Merge branch 'develop' of github.com:FusionAuth/fusionauth-openapi into lyle/ENG-3375/introspect-and-libs

Author: lyleschemmerling

openapi.yaml

@@ -1332,6 +1332,27 @@ components:
       - ACTIVE
       - PENDING
       - REJECTED
+    Context:
+      description: Represents the inbound lambda parameter 'context' for MFA Required
+        lambdas.
+      type: object
+      properties:
+        accessToken:
+          type: string
+        action:
+          "$ref": "#/components/schemas/MultiFactorAction"
+        application:
+          "$ref": "#/components/schemas/Application"
+        authenticationThreats:
+          type: array
+          uniqueItems: true
+          items: {}
+        eventInfo:
+          "$ref": "#/components/schemas/EventInfo"
+        mfaTrust:
+          "$ref": "#/components/schemas/Trust"
+        policies:
+          "$ref": "#/components/schemas/Policies"
     CoseAlgorithmIdentifier:
       description: A number identifying a cryptographic algorithm. Values should be
         registered with the <a  href="https:www.iana.orgassignmentscosecose.xhtml#algorithms">IANA
@@ -2322,6 +2343,13 @@ components:
       - Test
       - UserIdentityVerified
       - UserIdentityUpdate
+    ExistingUserStrategy:
+      description: Represent the various statesexpectations of a user in the context
+        of starting verification
+      type: string
+      enum:
+      - mustExist
+      - mustNotExist
     ExpandableRequest:
       description: An expandable API request.
       type: object
@@ -2843,6 +2871,16 @@ components:
           items:
             type: string
             format: uuid
+        type:
+          "$ref": "#/components/schemas/FormStepType"
+    FormStepType:
+      description: Denotes the type of form step. This is used to configure different
+        behavior on form steps in the registration flow.
+      type: string
+      enum:
+      - collectData
+      - verifyEmail
+      - verifyPhoneNumber
     FormType:
       description: ''
       type: string
@@ -4327,6 +4365,9 @@ components:
         idTokenPopulateId:
           type: string
           format: uuid
+        multiFactorRequirementId:
+          type: string
+          format: uuid
         samlv2PopulateId:
           type: string
           format: uuid
@@ -4421,6 +4462,7 @@ components:
       - SelfServiceRegistrationValidation
       - UserInfoPopulate
       - LoginValidation
+      - MFARequirement
     LinkedInApplicationConfiguration:
       description: ''
       type: object
@@ -4918,6 +4960,14 @@ components:
         total:
           type: integer
           format: int64
+    MultiFactorAction:
+      description: Communicate various actionscontexts in which multi-factor authentication
+        can be used.
+      type: string
+      enum:
+      - changePassword
+      - login
+      - stepUp
     MultiFactorAuthenticatorMethod:
       type: object
       properties:
@@ -5611,6 +5661,17 @@ components:
           type: boolean
         behavior:
           "$ref": "#/components/schemas/UnverifiedBehavior"
+    Policies:
+      description: Represents the inbound lambda parameter 'policies' for MFA Required
+        lambdas.
+      type: object
+      properties:
+        applicationLoginPolicy:
+          "$ref": "#/components/schemas/MultiFactorLoginPolicy"
+        applicationMultiFactorTrustPolicy:
+          "$ref": "#/components/schemas/ApplicationMultiFactorTrustPolicy"
+        tenantLoginPolicy:
+          "$ref": "#/components/schemas/MultiFactorLoginPolicy"
     PreviewMessageTemplateRequest:
       description: ''
       type: object
@@ -5875,6 +5936,8 @@ components:
             type: string
         licensed:
           type: boolean
+        multiFactorLambdas:
+          "$ref": "#/components/schemas/ReactorFeatureStatus"
         scimServer:
           "$ref": "#/components/schemas/ReactorFeatureStatus"
         tenantManagerApplication:
@@ -6098,6 +6161,10 @@ components:
           type: boolean
         user:
           "$ref": "#/components/schemas/User"
+        verificationIds:
+          type: array
+          items:
+            type: string
         eventInfo:
           "$ref": "#/components/schemas/EventInfo"
     RegistrationResponse:
@@ -6121,6 +6188,10 @@ components:
           "$ref": "#/components/schemas/ZonedDateTime"
         user:
           "$ref": "#/components/schemas/User"
+        verificationIds:
+          type: array
+          items:
+            "$ref": "#/components/schemas/VerificationId"
     RegistrationType:
       type: string
       enum:
@@ -6164,6 +6235,15 @@ components:
           type: boolean
         enabled:
           type: boolean
+    RequiredLambdaResult:
+      description: Represents the inbound lambda parameter 'result' for MFA Required
+        lambdas.
