# Retrieve authentication options (/docs/apis/management/options/FindAuthenticationOptions) `GET /options/authentication` Retrieves the current authentication configuration, including enabled authenticators, sign-in and sign-up behavior, and external identity provider settings. Base URL: `https://{tenant}.{region}.monocloud.com/api`, where `{tenant}`, `{region}` (one of us, eu, in) come from your tenant. Authentication: send your Management API key in the `X-API-KEY` header. ## Response body `200`, JSON. The authentication options were retrieved successfully Returns `AuthenticationOptions`. - `pushed_authorization` (PushedAuthorizationOptions, required) Pushed Authorization Request Options - `enable_pushed_authorization_requests` (boolean, required) Specifies whether Pushed Authorization Requests (PAR) are enabled for the tenant. - `require_pushed_authorization_requests` (boolean, required) Specifies whether Pushed Authorization Requests (PAR) are required tenant-wide for all authorization requests. When enabled, this setting overrides any client-specific PAR configuration and enforces PAR usage for all clients within the tenant. - `account_protection` (AccountProtectionOptions, required) Account Protection Options - `user_lockout` (AccountProtectionUserLockoutOptions, required) User account protection settings used to safeguard accounts from abuse. - `enabled` (boolean, required) Enables user lockout protection. - `max_failed_access_attempts` (integer, required, int32) Maximum failed sign-in attempts allowed before lockout (inclusive). - `user_lockout_time_span` (integer, required, int32) User account lockout duration (in minutes). - `ip_lockout_time_span` (integer, required, int32) IP lockout duration (in minutes). - `allowed_ips` (string[], required) Allowlisted IP addresses that are exempt from lockout enforcement. - `lockout_type` (string, required) The lockout enforcement mode (IP-based or user-account-based). One of: `ip`, `user_account`. - `user_unblock` (AccountProtectionUserUnblockOptions, required) The user unblock configuration. - `authenticators` (AuthenticatorOptions, required) Authenticators Options - `external_sign_in_methods_first` (boolean, required) Determines whether external authentication providers are prioritized over other authenticators during sign-in. - `password` (PasswordAuthenticatorOptions, required) Password authenticator configuration. - `enable_sign_in` (boolean, required) Specifies whether users can sign in using password-based authentication. - `enable_sign_up` (boolean, required) Specifies whether new users can sign up using password-based authentication. - `prompt_password_on_initial_screen` (boolean, required) Specifies whether the password is collected on the initial sign-in screen alongside the identifier. - `expiry` (integer, int32) Specifies the password expiration interval (in days). When empty, passwords do not expire. - `strength` (PasswordStrengthOptions, required) Password strength policy configuration. - `reuse` (PasswordReuseOptions, required) Password reuse policy configuration. - `passkey` (PasskeyAuthenticatorOptions, required) Passkey authenticator configuration. - `enable_sign_in` (boolean, required) Specifies whether users can sign in using passkeys. - `enable_sign_up` (boolean, required) Specifies whether new users can sign up using passkeys. - `prompt_enrollment` (boolean, required) Specifies whether users should be prompted to enroll a passkey if none exists. - `prompt_device_enrollment` (boolean, required) Specifies whether users should be prompted to enroll a passkey for the current device if no device-specific passkey exists. - `enable_auto_complete` (boolean, required) Specifies whether passkeys can be auto-filled using the identifier field on the sign-in page. - `show_passkey_button` (boolean, required) Specifies whether the “Continue with Passkey” button is shown on the sign-in page. - `email` (EmailAuthenticatorOptions, required) Email authenticator configuration. - `enable_sign_in` (boolean, required) Specifies whether users can sign in using email-based authentication. - `enable_sign_up` (boolean, required) Specifies whether new users can sign up using email-based authentication. - `enable_jit_provisioning` (boolean, required) Specifies whether users can be automatically provisioned on first successful email authentication (Just-In-Time provisioning). - `verification_type` (string, required) Specifies the verification mechanism used for email authentication (link, code, or both). One of: `code`, `link`, `both`. - `allow_cross_browser` (boolean, required) Specifies whether the authentication flow can be resumed in a different browser or device than where it was initiated. - `expiry` (integer, required, int32) Specifies the validity period of the email verification link or code (in seconds). - `code_length` (integer, required, int32) Specifies the number of digits in the email verification code. Only applicable when the verification type includes code-based verification. - `phone` (PhoneAuthenticatorOptions, required) Phone authenticator configuration. - `enable_sign_in` (boolean, required) Specifies whether users can sign in using phone-based authentication. - `enable_sign_up` (boolean, required) Specifies whether new users can sign up using phone-based authentication. - `enable_jit_provisioning` (boolean, required) Specifies whether users can be automatically provisioned on first successful phone authentication (Just-In-Time provisioning). - `expiry` (integer, required, int32) Specifies the validity period of the phone verification code (in seconds). - `code_length` (integer, required, int32) Specifies the number of digits in the phone verification code. - `identifiers` (IdentifierOptions, required) Identifiers Options - `email` (EmailIdentifierOptions, required) Email Identifier Options - `enable_sign_in` (boolean, required) Specifies whether users can sign in using an email address. - `show_at_sign_up` (boolean, required) Specifies whether an email address can be collected during sign-up. - `required_at_sign_up` (boolean, required) Specifies