Auth0 tenants API

openapi: 3.0.0
info:
  title: Auth0 Authentication actions tenants API
  description: Auth0 Authentication API. Endpoints for authentication and authorization using OpenID Connect, OAuth 2.0, SAML, WS-Federation, and Passwordless flows.
  version: 1.0.0
servers:
- url: '{auth0_domain}'
  description: The Authentication API is served over HTTPS.
  variables:
    auth0_domain:
      description: Auth0 domain
      default: https://demo.us.auth0.com
tags:
- name: tenants
paths:
  /tenants/settings:
    get:
      summary: Get Tenant Settings
      description: Retrieve tenant settings. A list of fields to include or exclude may also be specified.
      tags:
      - tenants
      parameters:
      - name: fields
        in: query
        description: Comma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
        schema:
          type: string
          pattern: ^((allowed_logout_urls)|(change_password)|(default_token_quota)|(error_page)|(flags)|(friendly_name)|(picture_url)|(support_email)|(support_url)|(session_lifetime)|(default_audience)|(default_directory)|(device_flow)|(idle_session_lifetime)|(ephemeral_session_lifetime)|(idle_ephemeral_session_lifetime)|(default_redirection_uri)|(universal_login)|(universal_login\.colors)|(universal_login\.passwordless)|(enabled_locales)|(session_cookie)|(sessions)|(oidc_logout)|(allow_organization_name_in_authentication_api)|(mtls)|(customize_mfa_in_postlogin_action)|(skip_non_verifiable_callback_uri_confirmation_prompt)|(resource_parameter_profile)|(enable_ai_guide)|(client_id_metadata_document_supported)|(phone_consolidated_experience))(,((allowed_logout_urls)|(change_password)|(default_token_quota)|(error_page)|(flags)|(friendly_name)|(picture_url)|(support_email)|(support_url)|(session_lifetime)|(default_audience)|(default_directory)|(device_flow)|(idle_session_lifetime)|(ephemeral_session_lifetime)|(idle_ephemeral_session_lifetime)|(default_redirection_uri)|(universal_login)|(universal_login\.colors)|(universal_login\.passwordless)|(enabled_locales)|(session_cookie)|(sessions)|(oidc_logout)|(allow_organization_name_in_authentication_api)|(mtls)|(customize_mfa_in_postlogin_action)|(skip_non_verifiable_callback_uri_confirmation_prompt)|(resource_parameter_profile)|(enable_ai_guide)|(client_id_metadata_document_supported)|(phone_consolidated_experience)))*$
      - name: include_fields
        in: query
        description: Whether specified fields are to be included (true) or excluded (false).
        schema:
          type: boolean
      responses:
        '200':
          description: Tenant settings successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetTenantSettingsResponseContent'
        '400':
          description: Invalid request query string. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: The specified client cannot perform the requested operation.
          x-description-1: 'Insufficient scope; expected any of: read:tenant_settings.'
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: tenant_settings_route
      x-release-lifecycle: GA
      x-operation-name: get
      x-operation-request-parameters-name: GetTenantSettingsRequestParameters
      x-operation-group:
      - tenants
      - settings
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - read:tenant_settings
    patch:
      summary: Update Tenant Settings
      description: Update settings for a tenant.
      tags:
      - tenants
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTenantSettingsRequestContent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/UpdateTenantSettingsRequestContent'
      responses:
        '200':
          description: Tenant settings successfully updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateTenantSettingsResponseContent'
        '400':
          description: Invalid request body. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: update:tenant_settings.'
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: patch_settings
      x-release-lifecycle: GA
      x-operation-name: update
      x-operation-group:
      - tenants
      - settings
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - update:tenant_settings
components:
  schemas:
    TenantOIDCLogoutSettings:
      type: object
      description: Settings related to OIDC RP-initiated Logout
      additionalProperties: false
      properties:
        rp_logout_end_session_endpoint_discovery:
          type: boolean
          description: Enable the end_session_endpoint URL in the .well-known discovery configuration
          default: true
    SessionCookieSchema:
      type:
      - object
      - 'null'
      description: Session cookie configuration
      additionalProperties: false
      required:
      - mode
      properties:
        mode:
          $ref: '#/components/schemas/SessionCookieModeEnum'
    TenantSettingsResourceParameterProfile:
      type: string
      description: Profile that determines how the identity of the protected resource (i.e., API) can be specified in the OAuth endpoints when access is being requested. When set to audience (default), the audience parameter is used to specify the resource server. When set to compatibility, the audience parameter is still checked first, but if it not provided, then the resource parameter can be used to specify the resource server.
