Gremlin

Gremlin Users.auth.mfa API

Endpoints for multi-factor user auth (MFA) and for managing MFA providers and secrets

Documentation GitHub OpenAPI

Operations 7

POST /users/auth/mfa/auth Authenticate a user with MFA #

POST /users/auth/mfa/disable Removes the MFA provider and secret, disabling MFA login #

POST /users/auth/mfa/enable Generate a secret key and enables it for the user #

POST /users/auth/mfa/forceDisable Removes the MFA provider and secret, disabling MFA login #

GET /users/auth/mfa/info Returns the enabled/disabled status and provider if set, of MFA for the user #

GET /users/auth/mfa/{email}/enabled Returns the enabled/disabled status of MFA for a user #

POST /users/auth/mfa/validate Validate a MFA token for a user #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/gremlin:gremlin-users-auth-mfa-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Gremlin Users.auth.mfa API
  version: '1.0'
  contact:
    name: Gremlin Support
    email: support@gremlin.com
  license:
    name: Gremlin License
    url: https://www.gremlin.com/license_2017_03_24
  termsOfService: https://www.gremlin.com/terms_of_service_2017_03_24
  description: 'Operations tagged users.auth.mfa across 2 of this provider''s published API definitions: gremlin-openapi.json, gremlin-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: /v1
- url: https://api.gremlin.com/v1
  description: Gremlin API v1
tags:
- name: users.auth.mfa
  description: Endpoints for multi-factor user auth (MFA) and for managing MFA providers and secrets
paths:
  /users/auth/mfa/auth:
    post:
      tags:
      - users.auth.mfa
      summary: Authenticate a user with MFA
      operationId: auth
      parameters:
      - name: getCompanySession
        in: query
        schema:
          type: boolean
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              required:
              - email
              - password
              type: object
              properties:
                email:
                  type: string
                password:
                  type: string
                token:
                  maximum: 999999
                  type: integer
                  format: int32
                companyName:
                  type: string
      responses:
        default:
          description: default response
          content:
            application/json: {}
        '403':
          description: Response was sent via HTTP, please retry using HTTPS
    servers:
    - url: /v1
  /users/auth/mfa/disable:
    post:
      tags:
      - users.auth.mfa
      summary: Removes the MFA provider and secret, disabling MFA login
      operationId: disable
      parameters: []
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              required:
              - email
              - password
              type: object
              properties:
                email:
                  type: string
                password:
                  type: string
                token:
                  maximum: 999999
                  type: integer
                  format: int32
      responses:
        default:
          description: default response
          content:
            text/plain: {}
        '403':
          description: Response was sent via HTTP, please retry using HTTPS
    servers:
    - url: /v1
  /users/auth/mfa/enable:
    post:
      tags:
      - users.auth.mfa
      summary: Generate a secret key and enables it for the user
      operationId: enable
      parameters: []
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              required:
              - email
              - password
              type: object
              properties:
                email:
                  type: string
                password:
                  type: string
      responses:
        default:
          description: default response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MfaEnableResponse'
        '403':
          description: Response was sent via HTTP, please retry using HTTPS
    servers:
    - url: /v1
  /users/auth/mfa/forceDisable:
    post:
      tags:
      - users.auth.mfa
      summary: Removes the MFA provider and secret, disabling MFA login
      description: 'COMPANY_OWNER and COMPANY_ADMIN users only

        Requires the privilege `COMPANY_USERS_WRITE`'
      operationId: forceDisable
      parameters: []
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              required:
              - email
              type: object
              properties:
                email:
                  type: string
      responses:
        default:
          description: default response
          content:
            text/plain: {}
        '403':
          description: 'User requires privilege: COMPANY_USERS_WRITE'
        '401':
          description: Authorization header missing or malformed. Please provide proper credentials in the authorization header.
      security:
      - privilege:
        - COMPANY_USERS_WRITE
    servers:
    - url: /v1
  /users/auth/mfa/info:
    get:
      tags:
      - users.auth.mfa
      summary: Returns the enabled/disabled status and provider if set, of MFA for the user
      description: Requires the privilege `MINIMUM_COMPANY_PRIVILEGES`
      operationId: getInfo
      parameters: []
      responses:
        default:
          description: default response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MfaInfoResponse'
        '403':
          description: 'User requires privilege: MINIMUM_COMPANY_PRIVILEGES'
        '401':
          description: Authorization header missing or malformed. Please provide proper credentials in the authorization header.
      security:
      - privilege:
        - MINIMUM_COMPANY_PRIVILEGES
    servers:
    - url: /v1
  /users/auth/mfa/{email}/enabled:
    get:
      tags:
      - users.auth.mfa
      summary: Returns the enabled/disabled status of MFA for a user
      description: 'Company Owners and Admins users only

        Requires the privilege `SECURITY_REPORTS_READ`'
      operationId: isEnabled
      parameters:
      - name: email
        in: path
        required: true
        schema:
          type: string
      responses:
        default:
          description: default response
          content:
            application/json:
              schema:
                type: boolean
        '403':
          description: 'User requires privilege: SECURITY_REPORTS_READ'
        '401':
          description: Authorization header missing or malformed. Please provide proper credentials in the authorization header.
      security:
      - privilege:
        - SECURITY_REPORTS_READ
    servers:
    - url: /v1
  /users/auth/mfa/validate:
    post:
      tags:
      - users.auth.mfa
      summary: Validate a MFA token for a user
      operationId: validate
      parameters: []
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              required:
              - email
              type: object
              properties:
                email:
                  type: string
                token:
                  maximum: 999999
                  type: integer
                  format: int32
      responses:
        default:
          description: default response
          content:
            text/plain: {}
        '403':
          description: Response was sent via HTTP, please retry using HTTPS
    servers:
    - url: /v1
components:
  schemas:
    MfaInfoResponse:
      type: object
      properties:
        enabled:
          type: string
        provider:
          type: string
    MfaEnableResponse:
      type: object
      properties:
        secretKey:
          type: string
        qrUrl:
          type: string
          format: uri
x-refined-from:
- gremlin-openapi.json
- gremlin-openapi.yml

Gremlin Users.auth.mfa API

Operations 7

Documentation

Specifications

Schemas & Data

Other Resources