
            - custom saml
          example: "custom"
        saml_provider_display_name:
          type: string
          description: Display name of the custom SAML identity provider.
          example: "Custom SAML AuthenticatoR"
          pattern: "^[0-9]+$"
        issuer_url:
          type: string
          description: URL that identifies the protection issuing the SAML assertion.
          example: "https://example-idp.com/iamapps/ssologin/custom/abc"
        login_url:
          type: string
          description: URL where users are redirected for authentication.
          example: "https://example-idp.com/iamapps/ssologin/custom/abc"
        public_key:
          type: string
          description: Public certificate used by IdP to sign SAML responses.
          example: "-----BEGIN CERTIFICATE-----MIICcTCC...-----END CERTIFICATE-----"
        saml_request_signed:
          type: boolean
          description: Specifies if the SAML request sent by SP is signed.
          example: true
        saml_authn_context:
          type: array
          description: Specifies the authentication context (e.g., PasswordProtectedTransport).
          example: [ "PPT" ]
          items:
            type: string
        saml_subject_include:
          type: boolean
          description: IIndicates if the subject (username) is included in the SAML request.
          example: true
        saml_subject_format:
          type: object
          description: SAML Subject format
          properties:
            name:
              type: string
              pattern: ^[0-9]+$
              description: Name of the subject format.
              example: "FirstName + LastName"
            type:
              type: string
              description: Type of subject format
              enum: [ attribute, naming_format ]
              example: attribute
        saml_response_signed:
          type: boolean
          description: Indicates whether the SAML response is signed.
          example: true
        saml_assertion_signed:
          type: boolean
          description: Indicates if the SAML assertion is digitally signed.
          example: true
        saml_assertion_signature_algo:
          type: string
          description: Cryptographic algorithm used for assertion signing.
          example: "SHA256"
        saml_assertion_encrypted:
          type: boolean
          description: Specifies if the assertion is encrypted before being sent.
          example: true
        encryption_cert_selected:
          type: string
          description: Type of certificate used for assertion encryption.
          enum: [ self_signed, ca_signed ]
          example: self_signed
        ca_signed_public_key:
          type: string
          description: CA-signed public key (used in encryption)
          example: "-----BEGIN CERTIFICATE-----\r\nMIIDWjCCAk.....\r\n-----END CERTIFICATE-----\r\n"
          writeOnly: true
        ca_signed_private_key:
          type: string
          description: CA-signed private key (used in encryption).
          example: "-----BEGIN CERTIFICATE-----\r\nMIIDWjCCAk.....\r\n-----END CERTIFICATE-----\r\n"
          writeOnly: true
        ca_signed_public_key_file_name:
          type: string
          pattern: ^[A-Za-z0-9]+$
          description: File name for the CA-signed public key (used in encryption).
          example: "caencpublic.pem"
        ca_signed_private_key_file_name:
          type: string
          pattern: ^[A-Za-z0-9]+$
          description: File name for the CA-signed private key (used in encryption).
          example: "caencprivate.pem"
        sp_config_details:
          readOnly: true
          $ref: '#/components/schemas/spConfigDetailsResource'
        ca_configs:
          type: array
          description: List of configured CAs
          maxItems: 5
          items:
            $ref: '#/components/schemas/caConfigResource'
        is_revocation_check_enabled:
          type: boolean
          description: To enable or disable certificate revocation for smartcard authentication
          example: true
    enabledPredefinedQuestionResource:
      type: object
      properties:
        question_id:
          type: string
          description: Unique identifier for the question
          example: "2000000283042"
          pattern: ^[0-9]+$
        is_mandatory:
          type: boolean
          description: Is the question mandatory during enrollment?
          example: true
    spConfigDetailsResource:
      type: object
      description: Object containing service provider configuration fields like metadata, certs, and URLs.
      properties:
        sp_issuer_url:
          type: string
          description: Identifier for the SP used in the SAML request and metadata.