      default: audience
      enum:
      - audience
      - compatibility
      x-release-lifecycle: GA
    TenantSettingsFlags:
      type: object
      description: Flags used to change the behavior of this tenant.
      additionalProperties: false
      properties:
        change_pwd_flow_v1:
          type: boolean
          description: Whether to use the older v1 change password flow (true, not recommended except for backward compatibility) or the newer safer flow (false, recommended).
          default: false
        enable_apis_section:
          type: boolean
          description: Whether the APIs section is enabled (true) or disabled (false).
          default: false
        disable_impersonation:
          type: boolean
          description: Whether the impersonation functionality has been disabled (true) or not (false). Read-only.
          default: false
        enable_client_connections:
          type: boolean
          description: Whether all current connections should be enabled when a new client (application) is created (true, default) or not (false).
          default: true
        enable_pipeline2:
          type: boolean
          description: Whether advanced API Authorization scenarios are enabled (true) or disabled (false).
          default: true
        allow_legacy_delegation_grant_types:
          type: boolean
          description: If enabled, clients are able to add legacy delegation grants.
        allow_legacy_ro_grant_types:
          type: boolean
          description: If enabled, clients are able to add legacy RO grants.
        allow_legacy_tokeninfo_endpoint:
          type: boolean
          description: Whether the legacy `/tokeninfo` endpoint is enabled for your account (true) or unavailable (false).
        enable_legacy_profile:
          type: boolean
          description: Whether ID tokens and the userinfo endpoint includes a complete user profile (true) or only OpenID Connect claims (false).
        enable_idtoken_api2:
          type: boolean
          description: Whether ID tokens can be used to authorize some types of requests to API v2 (true) not not (false).
        enable_public_signup_user_exists_error:
          type: boolean
          description: Whether the public sign up process shows a user_exists error (true) or a generic error (false) if the user already exists.
        enable_sso:
          type: boolean
          description: Whether users are prompted to confirm log in before SSO redirection (false) or are not prompted (true).
        allow_changing_enable_sso:
          type: boolean
          description: Whether the `enable_sso` setting can be changed (true) or not (false).
        disable_clickjack_protection_headers:
          type: boolean
          description: Whether classic Universal Login prompts include additional security headers to prevent clickjacking (true) or no safeguard (false).
        no_disclose_enterprise_connections:
          type: boolean
          description: Do not Publish Enterprise Connections Information with IdP domains on the lock configuration file.
        enforce_client_authentication_on_passwordless_start:
          type: boolean
          description: Enforce client authentication for passwordless start.
        enable_adfs_waad_email_verification:
          type: boolean
          description: Enables the email verification flow during login for Azure AD and ADFS connections
        revoke_refresh_token_grant:
          type: boolean
          description: Delete underlying grant when a Refresh Token is revoked via the Authentication API.
        dashboard_log_streams_next:
          type: boolean
          description: Enables beta access to log streaming changes
        dashboard_insights_view:
          type: boolean
          description: Enables new insights activity page view
        disable_fields_map_fix:
          type: boolean
          description: Disables SAML fields map fix for bad mappings with repeated attributes
        mfa_show_factor_list_on_enrollment:
          type: boolean
          description: Used to allow users to pick what factor to enroll of the available MFA factors.
        remove_alg_from_jwks:
          type: boolean
          description: Removes alg property from jwks .well-known endpoint
        improved_signup_bot_detection_in_classic:
          type: boolean
          description: Improves bot detection during signup in classic universal login
        genai_trial:
          type: boolean
          description: This tenant signed up for the Auth4GenAI trail
        enable_dynamic_client_registration:
          type: boolean
          description: Whether third-party developers can <a href="https://auth0.com/docs/api-auth/dynamic-client-registration">dynamically register</a> applications for your APIs (true) or not (false). This flag enables dynamic client registration.
