---
title: "Update tenant authentication policy"
description: "Updates sign-in methods, password rules, multi-factor requirements, self-registration, guest access, and session limits through the existing audited tenant authentication service. Requires an idempotency key.\n\n### Quire permissions\n\nRequired capability: `auth/configure`.\n\nCredential scopes: `tenants:write`.\n\nThe acting subject must also be allowed to perform this action in the organisation."
image: "https://docs.quirelms.com/og.png"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.quirelms.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: Quire API › tenants

`PUT /tenant_auth_settings`

Updates sign-in methods, password rules, multi-factor requirements, self-registration, guest access, and session limits through the existing audited tenant authentication service. Requires an idempotency key.

\### Quire permissions

Required capability: `auth/configure`.

Credential scopes: `tenants:write`.

The acting subject must also be allowed to perform this action in the organisation.

## Authentication

Requires one of the following:

- `apiKey`, http, header `Authorization`, scopes: `tenants:write`
- `oauth2`, oauth2, scopes: `tenants:write`

## Header parameters

- `updateTenantAuthSettings.header.Idempotency-Key` (string, required) — A caller-chosen key making this request safe to retry. A replay of a completed request returns the recorded response with `Idempotency-Replayed: true`. Reusing a key for a different request is refused.
  - maxLength 255
- `updateTenantAuthSettings.header.Quire-Version` (string, optional) — The dated API revision to serve this request at. Omitted, the request is served at the revision the credential was issued against. The response echoes the revision actually applied.
  - format `date`

## Request body

_Required._

- `updateTenantAuthSettings.mode` (string, optional)
  - one of `"off"`, `"optional"`, `"required"`, `"required_for_roles"`
- `updateTenantAuthSettings.required_roles` (array<string>, optional)
  - minLength 1; maxLength 100
- `updateTenantAuthSettings.accepted_acr_values` (array<string>, optional)
  - minLength 1; maxLength 300
- `updateTenantAuthSettings.cookie_cache_seconds` (integer, optional)
  - min -9007199254740991; max 9007199254740991
- `updateTenantAuthSettings.password_min_length` (integer, optional)
  - min -9007199254740991; max 9007199254740991
- `updateTenantAuthSettings.breach_check_enabled` (boolean, optional)
- `updateTenantAuthSettings.magic_link_minutes` (integer, optional)
  - min -9007199254740991; max 9007199254740991
- `updateTenantAuthSettings.self_registration_enabled` (boolean, optional)
- `updateTenantAuthSettings.self_registration_domains` (array<string>, optional)
  - maxLength 253
- `updateTenantAuthSettings.self_registration_requires_approval` (boolean, optional)
- `updateTenantAuthSettings.enabled_methods` (array<string>, optional)
  - one of `"password"`, `"magic_link"`, `"passkey"`, `"social"`, `"sso"`, `"ldap"`
- `updateTenantAuthSettings.mfa_methods` (array<string>, optional)
  - one of `"totp"`, `"email_otp"`, `"backup_code"`
- `updateTenantAuthSettings.password_require_mixed_case` (boolean, optional)
- `updateTenantAuthSettings.password_require_digit` (boolean, optional)
- `updateTenantAuthSettings.password_require_symbol` (boolean, optional)
- `updateTenantAuthSettings.session_idle_minutes` (any of, optional)
  - any of: `integer`, `null`
- `updateTenantAuthSettings.session_absolute_hours` (any of, optional)
  - any of: `integer`, `null`
- `updateTenantAuthSettings.max_concurrent_sessions` (any of, optional)
  - any of: `integer`, `null`
- `updateTenantAuthSettings.guest_access_enabled` (boolean, optional)

## Example request

```json
{
  "mode": "off",
  "required_roles": [
    "string"
  ],
  "accepted_acr_values": [
    "string"
  ],
  "cookie_cache_seconds": -9007199254740991,
  "password_min_length": -9007199254740991,
  "breach_check_enabled": true,
  "magic_link_minutes": -9007199254740991,
  "self_registration_enabled": true,
  "self_registration_domains": [
    "string"
  ],
  "self_registration_requires_approval": true,
  "enabled_methods": [
    "password"
  ],
  "mfa_methods": [
    "totp"
  ],
  "password_require_mixed_case": true,
  "password_require_digit": true,
  "password_require_symbol": true,
  "session_idle_minutes": -9007199254740991,
  "session_absolute_hours": -9007199254740991,
  "max_concurrent_sessions": -9007199254740991,
  "guest_access_enabled": true
}
```