+      type: object
+      properties:
+        required:
+          type: boolean
+        sendSuspiciousLoginEvent:
+          type: boolean
     RequiresCORSConfiguration:
       description: Interface describing the need for CORS configuration.
       type: object
@@ -6784,6 +6864,15 @@ components:
           type: string
         order:
           "$ref": "#/components/schemas/Sort"
+    StartInstant:
+      type: object
+      properties:
+        applications:
+          type: object
+          additionalProperties:
+            "$ref": "#/components/schemas/ZonedDateTime"
+        tenant:
+          "$ref": "#/components/schemas/ZonedDateTime"
     StatusResponse:
       description: The public Status API response
       type: object
@@ -7178,6 +7267,9 @@ components:
         loginValidationId:
           type: string
           format: uuid
+        multiFactorRequirementId:
+          type: string
+          format: uuid
         scimEnterpriseUserRequestConverterId:
           type: string
           format: uuid
@@ -7593,6 +7685,36 @@ components:
       - SimpleMajority
       - SuperMajority
       - AbsoluteMajority
+    Trust:
+      description: Represents the inbound lambda parameter 'mfaTrust' inside the 'context'
+        parameter for MFA Required lambdas.
+      type: object
+      properties:
+        applicationId:
+          type: string
+          format: uuid
+        attributes:
+          type: object
+          additionalProperties:
+            type: string
+        expirationInstant:
+          "$ref": "#/components/schemas/ZonedDateTime"
+        id:
+          type: string
+        insertInstant:
+          "$ref": "#/components/schemas/ZonedDateTime"
+        startInstants:
+          "$ref": "#/components/schemas/StartInstant"
+        state:
+          type: object
+          additionalProperties:
+            type: object
+        tenantId:
+          type: string
+          format: uuid
+        userId:
+          type: string
+          format: uuid
     TwilioMessengerConfiguration:
       description: ''
       type: object
@@ -7911,6 +8033,25 @@ components:
             "$ref": "#/components/schemas/TwoFactorMethod"
         twoFactorId:
           type: string
+    TwoFactorStatusRequest:
+      description: Check the status of two-factor authentication for a user, with
+        more options than on a GET request.
+      type: object
+      properties:
+        userId:
+          type: string
+          format: uuid
+        accessToken:
+          type: string
+        action:
+          "$ref": "#/components/schemas/MultiFactorAction"
+        applicationId:
+          type: string
+          format: uuid
+        twoFactorTrustId:
+          type: string
+        eventInfo:
+          "$ref": "#/components/schemas/EventInfo"
     TwoFactorStatusResponse:
       description: ''
       type: object
@@ -9183,6 +9324,8 @@ components:
         applicationId:
           type: string
           format: uuid
+        existingUserStrategy:
+          "$ref": "#/components/schemas/ExistingUserStrategy"
         loginId:
           type: string
         loginIdType:
@@ -15814,6 +15957,32 @@ paths:
             application/json:
               schema:
                 "$ref": "#/components/schemas/Errors"
+  "/api/two-factor/status":
+    post:
+      description: Retrieve a user's two-factor status.  This can be used to see if
+        a user will need to complete a two-factor challenge to complete a login, and
+        optionally identify the state of the two-factor trust across various applications.
+        This operation provides more payload options than retrieveTwoFactorStatus.
