A module representing Guardian, Auth0's multi-factor authentication, on Auth0.
This is the tenant-wide configuration side of MFA — which factors exist, how they
are delivered, and when they are required. The per-user side lives on
Auth0Client.Management.User: enrollments/1 reports what a user has enrolled and
delete_authenticators/1 resets it.
update versus replace
Where Auth0 offers both verbs for a provider's configuration, update_* is the
PATCH and merges into what is already there, while replace_* is the PUT and
overwrites the whole configuration. Where Auth0 offers only PUT — the phone
settings, the selected-provider endpoints and the policies — update_* is that
PUT, since there is no second verb to distinguish it from.
The /guardian/factors/sms/* endpoints are not wrapped. Auth0 documents them as
deprecated and points at the phone equivalents below, which take the same
payloads.
Summary
Functions
Gets the APNs push configuration
Creates an enrollment ticket, the out-of-band way to get a user to enrol in MFA.
Deletes an enrollment, so the user must enrol again
Gets the Duo configuration
Gets an enrollment
Lists the available factors and whether each is enabled
Gets the message types enabled for the phone factor
Gets which provider delivers the phone factor
Gets the enrollment and verification message templates for the phone factor
Gets the Twilio configuration for the phone factor
Gets the tenant's MFA policies
Gets which provider delivers push notifications
Replaces the whole APNs push configuration
Replaces the whole Duo configuration
Replaces the whole FCM push configuration. Write-only, as with update_fcm/1.
Replaces the whole FCM v1 push configuration. Write-only, as with update_fcm/1.
Replaces the whole Amazon SNS push configuration
Gets the Amazon SNS push configuration
Merges into the APNs push configuration
Merges into the Duo configuration
Enables or disables a factor for the whole tenant.
Merges into the FCM push configuration.
Merges into the FCM v1 push configuration. Write-only, as with update_fcm/1.
Sets the message types for the phone factor — sms, voice, or both
Chooses which provider delivers the phone factor — auth0, twilio or
phone-message-hook
Customises the enrollment and verification messages for the phone factor
Sets the Twilio configuration for the phone factor
Sets the tenant's MFA policies.
Chooses which provider delivers push notifications — guardian, sns or direct
Merges into the Amazon SNS push configuration
Functions
Gets the APNs push configuration
iex> Auth0Client.Management.Guardian.apns()Creates an enrollment ticket, the out-of-band way to get a user to enrol in MFA.
user_id is required. factor may be one of push-notification, phone,
email, otp, webauthn-roaming or webauthn-platform. Set send_mail to have
Auth0 email the ticket, or read ticket_url from the response and deliver it
yourself.
iex> Auth0Client.Management.Guardian.create_enrollment_ticket(%{user_id: "auth0|123", send_mail: true})Deletes an enrollment, so the user must enrol again
iex> Auth0Client.Management.Guardian.delete_enrollment("dev_abc123")Gets the Duo configuration
iex> Auth0Client.Management.Guardian.duo_settings()Gets an enrollment
iex> Auth0Client.Management.Guardian.enrollment("dev_abc123")Lists the available factors and whether each is enabled
iex> Auth0Client.Management.Guardian.factors()Gets the message types enabled for the phone factor
iex> Auth0Client.Management.Guardian.phone_message_types()Gets which provider delivers the phone factor
iex> Auth0Client.Management.Guardian.phone_provider()Gets the enrollment and verification message templates for the phone factor
iex> Auth0Client.Management.Guardian.phone_templates()Gets the Twilio configuration for the phone factor
iex> Auth0Client.Management.Guardian.phone_twilio()Gets the tenant's MFA policies
iex> Auth0Client.Management.Guardian.policies()Gets which provider delivers push notifications
iex> Auth0Client.Management.Guardian.push_provider()Replaces the whole APNs push configuration
iex> Auth0Client.Management.Guardian.replace_apns(%{bundle_id: "com.example.app", p12: "...", sandbox: false})Replaces the whole Duo configuration
iex> Auth0Client.Management.Guardian.replace_duo_settings(%{ikey: "...", skey: "...", hostname: "api-abc.duosecurity.com"})Replaces the whole FCM push configuration. Write-only, as with update_fcm/1.
iex> Auth0Client.Management.Guardian.replace_fcm(%{server_key: "..."})Replaces the whole FCM v1 push configuration. Write-only, as with update_fcm/1.
iex> Auth0Client.Management.Guardian.replace_fcmv1(%{server_credentials: "..."})Replaces the whole Amazon SNS push configuration
iex> Auth0Client.Management.Guardian.replace_sns(%{aws_access_key_id: "...", aws_region: "us-east-1"})Gets the Amazon SNS push configuration
iex> Auth0Client.Management.Guardian.sns()Merges into the APNs push configuration
iex> Auth0Client.Management.Guardian.update_apns(%{sandbox: true})Merges into the Duo configuration
iex> Auth0Client.Management.Guardian.update_duo_settings(%{hostname: "api-abc.duosecurity.com"})Enables or disables a factor for the whole tenant.
name is the factor — sms, push-notification, otp, email, duo,
webauthn-roaming, webauthn-platform or recovery-code.
iex> Auth0Client.Management.Guardian.update_factor("otp", %{enabled: true})Merges into the FCM push configuration.
Auth0 exposes no way to read the FCM configuration back — only PATCH and PUT.
That asymmetry with APNs and SNS is Auth0's, not an omission here.
iex> Auth0Client.Management.Guardian.update_fcm(%{server_key: "..."})Merges into the FCM v1 push configuration. Write-only, as with update_fcm/1.
iex> Auth0Client.Management.Guardian.update_fcmv1(%{server_credentials: "..."})Sets the message types for the phone factor — sms, voice, or both
iex> Auth0Client.Management.Guardian.update_phone_message_types(%{message_types: ["sms", "voice"]})Chooses which provider delivers the phone factor — auth0, twilio or
phone-message-hook
iex> Auth0Client.Management.Guardian.update_phone_provider(%{provider: "twilio"})Customises the enrollment and verification messages for the phone factor
iex> Auth0Client.Management.Guardian.update_phone_templates(%{enrollment_message: "Your code is @@password@@"})Sets the Twilio configuration for the phone factor
iex> Auth0Client.Management.Guardian.update_phone_twilio(%{sid: "AC...", auth_token: "...", from: "+15551234567"})Sets the tenant's MFA policies.
The body is a bare list, not an object wrapping one. ["all-applications"]
always prompts; ["confidence-score"] prompts adaptively; [] disables the
policy.
iex> Auth0Client.Management.Guardian.update_policies(["all-applications"])
iex> Auth0Client.Management.Guardian.update_policies([])Chooses which provider delivers push notifications — guardian, sns or direct
iex> Auth0Client.Management.Guardian.update_push_provider(%{provider: "direct"})Merges into the Amazon SNS push configuration
iex> Auth0Client.Management.Guardian.update_sns(%{aws_region: "us-east-1"})