          default: false
        disable_management_api_sms_obfuscation:
          type: boolean
          description: If true, SMS phone numbers will not be obfuscated in Management API GET calls.
          default: true
        trust_azure_adfs_email_verified_connection_property:
          type: boolean
          description: Changes email_verified behavior for Azure AD/ADFS connections when enabled. Sets email_verified to false otherwise.
          default: false
        custom_domains_provisioning:
          type: boolean
          description: If true, custom domains feature will be enabled for tenant.
          default: false
    TenantSettingsErrorPage:
      type:
      - object
      - 'null'
      description: Error page customization.
      additionalProperties: false
      properties:
        html:
          type: string
          description: Custom Error HTML (<a href='https://github.com/Shopify/liquid/wiki/Liquid-for-Designers'>Liquid syntax</a> is supported).
          default: ''
        show_log_link:
          type: boolean
          description: Whether to show the link to log as part of the default error page (true, default) or not to show the link (false).
          default: false
        url:
          type: string
          description: URL to redirect to when an error occurs instead of showing the default error page.
          default: https://mycompany.org/error
          format: absolute-uri-or-empty
    TenantSettingsSessions:
      type:
      - object
      - 'null'
      description: Sessions related settings for tenant
      additionalProperties: false
      properties:
        oidc_logout_prompt_enabled:
          type: boolean
          description: Whether to bypass prompting logic (false) when performing OIDC Logout
          default: true
    UpdateTenantSettingsRequestContent:
      type: object
      additionalProperties: false
      minProperties: 1
      properties:
        change_password:
          $ref: '#/components/schemas/TenantSettingsPasswordPage'
        device_flow:
          $ref: '#/components/schemas/TenantSettingsDeviceFlow'
          description: Device Flow configuration.
        guardian_mfa_page:
          $ref: '#/components/schemas/TenantSettingsGuardianPage'
        default_audience:
          type: string
          description: Default audience for API Authorization.
          default: ''
        default_directory:
          type: string
          description: 'Name of connection used for password grants at the `/token` endpoint. The following connection types are supported: LDAP, AD, Database Connections, Passwordless, Windows Azure Active Directory, ADFS.'
          default: ''
        error_page:
          $ref: '#/components/schemas/TenantSettingsErrorPage'
        default_token_quota:
          $ref: '#/components/schemas/DefaultTokenQuota'
          x-release-lifecycle: EA
        flags:
          $ref: '#/components/schemas/TenantSettingsFlags'
        friendly_name:
          type: string
          description: Friendly name for this tenant.
          default: My Company
        picture_url:
          type: string
          description: 'URL of logo to be shown for this tenant (recommended size: 150x150)'
          default: https://mycompany.org/logo.png
          format: absolute-uri-or-empty
        support_email:
          type: string
          description: End-user support email.
          default: support@mycompany.org
          format: email-or-empty
        support_url:
          type: string
          description: End-user support url.
          default: https://mycompany.org/support
          format: absolute-uri-or-empty
        allowed_logout_urls:
          type: array
          description: URLs that are valid to redirect to after logout from Auth0.
          items:
            type: string
            format: url-with-placeholders
        session_lifetime:
          type: integer
          description: Number of hours a session will stay valid.
          default: 168
          minimum: 1
        idle_session_lifetime:
          type: integer
          description: Number of hours for which a session can be inactive before the user must log in again.
          default: 72
          minimum: 1
        ephemeral_session_lifetime:
          type: integer
          description: Number of hours an ephemeral (non-persistent) session will stay valid.
          default: 72
          minimum: 1
        idle_ephemeral_session_lifetime:
          type: integer
          description: Number of hours for which an ephemeral (non-persistent) session can be inactive before the user must log in again.