whether an email address is required during sign-up. - `verification` (EmailIdentifierVerificationOptions, required) Email verification configuration applied during sign-up. - `phone` (PhoneIdentifierOptions, required) Phone Identifier Options - `enable_sign_in` (boolean, required) Specifies whether users can sign in using a phone number. - `show_at_sign_up` (boolean, required) Specifies whether a phone number can be collected during sign-up. - `required_at_sign_up` (boolean, required) Specifies whether a phone number is required during sign-up. - `verification` (PhoneIdentifierVerificationOptions, required) Phone verification configuration applied during sign-up. - `username` (UsernameIdentifierOptions, required) Username Identifier Options - `enable_sign_in` (boolean, required) Specifies whether users can sign in using a username. - `show_at_sign_up` (boolean, required) Specifies whether a username can be collected during sign-up. - `required_at_sign_up` (boolean, required) Specifies whether a username is required during sign-up. - `minimum_length` (integer, required, int32) Specifies the minimum length required for the username. - `recovery_methods` (RecoveryMethodsOptions, required) Recovery Methods Options - `email` (RecoveryMethodsEmailOptions, required) Recovery Methods Email Options - `enabled` (boolean, required) Enables account and password recovery using email-based verification. - `verification_type` (string, required) Specifies the verification mechanism used for email password recovery (link, code, or both). One of: `code`, `link`, `both`. - `allow_cross_browser` (boolean, required) Specifies whether the password recovery flow can be resumed in a different browser or device than where it was initiated. - `expiry` (integer, required, int32) Specifies the validity period of the email recovery verification link or code (in seconds). - `code_length` (integer, required, int32) Specifies the number of digits in the email recovery verification code. Only applicable when the verification type includes code-based recovery. - `phone` (RecoveryMethodsPhoneOptions, required) Recovery Methods Phone Options - `enabled` (boolean, required) Enables account and password recovery using a phone-based verification code. - `expiry` (integer, required, int32) Specifies the validity period of the recovery verification code (in seconds). - `code_length` (integer, required, int32) Specifies the number of digits in the recovery verification code. - `session` (SessionOptions, required) Session Options - `persistence_mode` (string, required) Determines whether the user session is persisted across browser restarts, expires on browser close, or is decided by the user. One of: `persistent`, `non_persistent`, `user_selected`. - `expiration_type` (string, required) Determines whether the session expiration is extended on activity (sliding) or expires at a fixed time (absolute). One of: `sliding`, `absolute`. - `sliding_session_lifetime` (integer, required, int32) The session lifetime applied when using sliding expiration (in minutes). Each qualifying user interaction renews the session up to the absolute limit. - `absolute_session_lifetime` (integer, required, int32) The maximum session lifetime after which the session expires regardless of activity or expiration type (in minutes). - `logout` (LogoutOptions, required) Logout Options - `automatic_redirect_after_logout` (boolean, required) Specifies whether the user is automatically redirected to the client’s configured post-logout redirect URL after signing out. - `show_logout_prompt` (boolean, required) Specifies whether the user is prompted for confirmation before signing out. - `sign_up` (SignUpOptions, required) Sign-up Options - `show_terms_and_privacy_policy` (boolean, required) Show Terms and/or Privacy Policy on the sign-up screen. - `require_explicit_user_agreement` (boolean, required) Require the user to explicitly agree to the Terms and/or Privacy Policy. - `privacy_url` (string) The URL of the Privacy Policy shown during sign-up. - `terms_url` (string) The URL of the Terms of Service shown during sign-up. - `allowlist` (SignUpRestrictionsOptions, required) Allowlist of identifiers permitted during sign-up. - `enabled` (boolean, required) Indicates whether the identifier restriction list is active. Pro plan subscription required to use sign-up restrictions. - `identifiers` (string[], required) A set of identifiers (email addresses, phone numbers, or domains) used for sign-up access control. Pro plan subscription required to use sign-up restrictions. - `blocklist` (SignUpRestrictionsOptions, required) Blocklist of identifiers disallowed during sign-up. - `enabled` (boolean, required) Indicates whether the identifier restriction list is active. Pro plan subscription required to use sign-up restrictions. - `identifiers` (string[], required) A set of identifiers (email addresses, phone numbers, or domains) used for sign-up access control. Pro plan subscription required to use sign-up restrictions. ## Errors - `401` Unauthorized - `403` Forbidden - `404` Not Found - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation. - `title` (string, required) A short, human-readable summary of the error. - `status` (integer, required, int32) The HTTP status code associated with this error response. - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics. - `detail` (string) A human-readable explanation specific to this occurrence of the error. - `instance` (string) A URI reference that identifies the specific occurrence of the error. ## Example (MonoCloud .NET SDK) ```csharp using MonoCloud.Management; using MonoCloud.Management.Core.Base; var apiClient = new MonoCloudManagementClient(new MonoCloudConfig("", "[[API-Key]]")); var result = await apiClient.Options.FindAuthenticationOptionsAsync(); ``` ## Example (MonoCloud Javascript SDK) ```javascript import { MonoCloudManagementClient } from '@monocloud/management'; const apiClient = MonoCloudManagementClient.init({ domain: '', apiKey: '[[API-Key]]' }); const result = apiClient.options.findAuthenticationOptions(); ```