> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Update FIDO settings

`PUT /api/web/v1/settings/fido`

Update the FIDO settings. Caller requires the SETTINGS:EDIT permission.

## Request Body

Required.

### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "attestation": {
      "type": "string",
      "description": "Attestation preference for passkey/FIDO2 registration. Determines how much information about the authenticator (security key/passkey) is shared during registration. NONE: No authenticator details shared (recommended for privacy). INDIRECT: Basic information shared in a privacy-preserving way (balanced approach). DIRECT: Full authenticator details shared (use when you need to verify specific device models).",
      "enum": [
        "NONE",
        "INDIRECT",
        "DIRECT"
      ]
    },
    "authenticatorList": {
      "type": "array",
      "description": "List of authenticator AAGUIDs used as the allow or block list. Only applicable when authenticatorTrustMode is ALLOW_SELECTED or BLOCK_SELECTED.",
      "items": {
        "type": "string",
        "description": "List of authenticator AAGUIDs used as the allow or block list. Only applicable when authenticatorTrustMode is ALLOW_SELECTED or BLOCK_SELECTED.",
        "format": "uuid"
      }
    },
    "authenticatorTrustMode": {
      "type": "string",
      "description": "Controls which authenticators are permitted. ALLOW_ALL: any authenticator is accepted (default). ALLOW_SELECTED: only authenticators listed in authenticatorList are accepted. BLOCK_SELECTED: authenticators listed in authenticatorList are blocked; all others are accepted.",
      "enum": [
        "ALLOW_ALL",
        "ALLOW_SELECTED",
        "BLOCK_SELECTED"
      ]
    },
    "backupEligibleCheck": {
      "type": "boolean",
      "description": "A boolean value indicating if synced passkey/FIDO2 tokens should be blocked.",
      "default": false
    },
    "fidoRelyingPartyAllowlist": {
      "type": "array",
      "description": "List of allowed relying party IDs for passkey/FIDO2 registration.",
      "items": {
        "required": [
          "hostname",
          "systemDefined"
        ],
        "type": "object",
        "properties": {
          "androidOrigins": {
            "type": "array",
            "description": "Collection of different android app origin configurations.",
            "items": {
              "required": [
                "fingerprints",
                "packageName"
              ],
              "type": "object",
              "properties": {
                "fingerprints": {
                  "type": "array",
                  "description": "An array of SHA-256 fingerprints of the app's signing certificate(s).",
                  "example": "[C8:64:56:31:CF:2D:A9:3D:68:14:AD:9F:90:46:FC:16:3B:4E:50:4F:C7:FF:A4:8E:73:23:1B:0F:76:EC:93:B4]",
                  "items": {
                    "type": "string",
                    "description": "An array of SHA-256 fingerprints of the app's signing certificate(s).",
                    "example": "[C8:64:56:31:CF:2D:A9:3D:68:14:AD:9F:90:46:FC:16:3B:4E:50:4F:C7:FF:A4:8E:73:23:1B:0F:76:EC:93:B4]"
                  }
                },
                "packageName": {
                  "type": "string",
                  "description": "Specifies the android app's package name.",
                  "example": "com.example.myapp"
                }
              },
              "description": "Represents the android origin configurations for Passkey/FIDO authenticator settings.",
              "title": "FIDOAndroidOriginSettings"
            }
          },
          "hostname": {
            "type": "string",
            "description": "Allowed FIDO relying party ID hostname value. This value can not contain a port.",
            "example": "example.com"
          },
          "iosOrigins": {
            "type": "array",
            "description": "Collection of different ios app association configurations.",
            "items": {
              "required": [
                "appIdentifierPrefix",
                "bundleIdentifier"
              ],
              "type": "object",
              "properties": {
                "appIdentifierPrefix": {
                  "type": "string",
                  "description": "Specifies the Apple developer Team ID.",
                  "example": "89D8S454P6"
                },
                "bundleIdentifier": {
                  "type": "string",
                  "description": "Application's unique bundle ID to associate with the server.",
                  "example": "com.example.myapp"
                }
              },
              "description": "Represents the iOS origin configurations for Passkey/FIDO authenticator settings.",
              "title": "FIDOIosOriginSettings"
            }
          },
          "subdomainsAllowed": {
            "type": "boolean",
            "description": "Determines if subdomains are allowed for this relying party ID."
          },
          "systemDefined": {
            "type": "boolean",
            "description": "Determines if the relying party ID is system defined."
          }
        },
        "description": "List of allowed relying party IDs for passkey/FIDO2 registration.",
        "title": "FIDOAllowedRpid"
      }
    },
    "fidoRelyingPartyAllowlistEnabled": {
      "type": "boolean",
      "description": "A boolean value indicating if passkey/FIDO2 relying party allow list is enabled.",
      "default": false
    },
    "nonCompliantAuthenticatorPolicy": {
      "type": "string",
      "description": "Policy applied during authentication when an authenticator is no longer compliant (e.g. authenticator was removed from the allowed list after the user registered, or the trust policy was tightened). ALLOW: authentication succeeds (default). BLOCK: authentication is blocked.",
      "enum": [
        "ALLOW",
        "BLOCK"
      ]
    },
    "passkeyAuthenticatorLevel": {
      "type": "string",
      "description": "The minimum authentication level required to use FIDO self user actions through the Authentication API."
    },
    "registrationAuthenticatorAttachment": {
      "type": "string",
      "description": "Should the token be embedded on the device or stored externally?",
      "enum": [
        "EITHER",
        "PLATFORM",
        "CROSS_PLATFORM"
      ]
    },
    "registrationRequireResidentKey": {
      "type": "string",
      "description": "Should the User ID be stored on the Passkey/FIDO2 token?",
      "enum": [
        "DISCOURAGED",
        "PREFERRED",
        "REQUIRED"
      ]
    },
    "registrationUserVerification": {
      "type": "string",
      "description": "Should the token perform user verification?",
      "enum": [
        "DISCOURAGED",
        "PREFERRED",
        "REQUIRED"
      ]
    },
    "timeout": {
      "type": "integer",
      "description": "The time in seconds that a client will wait for the FIDO token to respond. Value must be between 5 and 300.",
      "format": "int32"
    },
    "unknownAuthenticatorPolicy": {
      "type": "string",
      "description": "Policy applied when an authenticator's AAGUID cannot be identified from the server's metadata or community list. ALLOW: proceed normally (default). BLOCK: the operation is blocked.",
      "enum": [
        "ALLOW",
        "BLOCK"
      ]
    },
    "userPresentCheck": {
      "type": "boolean",
      "description": "A boolean value indicating if user presence is checked by the passkey/FIDO2 token.",
      "default": false
    }
  },
  "description": "Settings that set the behavior of FIDO authentication.",
  "title": "FIDOAuthenticatorSettingsParms"
}
```

## Responses

### 200

Successful

### 400

Bad Request

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 401

Access denied

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 403

Forbidden

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 404

Not Found

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 409

Conflict

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

## Security

Requirements

```json
[
  {
    "AdminAPIAuthentication": [
      "SETTINGS:EDIT"
    ]
  }
]
```