Frontegg Password Settings API

openapi: 3.0.0
info:
  title: Multi-Apps Overview Account Invitations Password Settings API
  description: Frontegg’s Multi-Apps feature simplifies and streamlines application management, delivering a seamless user experience. This section includes all necessary endpoints for managing applications and copying application settings across environments. All endpoints are categorized as **Management Endpoints**, requiring environment-level authorization and providing full control over entitlement resources.
  version: '1.0'
  x-metadata:
    note: Trigger publish artifacts job, remove this x-metadata after publishing
servers:
- url: https://api.frontegg.com/applications
  description: EU Region
- url: https://api.us.frontegg.com/applications
  description: US Region
- url: https://api.ca.frontegg.com/applications
  description: CA Region
- url: https://api.au.frontegg.com/applications
  description: AU Region
- url: https://{domain}.frontegg.com/applications
  description: Frontegg sub-domain for use with user tokens
  variables:
    domain:
      default: app-xxx
tags:
- name: Password Settings
  x-displayName: Password settings
paths:
  /resources/configurations/v1/password:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: PasswordPolicyController_addOrUpdatePasswordConfig
      summary: Create or Update Password Configuration
      description: Create or update the password policy for the entire environment.
      parameters:
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: false
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordConfigRequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordConfigResponse'
      tags:
      - Password Settings
      security:
      - bearer: []
    get:
      operationId: PasswordPolicyController_getPasswordConfig
      summary: Get Password Policy Configuration
      description: Retrieve the password policy for all accounts (tenants).
      parameters:
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: false
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordConfigResponse'
      tags:
      - Password Settings
      security:
      - bearer: []
  /resources/configurations/v1/password-history-policy:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: PasswordHistoryPolicyController_createPolicy
      summary: Create Password History Policy
      description: 'Create a password history policy for all accounts (tenants).


        To enable the password history policy, set the `enabled` parameter to `true` and specify the `passwordHistorySize` as a number between 1 and 10.'
      parameters:
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: false
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordHistoryPolicyRequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordHistoryPolicyResponse'
        '409':
          description: Policy already exists. Use the Update Password History Policy API.
      tags:
      - Password Settings
      security:
      - bearer: []
    patch:
      operationId: PasswordHistoryPolicyController_updatePolicy
      summary: Update Password History Policy
      description: 'Update the password history policy for all accounts (tenants).


        To disable the password history policy, set the `enabled` parameter to `false`. You can also update the `passwordHistorySize` value to a number between 1 and 10.'
      parameters:
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: false
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordHistoryPolicyRequest'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordHistoryPolicyResponse'
        '404':
          description: History size must to be between 1 to 10
      tags:
      - Password Settings
      security:
      - bearer: []
    get:
      operationId: PasswordHistoryPolicyController_getPolicy
      summary: Get Password History Policy
      description: Retrieve the password history policy for all accounts (tenants) or for a specific account (tenant).
      parameters:
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: false
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordHistoryPolicyResponse'
        '404':
          description: Password History Policy not found. Policy is disabled
      tags:
      - Password Settings
      security:
      - bearer: []
  /resources/users/v1/passwords/reset:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: UsersPasswordControllerV1_resetPassword
      summary: Reset Password
      description: 'Send a reset password email to a user.


        Provide the user''s email in the request body. If your email template uses metadata, include the email metadata in the request body as well.'
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResetPasswordDto'
      responses:
        '201':
          description: ''
      tags:
      - Password Settings
      security:
      - bearer: []
  /resources/users/v1/passwords/reset/verify:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: UsersPasswordControllerV1_verifyResetPassword
      summary: Verify Password
      description: 'Verify a user''s password using a verification token.


        Provide the `userId`, `token`, and `password` in the request body. The `token` can be obtained using the route for generating a user password reset token.'
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyPasswordDto'
      responses:
        '201':
          description: ''
      tags:
      - Password Settings
      security:
      - bearer: []
  /resources/users/v1/passwords/change:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: UsersPasswordControllerV1_changePassword
      summary: Change Password
      description: 'Change the password for a logged-in user.


        Include the current and new passwords in the request body.'
      parameters:
      - name: frontegg-user-id
        in: header
        description: The user ID identifier
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateUserPasswordDto'
      responses:
        '201':
          description: ''
      tags:
      - Password Settings
      security:
      - bearer: []
  /resources/users/v1/passwords/config:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    get:
      operationId: UsersPasswordControllerV1_getUserPasswordConfig
      summary: Get Strictest Password Configuration
      description: 'Retrieve the user''s strictest password configuration.


        This is useful when a user belongs to multiple accounts (tenants) with varying password complexity requirements. The route returns the strictest setting the user is subject to.'
      parameters:
      - name: userId
        required: false
        in: query
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordConfigResponse'
      tags:
      - Password Settings
      security:
      - bearer: []
  /resources/users/v2/passwords/reset/email:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: UsersPasswordControllerV2_resetPasswordViaEmail
      summary: Reset Password via Email
      description: Sends a password reset email to the user. Provide the user's email address in the request body to initiate the reset process.
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResetPasswordDto'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResetPasswordViaSmsResponseDto'
      tags:
      - Password Settings
      security:
      - bearer: []
  /resources/users/v2/passwords/reset/sms:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: UsersPasswordControllerV2_resetPasswordViaSms
      summary: Reset Password via SMS
      description: Sends a password reset SMS with a one-time code (OTP) to the user. Provide the user's phone number in the request body to initiate the reset process.
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResetPasswordDto'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResetPasswordViaSmsResponseDto'
      tags:
      - Password Settings
      security:
      - bearer: []
  /resources/users/v2/passwords/reset/sms/verify:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: UsersPasswordControllerV2_verifyResetPasswordViaSmsOtc
      summary: Verify Password Reset Code Sent via SMS
      description: Verifies the one-time code (OTP) sent via SMS for password reset. Provide the OTP in the request body. If valid, returns the user ID and reset token.
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyPasswordViaSmsRequestDto'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerifyPasswordViaSmsResponseDto'
      tags:
      - Password Settings
      security:
      - bearer: []
  /resources/configurations/v1/password-rotation:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    get:
      operationId: PasswordRotationConfigControllerV1_getPasswordRotationConfiguration
      summary: Get Password Expiration Period Configuration
      description: Retrieve the password expiration period configuration for your environment or for a specific account (tenant).
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordRotationConfigurationResponse'
        '404':
          description: Password rotation configuration not found
      tags:
      - Password Settings
      security:
      - bearer: []
    post:
      operationId: PasswordRotationConfigControllerV1_upsertPasswordRotationConfiguration
      summary: Manage Password Expiration
      description: 'Create or update the configuration for the password expiration policy.


