Auth0

Auth0 Guardian API

The guardian API from Auth0 — 18 operation(s) for guardian.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 42

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /guardian/enrollments/ticket Create an MFA enrollment ticket for a user · Create a Multi-factor Authentication Enrollment Ticket #
Ask an LLM
“How do I send a user a link to enroll in multi-factor authentication?”
“Can an MFA enrollment ticket be emailed to the user automatically in their own language?”
Tell an agent
Create an MFA enrollment ticket for user {user_id}.
Generate an MFA enrollment ticket for {user_id} and email it to {email}.
GET /guardian/enrollments/{id} Get one MFA enrollment's status and type · Get a Multi-factor Authentication Enrollment #
Ask an LLM
“What status and factor type does a specific MFA enrollment have?”
“Can I look up a single multi-factor enrollment by its ID to see if it is confirmed?”
Tell an agent
Show me the details of MFA enrollment {id}.
Check whether MFA enrollment {id} is confirmed.
DELETE /guardian/enrollments/{id} Remove an MFA enrollment so the user can re-enroll · Delete a Multi-factor Authentication Enrollment #
Ask an LLM
“How do I reset a user's MFA so they can enroll a new device?”
“What happens to a user when I delete one of their MFA enrollments?”
Tell an agent destructive · confirm first
Delete MFA enrollment {id} so the user can enroll again.
Remove the lost-phone MFA enrollment {id} from the user's account.
GET /guardian/factors List the tenant's MFA factors · Get Factors and Multi-factor Authentication Details #
Ask an LLM
“Which multi-factor authentication factors are available in my Auth0 tenant?”
“Can I see at a glance which MFA factors are turned on or off?”
Tell an agent
List every MFA factor in my tenant with its enabled state.
Show me which MFA factors are currently enabled.
GET /guardian/factors/duo/settings Get the DUO MFA configuration · Get DUO Configuration #
Ask an LLM
“What DUO integration key and API host is my MFA currently set up with?”
“Where can I check the current DUO factor configuration?”
Tell an agent
Show me the current DUO MFA configuration.
Fetch the DUO account settings used for multi-factor authentication.
PATCH /guardian/factors/duo/settings Change individual DUO MFA settings · Update the DUO Configuration #
Ask an LLM
“Can I change just the DUO API hostname without re-entering the other keys?”
“How would I rotate only the DUO secret key on an existing setup?”
Tell an agent
Update only the DUO secret key to {skey}.
Patch the existing DUO setup to point at API host {host}.
PUT /guardian/factors/duo/settings Set the full DUO MFA configuration · Set the DUO Configuration #
Ask an LLM
“How do I connect my DUO account to multi-factor authentication from scratch?”
“Can I replace the whole DUO configuration with new integration and secret keys at once?”
Tell an agent
Set the DUO configuration with integration key {ikey}, secret key {skey} and API host {host}.
Replace the entire DUO MFA setup using API host {host}.
GET /guardian/factors/phone/message-types List enabled phone MFA delivery methods · Get Enabled Phone Factors #
Ask an LLM
“Are SMS codes, voice calls or both enabled for phone MFA?”
“Which phone message types can users receive MFA codes through right now?”
Tell an agent
Show me which phone MFA message types are enabled.
Check whether voice is enabled alongside SMS for phone MFA.
PUT /guardian/factors/phone/message-types Choose SMS and/or voice for phone MFA · Update the Enabled Phone Factors #
Ask an LLM
“How do I let users get their MFA code by voice call as well as text message?”
“Can I switch phone MFA to SMS only?”
Tell an agent
Set the phone MFA message types to {message_types}.
Enable both SMS and voice for phone MFA by setting message types to {message_types}.
GET /guardian/factors/phone/providers/twilio Get the Twilio phone MFA provider configuration · Get Twilio Configuration #
Ask an LLM
“Which Twilio sender number and messaging service is my phone MFA using?”
“Where do I view the Twilio settings for phone-based multi-factor authentication?”
Tell an agent
Show me the Twilio configuration for phone MFA.
Fetch the Twilio account SID and from-number configured for phone factors.
PUT /guardian/factors/phone/providers/twilio Update the Twilio phone MFA provider configuration · Update Twilio Configuration #
Ask an LLM
“How do I change the Twilio number that sends phone MFA codes?”
“Can I switch phone MFA to use a Twilio messaging service SID instead of a from-number?”
Tell an agent
Set the Twilio phone provider to send from {from} using account SID {sid}.
Configure phone MFA Twilio with messaging service {messaging_service_sid} and auth token {auth_token}.
GET /guardian/factors/phone/selected-provider See which phone provider delivers MFA codes · Get Phone Provider Configuration #
Ask an LLM
“Which provider is currently selected for sending phone MFA messages?”
“Is my tenant using Twilio or the built-in phone provider for MFA?”
Tell an agent
Show me the selected phone provider for MFA.
Tell me which phone messaging provider multi-factor authentication currently uses.
PUT /guardian/factors/phone/selected-provider Choose the phone provider for MFA messages · Update Phone Provider Configuration #
Ask an LLM
“How do I switch the provider that sends phone MFA codes?”