## Code samples

### cURL

```curl
curl --request PUT \
  --url https://your-organisation.quirelms.com/api/v1/tenant_auth_settings \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: string' \
  --data '
{
  "mode": "off",
  "required_roles": [
    "string"
  ],
  "accepted_acr_values": [
    "string"
  ],
  "cookie_cache_seconds": -9007199254740991,
  "password_min_length": -9007199254740991,
  "breach_check_enabled": true,
  "magic_link_minutes": -9007199254740991,
  "self_registration_enabled": true,
  "self_registration_domains": [
    "string"
  ],
  "self_registration_requires_approval": true,
  "enabled_methods": [
    "password"
  ],
  "mfa_methods": [
    "totp"
  ],
  "password_require_mixed_case": true,
  "password_require_digit": true,
  "password_require_symbol": true,
  "session_idle_minutes": -9007199254740991,
  "session_absolute_hours": -9007199254740991,
  "max_concurrent_sessions": -9007199254740991,
  "guest_access_enabled": true
}
'
```

### TypeScript

```typescript
const url = 'https://your-organisation.quirelms.com/api/v1/tenant_auth_settings';
const options = {
  method: 'PUT',
  headers: {
    'Content-Type': 'application/json',
    'Idempotency-Key': 'string',
    Authorization: 'Bearer <token>'
  },
  body: JSON.stringify({
    mode: 'off',
    required_roles: ['string'],
    accepted_acr_values: ['string'],
    cookie_cache_seconds: -9007199254740991,
    password_min_length: -9007199254740991,
    breach_check_enabled: true,
    magic_link_minutes: -9007199254740991,
    self_registration_enabled: true,
    self_registration_domains: ['string'],
    self_registration_requires_approval: true,
    enabled_methods: ['password'],
    mfa_methods: ['totp'],
    password_require_mixed_case: true,
    password_require_digit: true,
    password_require_symbol: true,
    session_idle_minutes: -9007199254740991,
    session_absolute_hours: -9007199254740991,
    max_concurrent_sessions: -9007199254740991,
    guest_access_enabled: true
  })
};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));
```

### Python

```python
import requests

url = "https://your-organisation.quirelms.com/api/v1/tenant_auth_settings"

payload = {
    "mode": "off",
    "required_roles": ["string"],
    "accepted_acr_values": ["string"],
    "cookie_cache_seconds": -9007199254740991,
    "password_min_length": -9007199254740991,
    "breach_check_enabled": True,
    "magic_link_minutes": -9007199254740991,
    "self_registration_enabled": True,
    "self_registration_domains": ["string"],
    "self_registration_requires_approval": True,
    "enabled_methods": ["password"],
    "mfa_methods": ["totp"],
    "password_require_mixed_case": True,
    "password_require_digit": True,
    "password_require_symbol": True,
    "session_idle_minutes": -9007199254740991,
    "session_absolute_hours": -9007199254740991,
    "max_concurrent_sessions": -9007199254740991,
    "guest_access_enabled": True
}
headers = {
    "Content-Type": "application/json",
    "Idempotency-Key": "string",
    "Authorization": "Bearer <token>"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)
```

## Responses

### 200

Success.

#### Example

```json
{
  "saved": true,
  "policy": {
    "mode": "off",
    "required_roles": [
      "string"
    ],
    "accepted_acr_values": [
      "string"
    ],
    "cookie_cache_seconds": 0,
    "password_min_length": 0,
    "breach_check_enabled": true,
    "magic_link_minutes": 0,
    "self_registration_enabled": true,
    "self_registration_domains": [
      "string"
    ],
    "self_registration_requires_approval": true,
    "enabled_methods": [
      "password"
    ],
    "mfa_methods": [
      "totp"
    ],
    "password_require_mixed_case": true,
    "password_require_digit": true,
    "password_require_symbol": true,
    "session_idle_minutes": 0,
    "session_absolute_hours": 0,
    "max_concurrent_sessions": 0,
    "guest_access_enabled": true
  }
}
```