          default: 24
          minimum: 1
        sandbox_version:
          type: string
          description: Selected sandbox version for the extensibility environment
          default: '22'
          maxLength: 8
        legacy_sandbox_version:
          type: string
          description: Selected legacy sandbox version for the extensibility environment
          maxLength: 8
        default_redirection_uri:
          type: string
          description: The default absolute redirection uri, must be https
          format: absolute-https-uri-or-empty
        enabled_locales:
          type: array
          description: Supported locales for the user interface
          minItems: 1
          items:
            $ref: '#/components/schemas/TenantSettingsSupportedLocalesEnum'
        session_cookie:
          $ref: '#/components/schemas/SessionCookieSchema'
        sessions:
          $ref: '#/components/schemas/TenantSettingsSessions'
        oidc_logout:
          $ref: '#/components/schemas/TenantOIDCLogoutSettings'
        customize_mfa_in_postlogin_action:
          type:
          - boolean
          - 'null'
          description: Whether to enable flexible factors for MFA in the PostLogin action
          default: false
        allow_organization_name_in_authentication_api:
          type:
          - boolean
          - 'null'
          description: Whether to accept an organization name instead of an ID on auth endpoints
          default: false
        acr_values_supported:
          type:
          - array
          - 'null'
          description: Supported ACR values
          minItems: 0
          items:
            type: string
            format: acr
        mtls:
          $ref: '#/components/schemas/TenantSettingsMTLS'
        pushed_authorization_requests_supported:
          type:
          - boolean
          - 'null'
          description: Enables the use of Pushed Authorization Requests
          default: false
        authorization_response_iss_parameter_supported:
          type:
          - boolean
          - 'null'
          description: Supports iss parameter in authorization responses
          default: false
        skip_non_verifiable_callback_uri_confirmation_prompt:
          type:
          - boolean
          - 'null'
          description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).

            If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.

            See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
        resource_parameter_profile:
          $ref: '#/components/schemas/TenantSettingsResourceParameterProfile'
          x-release-lifecycle: GA
        client_id_metadata_document_supported:
          type: boolean
          description: Whether the authorization server supports retrieving client metadata from a client_id URL.
          default: false
          x-release-lifecycle: EA
        enable_ai_guide:
          type: boolean
          description: Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant.
        phone_consolidated_experience:
          type: boolean
          description: Whether Phone Consolidated Experience is enabled for this tenant.
        dynamic_client_registration_security_mode:
          $ref: '#/components/schemas/TenantSettingsDynamicClientRegistrationSecurityMode'
          x-release-lifecycle: GA
    SessionCookieModeEnum:
      type: string
      description: Behavior of the session cookie
      default: persistent
      enum:
      - persistent
      - non-persistent
    TokenQuotaConfiguration:
      type: object
      additionalProperties: true
      required:
      - client_credentials
      properties:
        client_credentials:
          $ref: '#/components/schemas/TokenQuotaClientCredentials'
    UpdateTenantSettingsResponseContent:
      type: object
      additionalProperties: false
      properties:
        change_password:
          $ref: '#/components/schemas/TenantSettingsPasswordPage'
        guardian_mfa_page:
          $ref: '#/components/schemas/TenantSettingsGuardianPage'
        default_audience:
          type: string
          description: Default audience for API authorization.
          default: ''
        default_directory:
          type: string
          description: 'Name of connection used for password grants at the `/token`endpoint. The following connection types are supported: LDAP, AD, Database Connections, Passwordless, Windows Azure Active Directory, ADFS.'
          default: ''
        error_page:
          $ref: '#/components/schemas/TenantSettingsErrorPage'
        device_flow:
          $ref: '#/components/schemas/TenantSettingsDeviceFlow'
        default_token_quota:
          $ref: '#/components/schemas/DefaultTokenQuota'
          x-release-lifecycle: EA
        flags:
          $ref: '#/components/schemas/TenantSettingsFlags'
        friendly_name:
          type: string
          description: Friendly name for this tenant.
          default: My Company
        picture_url:
          type: string
          description: 'URL of logo to be shown for this tenant (recommended size: 150x150)'
          default: https://mycompany.org/logo.png
          format: absolute-uri-or-empty
        support_email:
          type: string
          description: End-user support email address.
          default: support@mycompany.org
          format: email-or-empty
        support_url:
          type: string
          description: End-user support URL.
          default: https://mycompany.org/support
          format: absolute-uri-or-empty
        allowed_logout_urls:
          type: array
          description: URLs that are valid to redirect to after logout from Auth0.
          items:
            type: string
            format: url
        session_lifetime:
          type: number
          description: Number of hours a session will stay valid.
          default: 168
        idle_session_lifetime:
          type: number
          description: Number of hours for which a session can be inactive before the user must log in again.