“Can phone MFA be moved to Twilio as the selected provider?”
Tell an agent
Set the phone MFA provider to {provider}.
Switch phone-based multi-factor messaging over to {provider}.
GET /guardian/factors/phone/templates Get phone MFA enrollment and verification messages · Get Enrollment and Verification Phone Templates #
Ask an LLM
“What text do users receive by phone when they enroll in or verify MFA?”
“Where can I read the current phone enrollment and verification message templates?”
Tell an agent
Show me the phone MFA enrollment and verification templates.
Fetch the message text sent by phone for MFA verification codes.
PUT /guardian/factors/phone/templates Customize phone MFA enrollment and verification messages · Update Enrollment and Verification Phone Templates #
Ask an LLM
“Can I rewrite the text message users get when verifying MFA by phone?”
“How do I brand the phone enrollment message for multi-factor authentication?”
Tell an agent
Set the phone enrollment message to {enrollment_message} and the verification message to {verification_message}.
Update the phone factor templates with verification text {verification_message} and enrollment text {enrollment_message}.
GET /guardian/factors/push-notification/providers/apns Get the APNs push MFA configuration · Get APNS Push Notification Configuration #
Ask an LLM
“Which iOS bundle ID is set for push notification MFA through APNs?”
“Is my APNs push configuration in sandbox or production mode?”
Tell an agent
Show me the APNs push notification configuration for MFA.
Check whether the APNs MFA provider is set to sandbox.
PATCH /guardian/factors/push-notification/providers/apns Change individual APNs push MFA settings · Update APNs Provider Configuration #
Ask an LLM
“Can I flip APNs from sandbox to production without re-uploading the certificate?”
“How do I swap just the APNs p12 certificate when it expires?”
Tell an agent
Update only the APNs sandbox flag to {sandbox}.
Patch the existing APNs setup with renewed certificate {p12}.
PUT /guardian/factors/push-notification/providers/apns Overwrite the APNs push MFA configuration · Update APNS Configuration #
Ask an LLM
“How do I set up APNs from scratch for push-based MFA on iOS?”
“Can I replace the whole APNs configuration with a new p12 certificate and bundle ID?”
Tell an agent
Replace the APNs configuration with bundle ID {bundle_id} and certificate {p12}.
Overwrite all APNs push settings using bundle {bundle_id} in sandbox mode {sandbox}.
PATCH /guardian/factors/push-notification/providers/fcm Update the legacy FCM server key for push MFA · Updates FCM Configuration #
Ask an LLM
“Can I rotate just the legacy FCM server key on my existing push MFA setup?”
“Is there a partial update for the older FCM provider configuration?”
Tell an agent
Patch the legacy FCM provider with new server key {server_key}.
Rotate the legacy FCM server key to {server_key} without resetting other settings.
PUT /guardian/factors/push-notification/providers/fcm Overwrite the legacy FCM push MFA configuration · Overwrite FCM Configuration #
Ask an LLM
“How do I set the legacy FCM server key for Android push MFA from scratch?”
“Can I replace the whole legacy FCM configuration in one call?”
Tell an agent
Replace the legacy FCM push configuration with server key {server_key}.
Overwrite all FCM (legacy) settings for MFA push using key {server_key}.
PATCH /guardian/factors/push-notification/providers/fcmv1 Update the FCM v1 push MFA credentials · Updates FCMV1 Configuration #
Ask an LLM
“Can I rotate just the FCMv1 service account credentials on an existing push setup?”
“Is there a partial update for the FCM v1 provider used by Guardian push?”
Tell an agent
Patch the FCMv1 provider with new credentials {server_credentials}.
Rotate the FCM v1 service account to {server_credentials} without resetting other settings.
PUT /guardian/factors/push-notification/providers/fcmv1 Overwrite the FCM v1 push MFA configuration · Overwrite FCMV1 Configuration #
Ask an LLM
“How do I configure FCM HTTP v1 service account credentials for Android push MFA?”
“Can I replace the full FCMv1 configuration with a new service account JSON?”
Tell an agent
Replace the FCMv1 push configuration with credentials {server_credentials}.
Overwrite all FCM v1 settings for push MFA using service account {server_credentials}.
GET /guardian/factors/push-notification/providers/sns Get the AWS SNS push MFA configuration · Get AWS SNS Configuration #
Ask an LLM
“Which AWS region and platform application ARNs is push MFA using via SNS?”
“Where can I view my AWS SNS push notification settings for MFA?”
Tell an agent
Show me the AWS SNS push notification configuration for MFA.
Fetch the SNS APNs and GCM platform application ARNs used for push MFA.
PATCH /guardian/factors/push-notification/providers/sns Change individual AWS SNS push MFA settings · Update AWS SNS Configuration #
Ask an LLM
“Can I update only the GCM platform ARN in my existing SNS push setup?”
“How would I rotate just the AWS secret key used for SNS push MFA?”
Tell an agent
Patch the SNS push setup with GCM platform ARN {sns_gcm_platform_application_arn}.
Update only the SNS AWS secret key to {aws_secret_access_key}.
PUT /guardian/factors/push-notification/providers/sns Configure AWS SNS for push MFA from scratch · Configure AWS SNS Configuration #
