Credential aggregator service API references

The OneWelcome Identity Platform provides the credential aggregator service for unified credential and authenticator management. The credential aggregator service provides a centralized view and management interface for multiple authentication methods across the platform, including password, TOTP, SMS OTP, email OTP, FIDO, and recovery codes. It enables login history tracking, authenticator configuration, and multi-factor authentication orchestration.

Credential aggregator service APIs

The credential aggregator service includes the following APIs:

• Management API: Provides endpoints for the following tasks:

  • Retrieve all authenticators: Get the list of authenticator methods that are configured for the tenant, with optional filtering for enabled or disabled authenticators.

  • Replace enabled authenticators: Replace the entire set of enabled authenticator methods for the tenant (full replacement semantics).

  • Update authenticator state: Partially update the configuration of a specific authenticator method, including enabling or disabling and changing default challenges.

• User credentials API: Provides endpoints for the following tasks:

  • Get user login history: Retrieve the last N login attempts for a user with authenticator method details.

  • Record user login: Record a new login event for a user with the authenticator methods used.

  • Get user authenticators: Retrieve all enabled authenticators for a specific user with detailed information.

  • Add user authenticator: Add a new authenticator for a user.

  • Get user overview: Retrieve a combined view of the last login and the available authenticators for a user.

  • Get last login: Retrieve only the most recent login timestamp for a user.

  • Get specific authenticator: Retrieve detailed information about a specific user authenticator.

• Credential operations API: Provides endpoints for the following tasks:

  • Delete TOTP credential: Remove a specific TOTP device from a user's account with OTP validation.

  • Remove passkey: Remove a specific FIDO passkey from a user's account.

Authentication

All credential aggregator service API endpoints require OAuth2 bearer tokens with the appropriate permissions.