          example: "https://id360.manageengine.com/saml/v1/f0af1d6cc6fe5c807f9dfd92885d955eb04f1901"
        sp_acs_url:
          type: string
          description: Assertion Consumer Service endpoint to receive SAML responses.
          example: "https://id360.manageengine.com/saml/v1/f0af1d6cc6fe5c807f9dfd92885d955eb04f1901/acs"
        sp_metadata:
          type: string
          description: SAML metadata XML describing the SP's configuration.
          example: "<?xml version=\"1.0\" encoding=\"UTF-8\"?><md:EntityDescriptor.....></md:EntityDescriptor>"
        sp_signing_cert:
          type: string
          description: X.509 certificate used by SP to sign SAML requests.
          example: "-----BEGIN CERTIFICATE-----MIIDWjCC...-----END CERTIFICATE-----"
        sp_signing_cert_expired:
          type: boolean
          description: Indicates if the signing certificate has expired.
          example: false
        sp_signing_cert_expiry_time:
          type: string
          description: Expiration date and time of the SP's signing certificate.
          example: "2025-09-08T20:14:45.000Z"
        sp_encryption_cert:
          type: string
          description: Certificate used to encrypt SAML assertions.
          example: "-----BEGIN CERTIFICATE-----MIIDWjCC..."
        sp_encryption_cert_expired:
          type: boolean
          description: Indicates if the encryption certificate has expired.
          example: false
        sp_encryption_cert_expiry_time:
          type: string
          description: Expiration date and time of the SP’s encryption certificate.
          example: "2025-09-08T20:14:45.000Z"
    authnfactorConfigGetAll:
      type: array
      items:
        $ref: '#/components/schemas/authnfactorConfigResource'
      example:
        - id: "1525000000165354"
          factor_type: "EmailAuthenticator"
          is_enabled: true
        - id: "1525000001335049"
          factor_type: "FIDOAuthenticator"
          is_enabled: true
        - id: "1525000000779281"
          factor_type: "GoogleAuthenticator"
          is_enabled: false
        - id: "1525000000853039"
          factor_type: "MicrosoftAuthenticator"
          is_enabled: false
        - id: "1525000000853033"
          factor_type: "ZohoOneAuthAuthenticator"
          is_enabled: false
        - id: "1525000001335033"
          factor_type: "CustomTOTPAuthenticator"
          display_name: "ctotp1"
          is_enabled: true
          factor_logo: "<Base64 encoded image>"
        - id: "1525000001335173"
          factor_type: "CustomTOTPAuthenticator"
          display_name: "ctotp3"
          is_enabled: true
          factor_logo: "<Base64 encoded image>"
        - id: "1525000001335021"
          factor_type: "SMSAuthenticator"
          is_enabled: true
        - id: "1525000001335061"
          factor_type: "DUOAuthenticator"
          is_enabled: true
        - id: "1525000000165354"
          factor_type: "SmartCardAuthenticator"
          is_enabled: true
        - id: "1525000000193567"
          factor_type: "SQAAuthenticator"
          is_enabled: true
        - id: "1525000000193569"
          factor_type: "SAMLAuthenticator"
          is_enabled: true
          notifications:
            - severity: warning
              type: CertificateExpiringSoon
              message: "Signing Certificate will expire in 2 days"
    #          authenticator_notification: "SoonToExpireCertificate"
    #          authenticator_notification_details: "Signing certificate going to expire in 2 days"

    # Resource representing Certificate Authority (CA) configuration
    caConfigResource:
      type: object
      properties:
        id:
          type: string
          description: 'Unique identifier for the certificate authority configuration.'