- `updateTenantAuthSettings.response.200.saved` (boolean, required)
- `updateTenantAuthSettings.response.200.policy` (object, required)
  - `updateTenantAuthSettings.response.200.policy.mode` (string, required)
    - one of `"off"`, `"optional"`, `"required"`, `"required_for_roles"`
  - `updateTenantAuthSettings.response.200.policy.required_roles` (array<string>, required)
  - `updateTenantAuthSettings.response.200.policy.accepted_acr_values` (array<string>, required)
  - `updateTenantAuthSettings.response.200.policy.cookie_cache_seconds` (number, required)
  - `updateTenantAuthSettings.response.200.policy.password_min_length` (number, required)
  - `updateTenantAuthSettings.response.200.policy.breach_check_enabled` (boolean, required)
  - `updateTenantAuthSettings.response.200.policy.magic_link_minutes` (number, required)
  - `updateTenantAuthSettings.response.200.policy.self_registration_enabled` (boolean, required)
  - `updateTenantAuthSettings.response.200.policy.self_registration_domains` (array<string>, required)
  - `updateTenantAuthSettings.response.200.policy.self_registration_requires_approval` (boolean, required)
  - `updateTenantAuthSettings.response.200.policy.enabled_methods` (array<string>, required)
    - one of `"password"`, `"magic_link"`, `"passkey"`, `"social"`, `"sso"`, `"ldap"`
  - `updateTenantAuthSettings.response.200.policy.mfa_methods` (array<string>, required)
    - one of `"totp"`, `"email_otp"`, `"backup_code"`
  - `updateTenantAuthSettings.response.200.policy.password_require_mixed_case` (boolean, required)
  - `updateTenantAuthSettings.response.200.policy.password_require_digit` (boolean, required)
  - `updateTenantAuthSettings.response.200.policy.password_require_symbol` (boolean, required)
  - `updateTenantAuthSettings.response.200.policy.session_idle_minutes` (number | null, required)
  - `updateTenantAuthSettings.response.200.policy.session_absolute_hours` (number | null, required)
  - `updateTenantAuthSettings.response.200.policy.max_concurrent_sessions` (number | null, required)
  - `updateTenantAuthSettings.response.200.policy.guest_access_enabled` (boolean, required)

### 401

The credential is missing, malformed, expired or revoked.

#### Example

```json
{
  "type": "http://example.com",
  "title": "string",
  "status": 0,
  "code": "string",
  "category": "validation",
  "detail": "string",
  "request_id": "string",
  "errors": [
    {
      "path": "string",
      "code": "string",
      "detail": "string"
    }
  ],
  "retry_after": 0,
  "docs_url": "http://example.com"
}
```

- `updateTenantAuthSettings.response.401.type` (string, required)
  - format `uri`
- `updateTenantAuthSettings.response.401.title` (string, required)
- `updateTenantAuthSettings.response.401.status` (integer, required)
- `updateTenantAuthSettings.response.401.code` (string, required)
- `updateTenantAuthSettings.response.401.category` (string, required)
  - one of `"validation"`, `"authentication"`, `"authorization"`, `"not_found"`, `"conflict"`, `"precondition"`, `"quota"`, `"rate_limit"`, `"upstream"`, `"internal"`
- `updateTenantAuthSettings.response.401.detail` (string, required)
- `updateTenantAuthSettings.response.401.request_id` (string, required)
- `updateTenantAuthSettings.response.401.docs_url` (string, required)
  - format `uri`
- `updateTenantAuthSettings.response.401.errors` (array<object>, optional)
  - `updateTenantAuthSettings.response.401.errors.path` (string, required) — RFC 6901 JSON Pointer into the request body.
  - `updateTenantAuthSettings.response.401.errors.code` (string, required)
  - `updateTenantAuthSettings.response.401.errors.detail` (string, required)
- `updateTenantAuthSettings.response.401.retry_after` (integer | null, optional)

### 403

The credential lacks the scope this operation requires, or the acting subject lacks the capability.

