Identity and sessions

API reference descriptions are provided in English to preserve the exact published contract.

GETGet organization authentication policyidentity.authPolicy.list
PUTReplace organization authentication policyidentity.authPolicy.update
GETList the signed-in user's MFA credentialsidentity.mfa.credentials.list
DELETERevoke one MFA credentialidentity.mfa.credentials.delete
GETList admitted MFA methods for the signed-in memberidentity.mfa.enrollmentOptions.list
POSTStart WebAuthn or TOTP enrollmentidentity.mfa.enrollments
POSTComplete WebAuthn or TOTP enrollmentidentity.mfa.enrollments.complete
POSTReplace recovery codes and return the new codes onceidentity.mfa.recoveryCodes.rotate
POSTList the signed-in user's factors and start a WebAuthn step-up ceremonyidentity.mfa.verificationOptions
GETList organization identity providersidentity.providers.list
POSTStage an identity provider configurationidentity.providers.create
POSTVerify and activate an identity provideridentity.providers.activate
POSTIssue or rotate the SCIM bearer tokenidentity.providers.scimToken
POSTRevoke the SCIM bearer tokenidentity.providers.scimToken.revoke
POSTSuspend an identity provideridentity.providers.suspend
POSTExchange verified MFA or a one-use recovery code for a step-up tokenidentity.stepUp
POSTReset all MFA factors for a useridentity.users.mfa.reset
POSTRevoke every active browser session for a useridentity.users.sessions.revokeAll
GETList active role bindings in the account scoperoleBindings.list
POSTCreate an immutable role bindingroleBindings.create
DELETERevoke an immutable role bindingroleBindings.delete
GETList authoritative customer roles and permissionsroles.list
GETDiscover the API key's account and regionme.list

Get organization authentication policy

GET/v1/accounts/{AC}/identity/auth-policy

identity.authPolicy.listSDK operation getV1AccountsByAcIdentityAuthPolicy

Required scope: any one of roles:write, audit:read.

GET /v1/accounts/{AC}/identity/auth-policy

curl "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/auth-policy" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21"

Responses

Replace organization authentication policy

PUT/v1/accounts/{AC}/identity/auth-policy

identity.authPolicy.updateSDK operation putV1AccountsByAcIdentityAuthPolicy

Required scope: roles:write.Idempotency-Key required

Request body

autoDisableInactiveApiKeysbooleanRequired
expectedVersioninteger (1–)Required
mfaRequiredForAllRolesbooleanRequired
passwordLoginEnabledbooleanRequired
recoveryRevokesMfabooleanRequired
sessionAbsoluteTimeoutHoursinteger (1–2160)Required
sessionIdleTimeoutMinutesinteger (15–1440)Required
ssoEnforcedbooleanRequired
stepUpTokenstring (max 256 chars)Required

PUT /v1/accounts/{AC}/identity/auth-policy

curl -X PUT "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/auth-policy" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "autoDisableInactiveApiKeys": true,
  "expectedVersion": 1,
  "mfaRequiredForAllRoles": true,
  "passwordLoginEnabled": true,
  "recoveryRevokesMfa": true,
  "sessionAbsoluteTimeoutHours": 1,
  "sessionIdleTimeoutMinutes": 15,
  "ssoEnforced": true,
  "stepUpToken": "string"
}'

Responses

List the signed-in user's MFA credentials

GET/v1/accounts/{AC}/identity/mfa/credentials

identity.mfa.credentials.listSDK operation getV1AccountsByAcIdentityMfaCredentials

Required scope: api:access.Paginated

Parameters

limitinteger (1–100)query
cursorstring (max 2048 chars)query

GET /v1/accounts/{AC}/identity/mfa/credentials

curl "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/mfa/credentials" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21"

Responses

Revoke one MFA credential

DELETE/v1/accounts/{AC}/identity/mfa/credentials/{credentialId}

identity.mfa.credentials.deleteSDK operation deleteV1AccountsByAcIdentityMfaCredentialsByCredentialid

Required scope: api:access.