          default: 72
        ephemeral_session_lifetime:
          type: number
          description: Number of hours an ephemeral (non-persistent) session will stay valid.
          default: 72
          minimum: 1
        idle_ephemeral_session_lifetime:
          type: number
          description: Number of hours for which an ephemeral (non-persistent) session can be inactive before the user must log in again.
          default: 24
          minimum: 1
        sandbox_version:
          type: string
          description: Selected sandbox version for the extensibility environment.
          default: '22'
        legacy_sandbox_version:
          type: string
          description: Selected sandbox version for rules and hooks extensibility.
          default: ''
        sandbox_versions_available:
          type: array
          description: Available sandbox versions for the extensibility environment.
          items:
            type: string
        default_redirection_uri:
          type: string
          description: The default absolute redirection uri, must be https
        enabled_locales:
          type: array
          description: Supported locales for the user interface.
          items:
            $ref: '#/components/schemas/SupportedLocales'
        session_cookie:
          $ref: '#/components/schemas/SessionCookieSchema'
        sessions:
          $ref: '#/components/schemas/TenantSettingsSessions'
        oidc_logout:
          $ref: '#/components/schemas/TenantOIDCLogoutSettings'
        allow_organization_name_in_authentication_api:
          type: boolean
          description: Whether to accept an organization name instead of an ID on auth endpoints
          default: false
        customize_mfa_in_postlogin_action:
          type: boolean
          description: Whether to enable flexible factors for MFA in the PostLogin action
          default: false
        acr_values_supported:
          type:
          - array
          - 'null'
          description: Supported ACR values
          minItems: 0
          items:
            type: string
            format: acr
        mtls:
          $ref: '#/components/schemas/TenantSettingsMTLS'
        pushed_authorization_requests_supported:
          type: boolean
          description: Enables the use of Pushed Authorization Requests
          default: false
        authorization_response_iss_parameter_supported:
          type:
          - boolean
          - 'null'
          description: Supports iss parameter in authorization responses
          default: false
        skip_non_verifiable_callback_uri_confirmation_prompt:
          type:
          - boolean
          - 'null'
          description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).

            If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.

            See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
        resource_parameter_profile:
          $ref: '#/components/schemas/TenantSettingsResourceParameterProfile'
          x-release-lifecycle: GA
        client_id_metadata_document_supported:
          type: boolean
          description: Whether the authorization server supports retrieving client metadata from a client_id URL.
          default: false
          x-release-lifecycle: EA
        phone_consolidated_experience:
          type: boolean
          description: Whether Phone Consolidated Experience is enabled for this tenant.
        enable_ai_guide:
          type: boolean
          description: Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant.
        dynamic_client_registration_security_mode:
          $ref: '#/components/schemas/TenantSettingsDynamicClientRegistrationSecurityMode'
          x-release-lifecycle: GA
    SupportedLocales:
      type: string
      enum:
      - am
      - ar
      - ar-EG
      - ar-SA
      - az
      - bg
      - bn
      - bs
      - ca-ES
      - cnr
      - cs
      - cy
      - da
      - de
      - el
      - en
      - en-CA
      - es
      - es-419
      - es-AR
      - es-MX
      - et
      - eu-ES
      - fa
      - fi
      - fr
      - fr-CA
      - fr-FR
      - gl-ES
      - gu
      - he
      - hi
      - hr
      - hu
      - hy
      - id
      - is
      - it
      - ja
      - ka
      - kk
      - kn
      - ko
      - lt
      - lv
      - mk
      - ml
      - mn
      - mr
      - ms
      - my
      - nb
      - nl
      - nn
      - 'no'
      - pa
      - pl
      - pt
      - pt-BR
      - pt-PT
      - ro
      - ru
      - sk
      - sl
      - so
      - sq
      - sr
      - sv
      - sw
      - ta
      - te
      - th
      - tl
      - tr
      - uk
      - ur
      - vi
      - zgh
      - zh-CN
      - zh-HK
      - zh-MO
      - zh-TW
    DefaultTokenQuota:
      type:
      - object
      - 'null'
      description: Token Quota configuration, to configure quotas for token issuance for clients and organizations. Applied to all clients and organizations unless overridden in individual client or organization settings.