Ask an LLM
“How do I route push MFA notifications through my own AWS SNS account?”
“Can I replace the whole SNS push configuration with new AWS keys and region?”
Tell an agent
Configure SNS push MFA in region {aws_region} with access key {aws_access_key_id} and secret {aws_secret_access_key}.
Replace the SNS setup with APNs platform ARN {sns_apns_platform_application_arn}.
GET /guardian/factors/push-notification/selected-provider See which push notification provider MFA uses · Get Push Notification Provider #
Ask an LLM
“Is push MFA currently delivered through Guardian, SNS or direct APNs/FCM?”
“Which push notification provider is selected for my tenant?”
Tell an agent
Show me the selected push notification provider for MFA.
Tell me which provider sends Guardian push notifications.
PUT /guardian/factors/push-notification/selected-provider Choose the push notification provider for MFA · Update Push Notification Configuration #
Ask an LLM
“How do I switch push MFA to deliver through AWS SNS?”
“Can I change the selected push notification provider for Guardian?”
Tell an agent
Set the push notification provider for MFA to {provider}.
Switch Guardian push delivery over to {provider}.
GET /guardian/factors/sms/providers/twilio Get Twilio SMS MFA settings (deprecated endpoint) · Get Twilio SMS Configuration #
Ask an LLM
“What does the older SMS-only Twilio configuration endpoint return?”
“Can I still read Twilio settings through the deprecated SMS factor path?”
Tell an agent
Fetch the Twilio configuration from the deprecated SMS factor endpoint.
Show me the legacy SMS-factor Twilio settings.
PUT /guardian/factors/sms/providers/twilio Update Twilio SMS MFA settings (deprecated endpoint) · Update Twilio SMS Configuration #
Ask an LLM
“Does the deprecated SMS Twilio endpoint still accept a new from-number?”
“What fields does the older SMS-only Twilio update take?”
Tell an agent
Using the deprecated SMS endpoint, set the Twilio from-number to {from}.
Update the legacy SMS Twilio config with SID {sid} and auth token {auth_token}.
GET /guardian/factors/sms/selected-provider Get the SMS MFA provider (deprecated endpoint) · Get SMS Configuration #
Ask an LLM
“Which provider does the old SMS selected-provider endpoint report?”
“Can I still check the SMS provider via the deprecated SMS path?”
Tell an agent
Read the selected SMS provider from the deprecated SMS endpoint.
Show me the legacy SMS-factor provider selection.
PUT /guardian/factors/sms/selected-provider Set the SMS MFA provider (deprecated endpoint) · Update SMS Configuration #
Ask an LLM
“Does the deprecated SMS selected-provider endpoint still let me pick a provider?”
“What value does the legacy SMS provider update expect?”
Tell an agent
Using the deprecated SMS endpoint, set the SMS provider to {provider}.
Switch the legacy SMS-factor provider to {provider}.
GET /guardian/factors/sms/templates Get SMS MFA message templates (deprecated endpoint) · Get SMS Enrollment and Verification Templates #
Ask an LLM
“What do the old SMS-only enrollment and verification templates say?”
“Can I still read SMS templates through the deprecated SMS factor path?”
Tell an agent
Fetch the SMS enrollment and verification templates from the deprecated endpoint.
Show me the legacy SMS-factor message templates.
PUT /guardian/factors/sms/templates Update SMS MFA message templates (deprecated endpoint) · Update SMS Enrollment and Verification Templates #
Ask an LLM
“Does the deprecated SMS templates endpoint still let me change the message text?”
“Which two messages must I send to the legacy SMS template update?”
Tell an agent
Using the deprecated SMS endpoint, set enrollment text {enrollment_message} and verification text {verification_message}.
Update the legacy SMS templates so verification reads {verification_message} and enrollment reads {enrollment_message}.
PUT /guardian/factors/{name} Turn an MFA factor on or off · Update Multi-factor Authentication Type #
Ask an LLM
“How do I enable one-time password MFA for my tenant?”
“Can I disable a single MFA factor like email without touching the others?”
Tell an agent
Enable the {name} MFA factor by setting enabled to {enabled}.
Turn off the {name} factor (enabled {enabled}).
GET /guardian/policies Get the tenant's MFA policies · Get Multi-factor Authentication Policies #
Ask an LLM
“Is MFA required on every login or only when confidence is low?”
“What multi-factor authentication policy is my tenant enforcing today?”
Tell an agent
Show me the MFA policies configured for my tenant.
Tell me whether all-applications MFA is enforced.
PUT /guardian/policies Set the tenant's MFA policies · Update Multi-factor Authentication Policies #
Ask an LLM
“How do I require MFA for every application in my tenant?”
“Can I switch to confidence-score based MFA instead of always prompting?”
Tell an agent
Set the MFA policy to require multi-factor on all applications.
Replace the tenant MFA policies with the confidence-score policy.
GET /guardian/factors/email/settings Get Email Factor Settings #
PUT /guardian/factors/email/settings Set the Email Factor Settings #
GET /guardian/factors/phone/settings Get Phone Factor Settings #
PUT /guardian/factors/phone/settings Set the Phone Factor Settings #
GET /guardian/settings Get Guardian Settings #
PUT /guardian/settings Set the Guardian Settings #