Parameters

credentialIdstring (uuid)Required

Request body

stepUpTokenstring (max 256 chars)Required

DELETE /v1/accounts/{AC}/identity/mfa/credentials/{credentialId}

curl -X DELETE "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/mfa/credentials/credentialId..." \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Content-Type: application/json" \
  -d '{
  "stepUpToken": "string"
}'

Responses

List admitted MFA methods for the signed-in member

GET/v1/accounts/{AC}/identity/mfa/enrollment-options

identity.mfa.enrollmentOptions.listSDK operation getV1AccountsByAcIdentityMfaEnrollmentOptions

Required scope: api:access.

Parameters

providerKeystring (pattern ^[a-z0-9][a-z0-9_-]*$, max 64 chars)queryRequired

GET /v1/accounts/{AC}/identity/mfa/enrollment-options

curl "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/mfa/enrollment-options?providerKey=string" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21"

Responses

Start WebAuthn or TOTP enrollment

POST/v1/accounts/{AC}/identity/mfa/enrollments

identity.mfa.enrollmentsSDK operation postV1AccountsByAcIdentityMfaEnrollments

Required scope: api:access.Idempotency-Key required

Request body

methodenumRequired
WEBAUTHNTOTP
providerKeystring (pattern ^[a-z0-9][a-z0-9_-]*$, max 64 chars)Required
displayNamestring (max 128 chars)

POST /v1/accounts/{AC}/identity/mfa/enrollments

curl -X POST "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/mfa/enrollments" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "method": "WEBAUTHN",
  "providerKey": "string"
}'

Responses

Complete WebAuthn or TOTP enrollment

POST/v1/accounts/{AC}/identity/mfa/enrollments/{enrollmentId}/complete

identity.mfa.enrollments.completeSDK operation postV1AccountsByAcIdentityMfaEnrollmentsByEnrollmentidComplete

Required scope: api:access.Idempotency-Key required

Parameters

enrollmentIdstring (uuid)Required

Request body

ceremonyRefstring (max 1024 chars)Required
responsestring (max 32768 chars)Required

POST /v1/accounts/{AC}/identity/mfa/enrollments/{enrollmentId}/complete

curl -X POST "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/mfa/enrollments/enrollmentId.../complete" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "ceremonyRef": "string",
  "response": "string"
}'

Responses

Replace recovery codes and return the new codes once

POST/v1/accounts/{AC}/identity/mfa/recovery-codes/rotate

identity.mfa.recoveryCodes.rotateSDK operation postV1AccountsByAcIdentityMfaRecoveryCodesRotate

Required scope: api:access.Idempotency-Key required

Request body

stepUpTokenstring (max 256 chars)Required

POST /v1/accounts/{AC}/identity/mfa/recovery-codes/rotate

curl -X POST "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/mfa/recovery-codes/rotate" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "stepUpToken": "string"
}'

Responses

List the signed-in user's factors and start a WebAuthn step-up ceremony

POST/v1/accounts/{AC}/identity/mfa/verification-options

identity.mfa.verificationOptionsSDK operation postV1AccountsByAcIdentityMfaVerificationOptions

Required scope: api:access.Idempotency-Key required

Request body

actionstring (max 256 chars)Required

POST /v1/accounts/{AC}/identity/mfa/verification-options

curl -X POST "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/mfa/verification-options" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "action": "string"
}'

Responses

List organization identity providers

GET/v1/accounts/{AC}/identity/providers

identity.providers.listSDK operation getV1AccountsByAcIdentityProviders

Required scope: api:access.Paginated

Parameters

limitinteger (1–100)query
cursorstring (max 2048 chars)query

GET /v1/accounts/{AC}/identity/providers

curl "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/providers" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21"

Responses

Stage an identity provider configuration

POST/v1/accounts/{AC}/identity/providers

identity.providers.createSDK operation postV1AccountsByAcIdentityProviders

Required scope: roles:write.Idempotency-Key required

Request body

protocolenumRequired
OIDCSAMLSCIMWEBAUTHNTOTP
providerKeystring (pattern ^[a-z0-9][a-z0-9_-]*$, max 64 chars)Required
publicConfigobjectRequired
reasonstring (max 2000 chars)Required
stepUpTokenstring (max 256 chars)Required
credentialRefstring (max 512 chars)

