Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Read the tenant's sign-in policy (enforce 2FA)
Returns the tenant-wide "Enforce 2FA for all members" setting of the scope's tenant,
backing the org-security toggle. enforceMfa is false when the tenant never set it.
Validation: scopeId must resolve to a scope the caller can reach (unknown → 404
NOT_FOUND); no other inputs.
RBAC: READ on iam plus the iam:read token scope.
Async & state: Synchronous read; no state change.
Errors: 401 unauthenticated; 403 caller lacks iam READ or the token scope; 404 unknown
scopeId; 500 internal failure.
Idempotency/Concurrency: Safe, cacheable; no idempotency key required.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
The tenant's current sign-in policy.
application/json- response
The tenant-wide sign-in policy.
enforceMfa*booleanEvery member of the tenant must complete 2FA to sign in; false when never set.
curl -X GET "https://example.com/scopes/string/iam/auth-policy"{ "enforceMfa": true}