Auth0 API | Attack Protection › Brute Force Protection

Attack Protection

attack_protection

Attack Protection

Breached Password Detection

attack_protection.breached_password_detection

Methods

Get Breached Password Detection Settings ->

BreachedPasswordDetectionSettings

get/attack-protection/breached-password-detection

Retrieve details of the Breached Password Detection configuration of your tenant.

Update Breached Password Detection Settings -> { admin_notification_frequency, enabled, method, 2 more... }

patch/attack-protection/breached-password-detection

Update details of the Breached Password Detection configuration of your tenant.

Domain types

BreachedPasswordDetectionSettings = { admin_notification_frequency, enabled, method, 2 more... }

Attack Protection

Brute Force Protection

attack_protection.brute_force_protection

Methods

Get Brute Force Settings ->

BruteForceProtectionSettings

get/attack-protection/brute-force-protection

Retrieve details of the Brute-force Protection configuration of your tenant.

Update Brute Force Settings -> { allowlist, enabled, max_attempts, 2 more... }

patch/attack-protection/brute-force-protection

Update the Brute-force Protection configuration of your tenant.

Security

Example: Authorization: Bearer My Bearer Token

Response fields

allowlist: Array<string>

Optional

List of trusted IP addresses that will not have attack protection enforced against them.

enabled: boolean

Optional

Whether or not brute force attack protections are active.

max_attempts: number

Optional

Maximum number of unsuccessful attempts.

mode: "count_per_identifier_and_ip" | "count_per_identifier"

Optional

Account Lockout: Determines whether or not IP address is used when counting failed attempts. Possible values: count_per_identifier_and_ip, count_per_identifier.

shields: Array<"block" | "user_notification">

Optional

Action to take when a brute force protection threshold is violated. Possible values: block, user_notification.

Request example

curl https://login0.local.dev.auth0.com/api/v2/attack-protection/brute-force-protection \
    -X PATCH \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer $BEARER_TOKEN"

200Example

{
  "allowlist": [
    "string"
  ],
  "enabled": true,
  "max_attempts": 0,
  "mode": "count_per_identifier_and_ip",
  "shields": [
    "block"
  ]
}

Domain types

BruteForceProtectionSettings = { allowlist, enabled, max_attempts, 2 more... }

Attack Protection

Suspicious IP Throttling

attack_protection.suspicious_ip_throttling

Methods

Get Suspicious IP Throttling Settings ->

SuspiciousIPThrottlingSettings

get/attack-protection/suspicious-ip-throttling

Retrieve details of the Suspicious IP Throttling configuration of your tenant.

Update Suspicious IP Throttling Settings -> { allowlist, enabled, shields, 1 more... }

patch/attack-protection/suspicious-ip-throttling

Update the details of the Suspicious IP Throttling configuration of your tenant.

Domain types

SuspiciousIPThrottlingSettings = { allowlist, enabled, shields, 1 more... }