POST /v1/accounts/{AC}/identity/providers

curl -X POST "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/providers" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "protocol": "OIDC",
  "providerKey": "string",
  "publicConfig": {},
  "reason": "string",
  "stepUpToken": "string"
}'

Responses

Verify and activate an identity provider

POST/v1/accounts/{AC}/identity/providers/{providerId}/activate

identity.providers.activateSDK operation postV1AccountsByAcIdentityProvidersByProvideridActivate

Required scope: roles:write.Idempotency-Key required

Parameters

providerIdstring (uuid)Required

Request body

reasonstring (max 2000 chars)Required
stepUpTokenstring (max 256 chars)Required

POST /v1/accounts/{AC}/identity/providers/{providerId}/activate

curl -X POST "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/providers/providerId.../activate" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "reason": "string",
  "stepUpToken": "string"
}'

Responses

Issue or rotate the SCIM bearer token

POST/v1/accounts/{AC}/identity/providers/{providerId}/scim-token

identity.providers.scimTokenSDK operation postV1AccountsByAcIdentityProvidersByProvideridScimToken

Issues the bearer token a directory uses to call this SCIM provider's endpoint. The token is returned once and only its SHA-256 is stored; issuing again rotates it, revoking the previous token immediately. Requires an IDENTITY_PROVIDER_CHANGE step-up grant.

Required scope: roles:write.Idempotency-Key required

Parameters

providerIdstring (uuid)Required

Request body

reasonstring (max 2000 chars)Required
stepUpTokenstring (max 256 chars)Required

POST /v1/accounts/{AC}/identity/providers/{providerId}/scim-token

curl -X POST "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/providers/providerId.../scim-token" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "reason": "string",
  "stepUpToken": "string"
}'

Responses

Revoke the SCIM bearer token

POST/v1/accounts/{AC}/identity/providers/{providerId}/scim-token/revoke

identity.providers.scimToken.revokeSDK operation postV1AccountsByAcIdentityProvidersByProvideridScimTokenRevoke

Revokes the provider's live SCIM bearer token; directory requests fail at once. Requires an IDENTITY_PROVIDER_CHANGE step-up grant.

Required scope: roles:write.Idempotency-Key required

Parameters

providerIdstring (uuid)Required

Request body

reasonstring (max 2000 chars)Required
stepUpTokenstring (max 256 chars)Required

POST /v1/accounts/{AC}/identity/providers/{providerId}/scim-token/revoke

curl -X POST "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/providers/providerId.../scim-token/revoke" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "reason": "string",
  "stepUpToken": "string"
}'

Responses

Suspend an identity provider

POST/v1/accounts/{AC}/identity/providers/{providerId}/suspend

identity.providers.suspendSDK operation postV1AccountsByAcIdentityProvidersByProvideridSuspend

Deprovisioning: the provider stops backing sign-in, MFA or SCIM at once, every browser session it authenticated is revoked, and it can be re-verified and activated later.

Required scope: roles:write.Idempotency-Key required

Parameters

providerIdstring (uuid)Required

Request body

reasonstring (max 2000 chars)Required
stepUpTokenstring (max 256 chars)Required

POST /v1/accounts/{AC}/identity/providers/{providerId}/suspend

curl -X POST "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/providers/providerId.../suspend" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "reason": "string",
  "stepUpToken": "string"
}'

Responses

Exchange verified MFA or a one-use recovery code for a step-up token

POST/v1/accounts/{AC}/identity/step-up

identity.stepUpSDK operation postV1AccountsByAcIdentityStepUp

Required scope: api:access.Idempotency-Key required Paginated

Parameters

limitinteger (1–100)query
cursorstring (max 2048 chars)query

Request body

actionstring (max 256 chars)Required
The action the grant is for, exactly as a STEP_UP_REQUIRED refusal names it in details[path=stepUpAction] (for example API_KEY_CREATE, API_KEY_ROTATE, WEBHOOK_ENDPOINT_CREATE, WEBHOOK_URL_CHANGE, WEBHOOK_SECRET_ROTATE, WEBHOOK_ENDPOINT_REENABLE). A grant for another name is not accepted. Step-up is for people signed in to the console; an API key with webhooks:write manages webhook endpoints without it.
assertionstring (max 32768 chars)Required
methodenumRequired
WEBAUTHNTOTPRECOVERY_CODE
challengestring (max 256 chars)
providerKeystring (pattern ^[a-z0-9][a-z0-9_-]*$, max 64 chars)

