Duo Security Tokens API

openapi: 3.1.0
info:
  title: Duo Admin Bulk Tokens API
  description: The Duo Admin API provides programmatic access to the administrative functionality of Duo Security for managing
    users, groups, phones, hardware tokens, WebAuthn credentials, integrations, and bypass codes. Requests are authenticated
    using HMAC-SHA1 signed HTTP Basic credentials derived from your integration key and secret key.
  version: v1
  contact:
    name: Duo Security
    url: https://duo.com/docs/adminapi
  x-provenance:
    method: derived
    authored_by: API Evangelist
    derived_on: '2026-08-19'
    first_party: false
    provider_published: false
    source: Modelled from the provider's public HTML documentation.
    note: 'Not published by the provider. Probed 2026-08-19: no anonymously fetchable first-party contract. api.duosecurity.com
      answers 200 with an identical 130,977-byte HTML shell for invented paths — a soft 404, not a spec.'
servers:
- url: https://api-XXXXXXXX.duosecurity.com
  description: Duo Admin API host (replace XXXXXXXX with your tenant identifier)
security:
- basicAuth: []
tags:
- name: Tokens
  description: Hardware token management
paths:
  /admin/v1/users/{user_id}/tokens:
    parameters:
    - name: user_id
      in: path
      required: true
      schema:
        type: string
    get:
      operationId: listUserTokens
      summary: List user hardware tokens
      tags:
      - Tokens
      responses:
        '200':
          description: Successful response
    post:
      operationId: associateUserToken
      summary: Associate hardware token with user
      tags:
      - Tokens
      responses:
        '200':
          description: Token associated
  /admin/v1/users/{user_id}/tokens/{token_id}:
    parameters:
    - name: user_id
      in: path
      required: true
      schema:
        type: string
    - name: token_id
      in: path
      required: true
      schema:
        type: string
    delete:
      operationId: disassociateUserToken
      summary: Disassociate hardware token from user
      tags:
      - Tokens
      responses:
        '200':
          description: Token disassociated
components:
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
      description: HTTP Basic with HMAC-SHA1 signed credentials (integration key as user, signed signature as password).
externalDocs:
  description: Duo Admin API Documentation
  url: https://duo.com/docs/adminapi