Documentation

📖
Documentation
https://auth0.com/docs/api/management/v2
📖
APIReference
https://auth0.com/docs/api/management/v2
📖
GettingStarted
https://auth0.com/docs/get-started
📖
Authentication
https://auth0.com/docs/secure/tokens
📖
Documentation
https://auth0.com/docs/api/authentication
📖
APIReference
https://auth0.com/docs/api/authentication
📖
Documentation
https://docs.fga.dev

Specifications

⚙
OpenAPI
https://artifacts.apis.io/auth0/openapi/auth0-guardian-api-openapi.yml
⚙
AsyncAPI
https://artifacts.apis.io/auth0/asyncapi/auth0-log-streams-and-actions-asyncapi.yml

Other Resources

🔗
OpenAPISource
https://auth0.com/docs/api/management/openapi.json
🔗
SpectralRules
https://artifacts.apis.io/auth0/rules/auth0-management-rules.yml
🔗
SpectralRules
https://artifacts.apis.io/auth0/rules/auth0-authentication-rules.yml
🔗
SpectralRules
https://artifacts.apis.io/auth0/rules/auth0-fga-rules.yml
🔗
Project
https://openfga.dev
🔗
Repository
https://github.com/openfga/openfga

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/auth0:auth0-guardian-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

auth0-guardian-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Auth0 Guardian API
  version: '2.0'
  contact:
    name: Auth0 Support
    url: https://support.auth0.com
  termsOfService: https://auth0.com/web-terms/
  description: 'Operations tagged guardian across 2 of this provider''s published API definitions: auth0-management-api-openapi.yml, auth0-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{tenantDomain}/api/v2
  variables:
    tenantDomain:
      default: '{TENANT}.auth0.com'
      description: Auth0 Tenant Domain
security:
- bearerAuth: []
tags:


# --- truncated at 32 KB (108 KB total) ---
# Full source: https://artifacts.apis.io/auth0/openapi/auth0-guardian-api-openapi.yml