Policy Resource

The Policy resource represents a Security Policy, which can apply to users (kind: user) or apps (kind: app). kind is set at creation time and cannot be changed afterward.

Core Attributes

AttributeTypeDescription
idIntegerPolicy ID.
nameStringPolicy name.
kindStringuser or app. Immutable after create.
is_defaultBooleanComputed: true if this policy's ID matches the account's default policy ID. Only a user-kind policy can be default.

Password Attributes

AttributeTypeDescription
minimum_password_lengthIntegerMinimum password length. Allowed values: 5, 6, 8, 10, 12, 16.
password_complexity_requirementsInteger (enum)Complexity requirement level: 0 = none, 1 = letters+digits, 2 = mixed-case+digits, 3 = +special character, 4 = three-of-four character classes.
passwords_rememberedIntegerNumber of prior passwords disallowed for reuse. Allowed values: 0, 3, 5.
password_expiration_daysIntegerDays until password expires (0 = never).

There is no dedicated “include username in password” or “confirm password change” attribute on the Policy resource. The closest related settings are dynamic_blacklist_attributes and enforce_account_password_blacklist.

Invite Expiration Attributes

AttributeTypeDescription
invite_expiration_time_valueIntegerLength of the invite expiration window. Default: 24.
invite_expiration_time_unitInteger (enum)Unit for the invite expiration window: 0 = Minutes, 1 = Hours. Default: 1.

Lockout Attributes

AttributeTypeDescription
maximum_invalid_login_attemptsIntegerNumber of failed logins before lockout. Range 3–10, or 0 = no limit.
lock_effective_minutesInteger (enum)Lockout duration in minutes: 15, 30, 60, or 0.

There is no separate “failed attempts period” or “lockout notify” attribute on the Policy resource.

Session Attributes

AttributeTypeDescription
session_timeout_minutesIntegerIdle session timeout in minutes.
session_timeout_by_fixed_time_valueIntegerFixed maximum session duration value, paired with session_timeout_by_fixed_time_unit.
session_timeout_by_fixed_time_unitInteger (enum)Unit for session_timeout_by_fixed_time_value: 0 = Minutes, 1 = Hours.

There is no “prevent concurrent sessions” attribute. A related but distinct concept, persistent_session_enabled, exists but does not control concurrency.

MFA Attributes

AttributeTypeDescription
authentication_factor_idsArray<Integer>Enabled MFA factor IDs. Full-replace on update; send [] to clear.
reset_password_authentication_factor_idsArray<Integer>MFA factor IDs allowed for password reset. Full-replace on update.
mfa_registration_enabledBooleanWhether MFA registration is enabled.
voluntary_mfa_registration_enabledBooleanWhether users may voluntarily register MFA factors.

There is no single “MFA enrollment period” attribute; MFA registration is controlled by the two boolean flags above.

IP Restriction Attributes

AttributeTypeDescription
ip_addr_restrictionTextAllowed IP ranges. This is free-form text, not a JSON array.
ignore_xffBooleanWhether to ignore the X-Forwarded-For header when evaluating IP restriction.

Device Trust Attributes

AttributeTypeDescription
browser_cert_requiredBooleanRequire a browser certificate for device trust.
self_install_certBooleanAllow self-installed certificates.
third_party_device_trustBooleanAllow third-party device trust providers.
gdt_requiredBooleanRequire Global Device Trust.
trusted_device_login_enabledBooleanEnable trusted-device login.
trusted_device_login_mfa_allowedBooleanAllow MFA bypass on trusted-device login.
browser_pki_expirationIntegerDays until the browser PKI/device certificate expires (also governs "remember device" duration).

Device trust is not a single boolean; it is controlled by the combination of fields above.

Portal Attributes

AttributeTypeDescription
new_portal_settingStringrequired, allowed, or forbidden.
allow_add_company_appBooleanAllow users to add company apps from the portal.
allow_add_personal_appBooleanAllow users to add personal apps from the portal.
enable_browser_extensionsBooleanEnable browser extension support.
disable_browser_password_managerBooleanDisable the browser's native password manager.
enable_email_hintBooleanShow an email hint on the login page.

There is no single “show all apps in portal” attribute.

Social Sign-In Attributes

AttributeTypeDescription
social_sign_inBooleanMaster switch for social identity provider sign-in.
googleBooleanEnable Google sign-in.
facebookBooleanEnable Facebook sign-in.
linkedinBooleanEnable LinkedIn sign-in.
twitterBooleanEnable Twitter sign-in.

Advanced / Risk Attributes

AttributeTypeDescription
euba_enabledBooleanEnable entity/user behavior analytics-based risk checks.
euba_risk_thresholdIntegerRisk threshold for EUBA-based challenges.
enable_smart_accessBooleanEnable Smart Access risk-based authentication.
smart_access_risk_thresholdIntegerRisk threshold for Smart Access challenges.

There is no single “risk_based_auth_enabled” attribute; risk-based auth is split between the EUBA and Smart Access field groups above.

App Policy Settings (kind: app only)

AttributeTypeDescription
force_authnBooleanForce re-authentication for this app.
app_otp_offset_enabledBooleanEnable an OTP offset window for this app.
app_otp_offsetIntegerOTP offset value, when enabled.
app_force_authn_offsetIntegerForce-authentication offset for this app.

There is no single “app_session_timeout” attribute.

Secure Areas / Step-Up Attributes

AttributeTypeDescription
admin_policy_idIntegerID of an app-kind policy on the same account, applied as a step-up policy for admin/secure areas. 422 if it references a policy of a different kind or a different account.
profile_policy_idIntegerID of an app-kind policy on the same account, applied as a step-up policy for profile/secure areas. Same validation as admin_policy_id.
secure_area_otp_timeout_minutesIntegerOTP timeout, in minutes, for secure area step-up challenges.

Terms & Conditions Attributes

AttributeTypeDescription
terms_and_conditionsObjectAn object of shape { "enabled": Boolean, "content": String }, not a single boolean.