GET

List Authentication Factors

Use this API to return the list of MFA factor types configured on your account (the same factors an admin sees and manages under Settings > Authentication Factors in the OneLogin admin portal).

This is not the same as a user’s enrolled/available factors

This endpoint returns the account-level catalog of configured MFA factor types (for example, that SMS and Google Authenticator have been set up for the account). It does not return which factors a specific user has enrolled in. For that, see Get Enrolled Factors or Get Available Factors.

Resource URL

https://<subdomain>.onelogin.com/api/2/authentication_factors

Header Parameters

Authorization

required

string

Set to bearer <access_token>.

Set <access_token> to the access token you generated using the Generate Token API.

The access token must have been generated using an API credential pair created with read (or write) access to the Authentication Factors resource.

Query Parameters

None. This endpoint does not support filtering, sorting, or pagination — it always returns the full list of factors configured on the account.

Sample Responses

  • 200 OK
  • 401 Unauthorized

Returns an array of the account’s configured factors. Returns an empty array [] if no factors are configured.

[
  {
      "id": 4421,
      "name": "Google Authenticator",
      "type": "Google Authenticator"
  },
  {
      "id": 4422,
      "name": "Company SMS",
      "type": "SMS"
  }
]

id is the OneLogin ID for this account’s configured instance of the factor. name is the admin-configured display description for the factor (defaults to the factor type’s name if the admin has not customized it). type is the underlying OTP type name (for example SMS, Google Authenticator, Yubikey, OneLogin Protect, DuoSecurity, WebAuthn, Security Questions) as configured in Settings > Authentication Factors.

Typically, this error means that your access token value is invalid.

{
    "message": "Unauthorized",
    "statusCode": 401,
    "name": "UnauthorizedError"
}

Postman Collection

Replace sample variables indicated by < > in the sample request body with your actual values. Also, be sure to set Postman-specific environment variables indicated by {{ }}.

Run In Postman

    Clicking Run in Postman button navigates to the page where you can fork the collection to your workspace. Forking the collection into your workspace will enable you to contribute to the source collection using pull requests. You can also view the collection in a public workspace if you like and even import a copy of the collection using the links present on the screen.

Sample Code

cURL

Replace sample values indicated by < > with your actual values.

List Authentication Factors

curl 'https://<subdomain>.onelogin.com/api/2/authentication_factors' \
-X GET \
-H "Authorization: bearer <access_token>"