#### Example

```json
{
  "type": "http://example.com",
  "title": "string",
  "status": 0,
  "code": "string",
  "category": "validation",
  "detail": "string",
  "request_id": "string",
  "errors": [
    {
      "path": "string",
      "code": "string",
      "detail": "string"
    }
  ],
  "retry_after": 0,
  "docs_url": "http://example.com"
}
```

- `updateTenantAuthSettings.response.403.type` (string, required)
  - format `uri`
- `updateTenantAuthSettings.response.403.title` (string, required)
- `updateTenantAuthSettings.response.403.status` (integer, required)
- `updateTenantAuthSettings.response.403.code` (string, required)
- `updateTenantAuthSettings.response.403.category` (string, required)
  - one of `"validation"`, `"authentication"`, `"authorization"`, `"not_found"`, `"conflict"`, `"precondition"`, `"quota"`, `"rate_limit"`, `"upstream"`, `"internal"`
- `updateTenantAuthSettings.response.403.detail` (string, required)
- `updateTenantAuthSettings.response.403.request_id` (string, required)
- `updateTenantAuthSettings.response.403.docs_url` (string, required)
  - format `uri`
- `updateTenantAuthSettings.response.403.errors` (array<object>, optional)
  - `updateTenantAuthSettings.response.403.errors.path` (string, required) — RFC 6901 JSON Pointer into the request body.
  - `updateTenantAuthSettings.response.403.errors.code` (string, required)
  - `updateTenantAuthSettings.response.403.errors.detail` (string, required)
- `updateTenantAuthSettings.response.403.retry_after` (integer | null, optional)

### 409

The request conflicts with the current state, with a previous use of the same idempotency key, or with a concurrent write.

#### Example

```json
{
  "type": "http://example.com",
  "title": "string",
  "status": 0,
  "code": "string",
  "category": "validation",
  "detail": "string",
  "request_id": "string",
  "errors": [
    {
      "path": "string",
      "code": "string",
      "detail": "string"
    }
  ],
  "retry_after": 0,
  "docs_url": "http://example.com"
}
```

- `updateTenantAuthSettings.response.409.type` (string, required)
  - format `uri`
- `updateTenantAuthSettings.response.409.title` (string, required)
- `updateTenantAuthSettings.response.409.status` (integer, required)
- `updateTenantAuthSettings.response.409.code` (string, required)
- `updateTenantAuthSettings.response.409.category` (string, required)
  - one of `"validation"`, `"authentication"`, `"authorization"`, `"not_found"`, `"conflict"`, `"precondition"`, `"quota"`, `"rate_limit"`, `"upstream"`, `"internal"`
- `updateTenantAuthSettings.response.409.detail` (string, required)
- `updateTenantAuthSettings.response.409.request_id` (string, required)
- `updateTenantAuthSettings.response.409.docs_url` (string, required)
  - format `uri`
- `updateTenantAuthSettings.response.409.errors` (array<object>, optional)
  - `updateTenantAuthSettings.response.409.errors.path` (string, required) — RFC 6901 JSON Pointer into the request body.
  - `updateTenantAuthSettings.response.409.errors.code` (string, required)
  - `updateTenantAuthSettings.response.409.errors.detail` (string, required)
- `updateTenantAuthSettings.response.409.retry_after` (integer | null, optional)

### 422

The request was understood and its content is not valid. `errors` names each field.

#### Example

```json
{
  "type": "http://example.com",
  "title": "string",
  "status": 0,
  "code": "string",
  "category": "validation",
  "detail": "string",
  "request_id": "string",
  "errors": [
    {
      "path": "string",
      "code": "string",
      "detail": "string"
    }
  ],
  "retry_after": 0,
  "docs_url": "http://example.com"
}
```

