Cloud Administration Manage FIDO Configuration API
9 days ago

Cloud Administration Manage FIDO Configuration API

The Cloud Administration Manage FIDO Configuration API allows you to manage the configuration of FIDO authenticators. This API requires the rsa.fido.configuration.manage OAuth permission. For more information, see OAuth 2.0-Based Permissions for the Cloud Administration APIs.

For information about managing access to this API, see Accessing the Cloud Administration APIs.

Authentication

Clients calling this API must authenticate themselves by including a JSON Web Token in a request. For instructions on using this token, see Authentication for the Cloud Administration APIs.

Software Developer Kit

You can download the API Software Developer Kit (SDK) from Cloud Administration REST API Download.

Request Requirements

Use the following information to manage FIDO configuration.

ActionMethodRequest URLResponse Content TypeResponse BodyResponse codes
Update FIDO ConfigurationPATCHAdminInterface/restapi/v1/configuration/fido
application/jsonObject containing FIDO configuration details200, 400, 429, 500

Example Request Data

The request does not contain any parameters. The following example displays a request.

PATCH AdminInterface/restapi/v1/configuration/fido

Accept: application/json

Authorization: Bearer <JWT token>

Example Request Body

The following example request shows the FIDO configuration.

  {
    "fidoAppIdDTOList": [
        {
            "id": 2,
            "appId": "https://google.com",
        }
    ],
    "passkeyStatus": false,
    "endPasskeyGracePeriodDate": 1771365600000,
    "minimumCertificationLevel": "FIDO_CERTIFIED_L2",
    "allowedAuthenticatorsList": "DS100,yubikey",
    "deniedAuthenticatorsList": "DS101,yubik*",
    "allowedAuthenticatorsListEnabled": true,
    "deniedAuthenticatorsListEnabled": true,
    "fidoStaticNamedList": [
        {
            "name": "RSA Authenticator App",
            "enabled": true
        },
        {
            "name": "RSA DS100",
            "enabled": false
        },
        {
            "name": "Windows Hello",
            "enabled": false
        }
    ],
    "fidoAddedNamedList": [
        {
            "aaguid": "5626bed4-e756-430b-a7ff-ca78c8b12738",
            "enabled": true
        },
        {
            "aaguid": "22222222-2222-2222-2222-222222222222",
            "enabled": true
        }
    ]
}

 

Response Body Parameters

The table lists the parameters returned in the response body.

 

PropertyDescriptionData TypeRequired
fidoAppIdDTOListFIDO Relying Party Domain(s)List of objects containing appIdFalse
passkeyStatusWhen disabled, FIDO Synced Passkeys can no longer be registered or used for authentication.BooleanFalse
endPasskeyGracePeriodDateUnix timestamp in milliseconds for the date when the grace period ends. When enabled, users with registered disallowed authenticators can continue to authenticate using those authenticators until the grace period ends.StringFalse
minimumCertificationLevelRepresents the authenticator’s compliance with the security requirements of the FIDO certification program.String
Must be one of: ["FIDO_CERTIFIED_L1", "FIDO_CERTIFIED_L2", "FIDO_CERTIFIED_L3"]
False
allowedAuthenticatorsListComma-separated list of allowed authenticators.StringFalse
deniedAuthenticatorsListComma-separated list of denied authenticators.StringFalse
allowedAuthenticatorsListEnabledBoolean that determines whether the allowedAuthenticatorsList parameter should be used.BooleanFalse
deniedAuthenticatorsListEnabledBoolean that determines whether the deniedAuthenticatorsList parameter should be used.BooleanFalse
fidoStaticNamedListStatic list of FIDO authenticators (RSA DS100, Windows Hello, RSA Authenticator App) that administrators can enable or disable.ListFalse
fidoAddedNamedListDynamic list of FIDO authenticators, where administrators can add or remove authenticators using the AAGUID and change their enabled status.ListFalse

 

Response Codes

The following table lists the response codes and their descriptions.

 

CodeDescription
200Emergency Access Code generated successfully.
400

Invalid AAGUID format.

Duplicate AAGUID found.

Invalid FIDO certification level.

429Too many requests.
500Internal error occurred when processing the request.