Need help with your APIs? I offer API discovery, governance & evangelism services. Explore services →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Weavr Authentication Factors API

Manage user authentication factors, including passwords and device-based factors (OTP and push).

Weavr Authentication Factors API is one of 43 APIs that Weavr publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Authentication Factors. The published artifact set on APIs.io includes an OpenAPI specification.

This API exposes 10 operations across 9 paths, and defines 17 schemas. It is described by OpenAPI 3.1.0, at version v3.

Requests are made against a single base URL, https://sandbox.weavr.io/multi/backoffice.

10 operations 9 paths 17 schemas 1 DELETE1 GET8 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.1.0
API Version
v3
Base URL
https://api.weavr.io/multi
Authentication
API Key, HTTP Bearer
Contact
Resource Areas
1

Authentication & Security 2

Weavr Authentication Factors API declares 2 security schemes for authenticating requests. An API key is passed in the header as api-key (api_key). It accepts HTTP bearer tokens (JWT) (auth_token).

  • api_key — The API Key representing your Multi account.
  • auth_token — The authentication token representing the user. This will be included in the login response object.

Paths & Operations 10

Across 9 paths, the API surfaces 10 operations — 1 DELETE, 1 GET, 8 POST. Each is listed below with its method, path, parameters, and response codes.

Authentication Factors 10

Manage user authentication factors, including passwords and device-based factors (OTP and push).

POST
/passwords/{user_id}/create
Create a password
passwordCreate 1 param body → 200400401403404409410429
POST
/passwords/update
Update a password
passwordUpdate body → 200400401403404409410429
POST
/passwords/validate
Validate a password
passwordValidate body → 204400401403404409410429
POST
/passwords/lost_password/start
Initiate lost password process
lostPasswordInitiate body → 204400401403404409429500
POST
/passwords/lost_password/resume
Resume lost password process
lostPasswordResume body → 200400401403404409410429
GET
/authentication_factors
Get user authentication factors
authFactorsGet → 200400401403404429500503
POST
/authentication_factors/otp/{channel}
Enrol a user device for authentication using one-time passwords
enrolDeviceUsingOtpStepOne 2 params → 204400401403404409429500
POST
/authentication_factors/otp/{channel}/verify
Verify enrolment of a user device for authentication using one-time passwords
enrolDeviceUsingOtpStepTwo 2 params body → 204400401403404409429500
POST
/authentication_factors/push/{channel}
Enrol a user device for authentication using push notifications
enrolDeviceUsingPush 2 params → 204400401403404409429500
DELETE
/authentication_factors/push/{channel}
Unlink a user device for authentication using push notifications
unlinkDeviceUsingPush 2 params → 204400401403404409429500

Schemas 17

The contract defines 17 schemas that model the data the API accepts and returns. The most detailed are SCAFactor (3 properties), IdentityId (2 properties), PasswordInfo (2 properties), Error (2 properties). Each schema is shown below with its type and property counts.

UserId
string
SyntaxError
object
Is returned as part of an HTTP error response whenever a syntax error is detected. A list of the fields together with their syntax error will be provided.
1 property
TokenError
object
The used token is expired or not found
1 property
PasswordInfo
object
Additional information related to the user's password.
2 properties 1 required
SensitivePassword
object
The user's password or passcode used to log in a user. Passwords must be: - minimum 8 characters for end-users (Consumers and Corporates); 12 characters for ot…
1 property 1 required
SCAPushChannel
string
- "AUTHY": The push notification is sent on the user's device using [Twilio Authy](https://www.twilio.com/authy) - "BIOMETRIC": The push notification is sent t…
Nonce
string
A randomly generated one-time use code.
SCAOtpChannel
string
- "SMS": The one-time-password is sent as a text message
Email
string
E-mail Address of the user
SCAFactorStatus
string
The state of the factor type. - PENDINGVERIFICATION : The user has started the enrolment process but still hasn't completed enrolment. Challenges cannot be use…
TokenResponse
object
1 property
IdentityId
object
2 properties 2 required
SCAChallengeType
string
- "OTP": The OTP is sent as a text message - "PUSH": The authorisation request is sent as a push notification - "BIOMETRIC": The push notification is sent via…
AuthSCAPushChannel
string
- "AUTHY": The push notification is sent on the user's device using [Twilio Authy](https://www.twilio.com/authy)
Error
object
2 properties
SCAFactor
object
3 properties
SCAChannel
string
- "SMS": The one-time-password is sent as a text message - "AUTHY": The push notification is sent to an Authy application - "BIOMETRIC": The push notification…

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

weavr-authentication-factors-api-openapi.yml Raw ↑

Other APIs Weavr publishes across the network.

Weavr Access Token API
Weavr Access Tokens API
Weavr Accounts API
Weavr Additional Factors API
Weavr Authorised Signatories API
Weavr Authorised Users API
Weavr Buyer Authorised Users API
Weavr Buyers API
Weavr Card Payments API
Weavr Cards API
Weavr Confirmation Challenges API
Weavr Consumers API