      additionalProperties: false
      minProperties: 1
      x-release-lifecycle: EA
      properties:
        clients:
          $ref: '#/components/schemas/TokenQuotaConfiguration'
        organizations:
          $ref: '#/components/schemas/TokenQuotaConfiguration'
    TenantSettingsDeviceFlow:
      type:
      - object
      - 'null'
      description: Device Flow configuration
      additionalProperties: false
      properties:
        charset:
          $ref: '#/components/schemas/TenantSettingsDeviceFlowCharset'
        mask:
          type: string
          description: Mask used to format a generated User Code into a friendly, readable format.
          default: '****-****'
          maxLength: 20
    GetTenantSettingsResponseContent:
      type: object
      additionalProperties: false
      properties:
        change_password:
          $ref: '#/components/schemas/TenantSettingsPasswordPage'
        guardian_mfa_page:
          $ref: '#/components/schemas/TenantSettingsGuardianPage'
        default_audience:
          type: string
          description: Default audience for API authorization.
          default: ''
        default_directory:
          type: string
          description: 'Name of connection used for password grants at the `/token`endpoint. The following connection types are supported: LDAP, AD, Database Connections, Passwordless, Windows Azure Active Directory, ADFS.'
          default: ''
        error_page:
          $ref: '#/components/schemas/TenantSettingsErrorPage'
        device_flow:
          $ref: '#/components/schemas/TenantSettingsDeviceFlow'
        default_token_quota:
          $ref: '#/components/schemas/DefaultTokenQuota'
          x-release-lifecycle: EA
        flags:
          $ref: '#/components/schemas/TenantSettingsFlags'
        friendly_name:
          type: string
          description: Friendly name for this tenant.
          default: My Company
        picture_url:
          type: string
          description: 'URL of logo to be shown for this tenant (recommended size: 150x150)'
          default: https://mycompany.org/logo.png
          format: absolute-uri-or-empty
        support_email:
          type: string
          description: End-user support email address.
          default: support@mycompany.org
          format: email-or-empty
        support_url:
          type: string
          description: End-user support URL.
          default: https://mycompany.org/support
          format: absolute-uri-or-empty
        allowed_logout_urls:
          type: array
          description: URLs that are valid to redirect to after logout from Auth0.
          items:
            type: string
            format: url
        session_lifetime:
          type: number
          description: Number of hours a session will stay valid.
          default: 168
        idle_session_lifetime:
          type: number
          description: Number of hours for which a session can be inactive before the user must log in again.
          default: 72
        ephemeral_session_lifetime:
          type: number
          description: Number of hours an ephemeral (non-persistent) session will stay valid.
          default: 72
          minimum: 1
        idle_ephemeral_session_lifetime:
          type: number
          description: Number of hours for which an ephemeral (non-persistent) session can be inactive before the user must log in again.
          default: 24
          minimum: 1
        sandbox_version:
          type: string
          description: Selected sandbox version for the extensibility environment.
          default: '22'
        legacy_sandbox_version:
          type: string
          description: Selected sandbox version for rules and hooks extensibility.
          default: ''
        sandbox_versions_available:
          type: array
          description: Available sandbox versions for the extensibility environment.
          items:
            type: string
        default_redirection_uri:
          type: string
          description: The default absolute redirection uri, must be https
        enabled_locales:
          type: array
          description: Supported locales for the user interface.
          items:
            $ref: '#/components/schemas/SupportedLocales'
        session_cookie:
          $ref: '#/components/schemas/SessionCookieSchema'
        sessions:
          $ref: '#/components/schemas/TenantSettingsSessions'
        oidc_logout:
          $ref: '#/components/schemas/TenantOIDCLogoutSettings'
        allow_organization_name_in_authentication_api:
          type: boolean
          description: Whether to accept an organization name instead of an ID on auth endpoints
          default: false
        customize_mfa_in_postlogin_action:
          type: boolean
          description: Whether to enable flexible factors for MFA in the PostLogin action
          default: false
        acr_values_supported:
          type:
          - array
          - 'null'
          description: Suppor

# --- truncated at 32 KB (37 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/auth0/refs/heads/main/openapi/auth0-tenants-api-openapi.yml