POST /v1/accounts/{AC}/identity/step-up

curl -X POST "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/step-up" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "action": "string",
  "assertion": "string",
  "method": "WEBAUTHN"
}'

Responses

Reset all MFA factors for a user

POST/v1/accounts/{AC}/identity/users/{userSid}/mfa/reset

identity.users.mfa.resetSDK operation postV1AccountsByAcIdentityUsersByUsersidMfaReset

Required scope: roles:write.Idempotency-Key required

Parameters

userSidstring (US… SID)Required

Request body

stepUpTokenstring (max 256 chars)Required

POST /v1/accounts/{AC}/identity/users/{userSid}/mfa/reset

curl -X POST "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/users/userSid.../mfa/reset" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "stepUpToken": "string"
}'

Responses

Revoke every active browser session for a user

POST/v1/accounts/{AC}/identity/users/{userSid}/sessions/revoke-all

identity.users.sessions.revokeAllSDK operation postV1AccountsByAcIdentityUsersByUsersidSessionsRevokeAll

Required scope: roles:write.Idempotency-Key required

Parameters

userSidstring (US… SID)Required

Request body

stepUpTokenstring (max 256 chars)Required

POST /v1/accounts/{AC}/identity/users/{userSid}/sessions/revoke-all

curl -X POST "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/identity/users/userSid.../sessions/revoke-all" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "stepUpToken": "string"
}'

Responses

List active role bindings in the account scope

GET/v1/accounts/{AC}/role-bindings

roleBindings.listSDK operation getV1AccountsByAcRoleBindings

Required scope: any one of roles:write, audit:read.Paginated

Parameters

limitinteger (1–100)query
cursorstring (max 2048 chars)query

GET /v1/accounts/{AC}/role-bindings

curl "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/role-bindings" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21"

Responses

Create an immutable role binding

POST/v1/accounts/{AC}/role-bindings

roleBindings.createSDK operation postV1AccountsByAcRoleBindings

Required scope: roles:write.Idempotency-Key required

Request body

principalRefstring (max 128 chars)Required
principalTypeenumRequired
USERAPI_KEY
rolestring (max 64 chars)Required
scopeKindenumRequired
ORGANIZATIONACCOUNTSUBACCOUNTINBOX
stepUpTokenstring (max 256 chars)Required
environmentenum
livesandboxboth
expiresAtstring (date-time)
inboxSidstring (IB… SID)

POST /v1/accounts/{AC}/role-bindings

curl -X POST "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/role-bindings" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "principalRef": "string",
  "principalType": "USER",
  "role": "string",
  "scopeKind": "ORGANIZATION",
  "stepUpToken": "string"
}'

Responses

Revoke an immutable role binding

DELETE/v1/accounts/{AC}/role-bindings/{bindingId}

roleBindings.deleteSDK operation deleteV1AccountsByAcRoleBindingsByBindingid

Required scope: roles:write.

Parameters

bindingIdstring (uuid)Required

Request body

reasonstring (max 1000 chars)Required
stepUpTokenstring (max 256 chars)Required

DELETE /v1/accounts/{AC}/role-bindings/{bindingId}

curl -X DELETE "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/role-bindings/bindingId..." \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Content-Type: application/json" \
  -d '{
  "reason": "string",
  "stepUpToken": "string"
}'

Responses

List authoritative customer roles and permissions

GET/v1/accounts/{AC}/roles

roles.listSDK operation getV1AccountsByAcRoles

Required scope: any one of roles:write, audit:read.Paginated

Parameters

limitinteger (1–100)query
cursorstring (max 2048 chars)query

GET /v1/accounts/{AC}/roles

curl "https://api.staging.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/roles" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21"

Responses

Discover the API key's account and region

GET/v1/me

me.listSDK operation getV1Me

GET /v1/me

curl "https://api.staging.toutye.com/v1/me" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21"

Responses