- `updateTenantAuthSettings.response.422.type` (string, required)
  - format `uri`
- `updateTenantAuthSettings.response.422.title` (string, required)
- `updateTenantAuthSettings.response.422.status` (integer, required)
- `updateTenantAuthSettings.response.422.code` (string, required)
- `updateTenantAuthSettings.response.422.category` (string, required)
  - one of `"validation"`, `"authentication"`, `"authorization"`, `"not_found"`, `"conflict"`, `"precondition"`, `"quota"`, `"rate_limit"`, `"upstream"`, `"internal"`
- `updateTenantAuthSettings.response.422.detail` (string, required)
- `updateTenantAuthSettings.response.422.request_id` (string, required)
- `updateTenantAuthSettings.response.422.docs_url` (string, required)
  - format `uri`
- `updateTenantAuthSettings.response.422.errors` (array<object>, optional)
  - `updateTenantAuthSettings.response.422.errors.path` (string, required) — RFC 6901 JSON Pointer into the request body.
  - `updateTenantAuthSettings.response.422.errors.code` (string, required)
  - `updateTenantAuthSettings.response.422.errors.detail` (string, required)
- `updateTenantAuthSettings.response.422.retry_after` (integer | null, optional)

### 429

A rate limit or a concurrency cap was reached. `Retry-After` says when to try again.

#### Example

```json
{
  "type": "http://example.com",
  "title": "string",
  "status": 0,
  "code": "string",
  "category": "validation",
  "detail": "string",
  "request_id": "string",
  "errors": [
    {
      "path": "string",
      "code": "string",
      "detail": "string"
    }
  ],
  "retry_after": 0,
  "docs_url": "http://example.com"
}
```

- `updateTenantAuthSettings.response.429.type` (string, required)
  - format `uri`
- `updateTenantAuthSettings.response.429.title` (string, required)
- `updateTenantAuthSettings.response.429.status` (integer, required)
- `updateTenantAuthSettings.response.429.code` (string, required)
- `updateTenantAuthSettings.response.429.category` (string, required)
  - one of `"validation"`, `"authentication"`, `"authorization"`, `"not_found"`, `"conflict"`, `"precondition"`, `"quota"`, `"rate_limit"`, `"upstream"`, `"internal"`
- `updateTenantAuthSettings.response.429.detail` (string, required)
- `updateTenantAuthSettings.response.429.request_id` (string, required)
- `updateTenantAuthSettings.response.429.docs_url` (string, required)
  - format `uri`
- `updateTenantAuthSettings.response.429.errors` (array<object>, optional)
  - `updateTenantAuthSettings.response.429.errors.path` (string, required) — RFC 6901 JSON Pointer into the request body.
  - `updateTenantAuthSettings.response.429.errors.code` (string, required)
  - `updateTenantAuthSettings.response.429.errors.detail` (string, required)
- `updateTenantAuthSettings.response.429.retry_after` (integer | null, optional)

### 500

Something failed at our end. Quote `request_id` when reporting it.

#### Example

```json
{
  "type": "http://example.com",
  "title": "string",
  "status": 0,
  "code": "string",
  "category": "validation",
  "detail": "string",
  "request_id": "string",
  "errors": [
    {
      "path": "string",
      "code": "string",
      "detail": "string"
    }
  ],
  "retry_after": 0,
  "docs_url": "http://example.com"
}
```

- `updateTenantAuthSettings.response.500.type` (string, required)
  - format `uri`
- `updateTenantAuthSettings.response.500.title` (string, required)
- `updateTenantAuthSettings.response.500.status` (integer, required)
- `updateTenantAuthSettings.response.500.code` (string, required)
- `updateTenantAuthSettings.response.500.category` (string, required)
  - one of `"validation"`, `"authentication"`, `"authorization"`, `"not_found"`, `"conflict"`, `"precondition"`, `"quota"`, `"rate_limit"`, `"upstream"`, `"internal"`
- `updateTenantAuthSettings.response.500.detail` (string, required)
- `updateTenantAuthSettings.response.500.request_id` (string, required)
- `updateTenantAuthSettings.response.500.docs_url` (string, required)
  - format `uri`
- `updateTenantAuthSettings.response.500.errors` (array<object>, optional)
  - `updateTenantAuthSettings.response.500.errors.path` (string, required) — RFC 6901 JSON Pointer into the request body.
  - `updateTenantAuthSettings.response.500.errors.code` (string, required)
  - `updateTenantAuthSettings.response.500.errors.detail` (string, required)
- `updateTenantAuthSettings.response.500.retry_after` (integer | null, optional)


Source: https://docs.quirelms.com/api/tenants/updateTenantAuthSettings/index.md