          example: "1525000000178381"
          readOnly: true
        is_enabled:
          type: boolean
          description: To enable or disable the configured CA
          example: true
        ca_file:
          type: string
          format: binary
          description: >
            CER encoded CA certificate file
            <br>
            Note: The file should be in .cer format;
          example: "-----BEGIN CERTIFICATE-----\r\nMIIDWjCCAk.....\r\n-----END CERTIFICATE-----\r\n"
          writeOnly: true
        subject_name:
          type: string
          description: Distinguished Name (DN) of the CA, used for identification
          example: "CN=idprotection,CN=Users,DC=Com"
          readOnly: true
        thumbprint:
          type: string
          description: Thumbprint of the CA certificate, used for identification
          example: "deuejnjenje2endd32ejdjebjfer"
          readOnly: true
        certificate_mapping_attribute:
          type: string
          description: Mapping attribute for smartcard enrollment and verification
          example: "emailAddress"
        expires_on:
          type: string
          description: Expiration date of the CA certificate
          example: "2025-09-08T20:14:45.000Z"
          readOnly: true
        added_time:
          type: string
          description: Timestamp when the CA configuration was added
          example: "2025-09-08T20:14:45.000Z"
          readOnly: true


    # Resource representing Regenerate SAML Certificate for signing
    regenerateSamlSigningCertResource:
      type: object
      properties:
        sp_signing_cert:
          type: string
          description: Certificate content of signing/encryption based on cert_type
          example: "-----BEGIN CERTIFICATE-----MIIDWjCC...-----END CERTIFICATE-----"
          readOnly: true
        sp_signing_cert_expired:
          type: boolean
          description: Indicates if the SP signing/encryption certificate is expired.
          example: false
          readOnly: true
        sp_signing_cert_expiry_time:
          type: string
          description: Expiration date and time of the signing/encryption certificate.
          example: 2025-09-08T20:14:45.000Z
          readOnly: true

    # Resource representing Regenerate SAML Certificate for encryption
    regenerateSamlEncryptionCertResource:
      type: object
      properties:
        sp_encryption_cert:
          type: string
          description: Certificate content of signing/encryption based on cert_type
          example: "-----BEGIN CERTIFICATE-----MIIDWjCC...-----END CERTIFICATE-----"
          readOnly: true
        sp_encryption_cert_expired:
          type: boolean
          description: Indicates if the SP signing/encryption certificate is expired.
          example: false
          readOnly: true
        sp_encryption_cert_expiry_time:
          type: string
          description: Expiration date and time of the signing/encryption certificate.
          example: 2025-09-08T20:14:45.000Z
          readOnly: true

    invalidParam:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              example: '00000107'
            title:
              type: string
              example: 'Invalid Parameter'
            detail:
              type: string
              example: 'The parameter select is invalid.'
    authnfactorConfigNotFound:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              example: '---'
            title:
              type: string
              example: 'Authnfactor Config Not Found'
            detail:
              type: string
              example: 'This Authnfactor Config ID does not exist or you do not have permission to access it.'
    unauthorized:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              example: '00000101'
            title:
              type: string
              example: 'Unauthorized'
            detail:
              type: string
              example: 'The OAuth token is invalid.'
    serverError:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              example: '00000000'
            title:
              type: string
              example: 'Internal Server Error'
            detail:
              type: string
              example: 'An unexpected internal error has occurred on the server. Please try again later.'
  securitySchemes:
    Zoho_Auth:
      type: oauth2
      x-authorization-example: 'Zoho-oauthtoken 1000.41d9f2cfbd1b7a8f9e314b7aff7bc2d1.8fcc9810810a216793f385b9dd6e125f'
      flows:
        authorizationCode:
          authorizationUrl: 'https://accounts.zoho.com/oauth/v2/auth'
          tokenUrl: 'https://accounts.zoho.com/oauth/v2/token'
          scopes:
            idmpod.auth.read: 'Read Authnfactor Configs from the account'
            idmpod.auth.write: 'Create/Update/Delete Authnfactor Configs in the account'
            idmpod.auth.create: 'Create Authnfactor Config in the account'
            idmpod.auth.delete: 'Delete Authnfactor Config from the account'
            idmpod.auth.update: 'Update Authnfactor Config in the account'
            idmpod.auth.all: 'Perform all actions on Authnfactor Configs'