Create FIDO Policy - specific authenticators
POST {{apiPath}}/environments/{{envID}}/fido2Policies/
Use POST {{apiPath}}/environments/{{envID}}/fido2Policies/ to create a new FIDO policy for an environment.
This example limits authentication to a specific list of authenticators by setting attestationRequirements to SPECIFIC and providing a list of authenticator IDs in the allowedAuthenticators array.
Prerequisites
- See FIDO Policies for important overview information.
| Property | Type | Required? |
|---|---|---|
allowedAuthenticators | Array | Optional |
attestationRequirements | String | Required |
default | Boolean | Optional |
description | String | Optional |
enforceDuringAuthentication | Boolean | Optional |
name | String | Required |
residentKeyRequirement | String | Required |
See the FIDO Policies data model for full property descriptions.
Request Body
{"name"=>"FIDO Policy - specific authenticators", "description"=>"FIDO Policy that specifies two authenticators that can be used", "deviceDisplayName"=>"Fido2 device B", "discoverableCredentials"=>"REQUIRED", "authenticatorAttachment"=>"BOTH", "userVerification"=>{"enforceDuringAuthentication"=>true, "option"=>"REQUIRED"}, "backupEligibility"=>{"enforceDuringAuthentication"=>true, "allow"=>true}, "userDisplayNameAttributes"=>{"attributes"=>[{"name"=>"username"}, {"name"=>"email"}]}, "attestationRequirements"=>"DIRECT", "mdsAuthenticatorsRequirements"=>{"option"=>"SPECIFIC", "allowedAuthenticators"=>[{"id"=>"{{allowedAuthenticatorID}}"}, {"id"=>"{{allowedAuthenticatorID_2}}"}], "enforceDuringAuthentication"=>true}, "relyingPartyId"=>"relyingpartydomain.example.com", "default"=>false}
RESPONSES
status: Created
{"_links":{"self":{"href":"https://api.pingone.eu/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/fido2Policies/4a3dcf3b-b079-42d5-8e90-529205ce0b75"},"environment":{"href":"https://api.pingone.eu/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"}},"id":"4a3dcf3b-b079-42d5-8e90-529205ce0b75","environment":{"id":"abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"},"updatedAt":"2023-06-05T12:43:50.905Z","createdAt":"2023-06-05T12:43:50.905Z","name":"FIDO Policy - specific authenticators","description":"FIDO Policy that specifies two authenticators that can be used","deviceDisplayName":"Fido2 device B","discoverableCredentials":"REQUIRED","authenticatorAttachment":"BOTH","userVerification":{"enforceDuringAuthentication":true,"option":"REQUIRED"},"backupEligibility":{"enforceDuringAuthentication":true,"allow":true},"userDisplayNameAttributes":{"attributes":[{"name":"username"},{"name":"email"}]},"attestationRequirements":"DIRECT","mdsAuthenticatorsRequirements":{"enforceDuringAuthentication":true,"option":"SPECIFIC","allowedAuthenticators":[{"id":"be42c14ed8d123f6c4534a64e7ffdeb371400278"},{"id":"6b3c8eb5095216e6753549ace2e0941d8758031e"}]},"relyingPartyId":"relyingpartydomain.example.com","default":false}