        If no configuration exists, a default policy will be applied.'
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOrUpdatePasswordRotationDto'
      responses:
        '200':
          description: ''
      tags:
      - Password Settings
      security:
      - bearer: []
  /resources/configurations/v1/password-rotation/vendor:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    get:
      operationId: PasswordRotationConfigControllerV1_getVendorPasswordRotationConfiguration
      summary: Get Environment Configuration for Password Expiration Period.
      description: Retrieve the password expiration period configuration for your environment or for a specific account (tenant).
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordRotationConfigurationResponse'
        '404':
          description: Password rotation configuration not found
      tags:
      - Password Settings
      security:
      - bearer: []
components:
  schemas:
    PasswordConfigRequest:
      type: object
      properties:
        allowPassphrases:
          type: boolean
        maxLength:
          type: number
        minLength:
          type: number
        minPhraseLength:
          type: number
        minOptionalTestsToPass:
          type: number
        blockPwnedPasswords:
          type: boolean
        optionalTests:
          $ref: '#/components/schemas/OptionalTestsConfig'
        requiredTests:
          $ref: '#/components/schemas/RequiredTestsConfig'
    PasswordHistoryPolicyRequest:
      type: object
      properties:
        enabled:
          type: boolean
          description: Detemine whether the history policy is enbaled.
          default: false
        historySize:
          type: number
          description: Number of passwords per user to remember in the history.
          maximum: 10
          minimum: 1
          default: 1
      required:
      - enabled
      - historySize
    CreateOrUpdatePasswordRotationDto:
      type: object
      properties:
        isActive:
          type: boolean
          description: Indicates whether password expiration is enabled
          default: false
        rotationPeriod:
          type: number
          minimum: 1
          maximum: 2628000
          description: The password expiration period, in minutes
          default: 129600
        notificationPeriod:
          type: number
          minimum: 0
          maximum: 2628000
          description: Notification period before password expiration, in minutes
          default: 10080
    PasswordConfigResponse:
      type: object
      properties:
        allowPassphrases:
          type: boolean
        maxLength:
          type: number
        minLength:
          type: number
        minPhraseLength:
          type: number
        minOptionalTestsToPass:
          type: number
        blockPwnedPasswords:
          type: boolean
        optionalTests:
          type: object
        requiredTests:
          type: object
      required:
      - blockPwnedPasswords
    VerifyPasswordViaSmsResponseDto:
      type: object
      properties:
        userId:
          type: string
        token:
          type: string
      required:
      - userId
      - token
    RequiredTestsConfig:
      type: object
      properties:
        checkThreeRepeatedChars:
          type: boolean
          description: Check if the password contains three repeated characters
    PasswordHistoryPolicyResponse:
      type: object
      properties:
        id:
          type: string
        enabled:
          type: boolean
        historySize:
          type: number
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
      required:
      - id
      - enabled
      - historySize
      - createdAt
      - updatedAt
    VerifyPasswordViaSmsRequestDto:
      type: object
      properties:
        otcToken:
          type: string
        sessionId:
          type: string
      required:
      - otcToken
      - sessionId
    VerifyPasswordDto:
      type: object
      properties:
        userId:
          type: string
        token:
          type: string
        password:
          type: string
      required:
      - userId
      - token
      - password
    UpdateUserPasswordDto:
      type: object
      properties:
        password:
          type: string
        newPassword:
          type: string
      required:
      - password
      - newPassword
    ResetPasswordDto:
      type: object
      properties:
        identifier:
          type: string
          description: User identifier (phone number or email)
        identifierType:
          enum:
          - email
          - phoneNumber
          - username
          type: string
          description: Type of the identifier
        emailMetadata:
          type: object
      required:
      - identifier
      - identifierType
    ResetPasswordViaSmsResponseDto:
      type: object
      properties:
        sessionId:
          type: string
      required:
      - sessionId
    PasswordRotationConfigurationResponse:
      type: object
      properties:
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
        isActive:
          type: boolean
        rotationPeriod:
          type: number
        notificationPeriod:
          type: number
        tenantId:
          type: string
      required:
      - createdAt
      - updatedAt
      - isActive
      - rotationPeriod
      - notificationPeriod
      - tenantId
    OptionalTestsConfig:
      type: object
      properties:
        requireLowercase:
          type: boolean
          description: Require at least one lowercase letter
        requireUppercase:
          type: boolean
          description: Require at least one uppercase letter
        requireNumbers:
          type: boolean
          description: Require at least one number
        requireSpecialChars:
          type: boolean
          description: Require at least one special character
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http
x-tagGroups:
- name: Management
  tags:
  - Applications settings