+      operationId: retrieveTwoFactorStatusWithRequestWithId
+      parameters: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              "$ref": "#/components/schemas/TwoFactorStatusRequest"
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/TwoFactorStatusResponse"
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/Errors"
   "/api/two-factor/status/{twoFactorTrustId}":
     get:
       description: Retrieve a user's two-factor status.  This can be used to see if
@@ -16590,12 +16759,30 @@ paths:
         completing a Two-Factor Step-Up authentication.  An HTTP status code of 400
         with a general error code of [TrustTokenRequired] indicates that a Trust Token
         is required to make a POST request to this API. OR Check to see if the user
-        must obtain a Trust Token Id in order to complete a change password request.
+        must obtain a Trust Request Id in order to complete a change password request.
         When a user has enabled Two-Factor authentication, before you are allowed
         to use the Change Password API to change your password, you must obtain a
-        Trust Token by completing a Two-Factor Step-Up authentication.  An HTTP status
-        code of 400 with a general error code of [TrustTokenRequired] indicates that
-        a Trust Token is required to make a POST request to this API.
+        Trust Request Id by completing a Two-Factor Step-Up authentication.  An HTTP
+        status code of 400 with a general error code of [TrustTokenRequired] indicates
+        that a Trust Token is required to make a POST request to this API. OR Check
+        to see if the user must obtain a Trust Request Id in order to complete a change
+        password request. When a user has enabled Two-Factor authentication, before
+        you are allowed to use the Change Password API to change your password, you
+        must obtain a Trust Request Id by completing a Two-Factor Step-Up authentication.  An
+        HTTP status code of 400 with a general error code of [TrustTokenRequired]
+        indicates that a Trust Token is required to make a POST request to this API.
+        OR Check to see if the user must obtain a Trust Token Id in order to complete
+        a change password request. When a user has enabled Two-Factor authentication,
+        before you are allowed to use the Change Password API to change your password,
+        you must obtain a Trust Token by completing a Two-Factor Step-Up authentication.  An
+        HTTP status code of 400 with a general error code of [TrustTokenRequired]
+        indicates that a Trust Token is required to make a POST request to this API.
+        OR Check to see if the user must obtain a Trust Token Id in order to complete
+        a change password request. When a user has enabled Two-Factor authentication,
+        before you are allowed to use the Change Password API to change your password,
+        you must obtain a Trust Token by completing a Two-Factor Step-Up authentication.  An
+        HTTP status code of 400 with a general error code of [TrustTokenRequired]
+        indicates that a Trust Token is required to make a POST request to this API.
       operationId: retrieveUserChangePassword
       parameters:
       - name: loginId
@@ -16611,6 +16798,12 @@ paths:
           items:
             type: string
         description: The identity types that FusionAuth will compare the loginId to.
+      - name: ipAddress
+        in: query
+        schema:
+          type: string
+        description: IP address of the user changing their password. This is used
+          for MFA risk assessment.
       responses:
         '200':
           description: Success
@@ -16661,8 +16854,20 @@ paths:
         your password, you must obtain a Trust Token by completing a Two-Factor Step-Up
         authentication.  An HTTP status code of 400 with a general error code of [TrustTokenRequired]
         indicates that a Trust Token is required to make a POST request to this API.
-      operationId: checkChangePasswordUsingIdWithId
+        OR Check to see if the user must obtain a Trust Token Id in order to complete
+        a change password request. When a user has enabled Two-Factor authentication,
+        before you are allowed to use the Change Password API to change your password,
+        you must obtain a Trust Token by completing a Two-Factor Step-Up authentication.  An
+        HTTP status code of 400 with a general error code of [TrustTokenRequired]
+        indicates that a Trust Token is required to make a POST request to this API.
+      operationId: retrieveUserChangePasswordWithId
       parameters:
+      - name: ipAddress
+        in: query
+        schema:
+          type: string
+        description: IP address of the user changing their password. This is used
+          for MFA risk assessment.
       - name: changePasswordId
         in: path
         schema: