# io.fusionauth/mcp-api (npm · @fusionauth/mcp-api) Preview release of FusionAuth API MCP server - Trust score: 66/100 (medium) - Change this week: +20 - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-08-03 ## Components - npm · `@fusionauth/mcp-api`: 66/100 (this document), [markdown](https://verifymcp.io/servers/io-fusionauth-mcp-api/fusionauth-mcp-api.md), [page](https://verifymcp.io/servers/io-fusionauth-mcp-api/fusionauth-mcp-api) ## Channel facts - Registry: `npm` - Package: `@fusionauth/mcp-api` - Version: `0.1.14` - Transport: `stdio` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-08-03. - **Supply Chain Security**: 88/100 - No malware found by supply-chain analysis. - Only part of the dependency tree could be resolved (110 of 111), so this covers what we could see, not the whole tree. - No install/post-install scripts declared. - Only part of the dependency tree could be resolved (110 of 111), so this covers what we could see, not the whole tree. - **Provenance & Transparency**: 45/100 - Source repository is publicly reachable at the declared URL. - Provenance check failed: no build-provenance attestation is published. - Clear OSI-approved license (Apache-2.0). - Actively maintained (last published 118 days ago). - Disclosure check failed: no security disclosure policy was found in the source repository. - **Schema Quality & AI Usability**: 60/100 - AI-judged instruction clarity (fair). - Tool/resource definitions use about 22835 tokens (~73/item across 310 items; 310 tools + 0 resources), lean. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 27/100 - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses. - **Tool Coverage**: 99/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 97% of tool parameters carry a description. - **Capabilities**: 100/100 - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28. ## Install ### Claude ```bash claude mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api ``` ### Codex ```bash codex mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "io-fusionauth-mcp-api": { "type": "local", "command": [ "npx", "-y", "@fusionauth/mcp-api" ], "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add io-fusionauth-mcp-api --command npx --arg -y --arg @fusionauth/mcp-api ``` ### Hermes ```yaml mcp_servers: io-fusionauth-mcp-api: command: "npx" args: ["-y", "@fusionauth/mcp-api"] ``` ### Other ```json { "mcpServers": { "io-fusionauth-mcp-api": { "command": "npx", "args": [ "-y", "@fusionauth/mcp-api" ] } } } ``` ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-08-02 (score 66, +30) - [security regression] Provenance: unverified → fail - [security improvement] Install scripts: unverified → pass - [security improvement] Known CVEs: unverified → partial - [functional regression] Security disclosure: fail → unverified - [functional improvement] Dependency health: unverified → partial - [functional improvement] Maintenance: unverified → pass - [functional improvement] MCP protocol: unverified → pass - [functional improvement] Stability: unverified → 0.23 - [functional improvement] License: unverified → pass - [functional improvement] Schema quality: unverified → fair - [functional] Licence: Apache-2.0 ### 2026-08-01 (score 36, +15) - [security improvement] Malware scan: unverified → pass ### 2026-07-31 (score 21, −25) - [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server ### 2026-07-27 (score 46) First indexed and scored. ## MCP tools (310) ### `retrieveJsonWebKeySetWithId` (~33 tokens) Returns public keys used by FusionAuth to cryptographically verify JWTs using the JSON Web Key format. ### `retrieveOpenIdConfigurationWithId` (~22 tokens) Returns the well known OpenID Configuration JSON document ### `createAPIKey` (~98 tokens) Creates an API key. You can optionally specify a unique Id for the key, if not provided one will be generated. an API key can only be created with equal or lesser authority. An API key cannot create another API key unless it is granted to that API key. If an API key is locked to a tenant, it can only create API Keys for that same tenant. Input parameters: - `requestBody` (object): Authentication key request object. ### `retrieveAPIKeyWithId` (~37 tokens) Retrieves an authentication API key for the given Id. Input parameters: - `keyId` (string, required): The Id of the API key to retrieve. ### `updateAPIKeyWithId` (~48 tokens) Updates an API key with the given Id. Input parameters: - `keyId` (string, required): The Id of the API key to update. - `requestBody` (object): Authentication key request object. ### `createAPIKeyWithId` (~126 tokens) Creates an API key. You can optionally specify a unique Id for the key, if not provided one will be generated. an API key can only be created with equal or lesser authority. An API key cannot create another API key unless it is granted to that API key. If an API key is locked to a tenant, it can only create API Keys for that same tenant. Input parameters: - `keyId` (string, required): The unique Id of the API key. If not provided a secure random Id will be generated. - `requestBody` (object): Authentication key request object. ### `deleteAPIKeyWithId` (~37 tokens) Deletes the API key for the given Id. Input parameters: - `keyId` (string, required): The Id of the authentication API key to delete. ### `patchAPIKeyWithId` (~58 tokens) Updates an API key with the given Id. Input parameters: - `keyId` (string, required): The Id of the API key. If not provided a secure random api key will be generated. - `requestBody` (object): Authentication key request object. ### `retrieveApplication` (~86 tokens) Retrieves all the applications that are currently inactive. OR Retrieves the application for the given Id or all the applications if the Id is null. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `inactive` (string) ### `createApplication` (~87 tokens) Creates an application. You can optionally specify an Id for the application, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): The Application API request object. ### `searchApplicationsWithId` (~31 tokens) Searches applications with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for Applications ### `retrieveApplicationWithId` (~82 tokens) Retrieves the application for the given Id or all the applications if the Id is null. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The application Id. ### `updateApplicationWithId` (~109 tokens) Updates the application with the given Id. OR Reactivates the application with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application to update. - `reactivate` (string) - `requestBody` (object): The Application API request object. ### `createApplicationWithId` (~115 tokens) Creates an application. You can optionally specify an Id for the application, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id to use for the application. If not provided a secure random UUID will be generated. - `requestBody` (object): The Application API request object. ### `deleteApplicationWithId` (~161 tokens) Hard deletes an application. This is a dangerous operation and should not be used in most circumstances. This will delete the application, any registrations for that application, metrics and reports for the application, all the roles for the application, and any other data associated with the application. This operation could take a very long time, depending on the amount of data in your database. OR Deactivates the application with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application to delete. - `hardDelete` (string) ### `patchApplicationWithId` (~94 tokens) Updates, via PATCH, the application with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application to update. - `requestBody` (object): The Application API request object. ### `retrieveOauthConfigurationWithId` (~87 tokens) Retrieves the Oauth2 configuration for the application for the given Application Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the Application to retrieve OAuth configuration. ### `createApplicationRole` (~131 tokens) Creates a new role for an application. You must specify the Id of the application you are creating the role for. You can optionally specify an Id for the role inside the ApplicationRole object itself, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application to create the role on. - `requestBody` (object): The Application API request object. ### `updateApplicationRoleWithId` (~113 tokens) Updates the application role with the given Id for the application. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application that the role belongs to. - `requestBody` (object): The Application API request object. - `roleId` (string, required): The Id of the role to update. ### `createApplicationRoleWithId` (~157 tokens) Creates a new role for an application. You must specify the Id of the application you are creating the role for. You can optionally specify an Id for the role inside the ApplicationRole object itself, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application to create the role on. - `requestBody` (object): The Application API request object. - `roleId` (string, required): The Id of the role. If not provided a secure random UUID will be generated. ### `deleteApplicationRoleWithId` (~121 tokens) Hard deletes an application role. This is a dangerous operation and should not be used in most circumstances. This permanently removes the given role from all users that had it. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application that the role belongs to. - `roleId` (string, required): The Id of the role to delete. ### `patchApplicationRoleWithId` (~117 tokens) Updates, via PATCH, the application role with the given Id for the application. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application that the role belongs to. - `requestBody` (object): The Application API request object. - `roleId` (string, required): The Id of the role to update. ### `createOAuthScope` (~133 tokens) Creates a new custom OAuth scope for an application. You must specify the Id of the application you are creating the scope for. You can optionally specify an Id for the OAuth scope on the URL, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application to create the OAuth scope on. - `requestBody` (object): The Application Scope API request object. ### `retrieveOAuthScopeWithId` (~96 tokens) Retrieves a custom OAuth scope. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application that the OAuth scope belongs to. - `scopeId` (string, required): The Id of the OAuth scope to retrieve. ### `updateOAuthScopeWithId` (~116 tokens) Updates the OAuth scope with the given Id for the application. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application that the OAuth scope belongs to. - `requestBody` (object): The Application Scope API request object. - `scopeId` (string, required): The Id of the OAuth scope to update. ### `createOAuthScopeWithId` (~160 tokens) Creates a new custom OAuth scope for an application. You must specify the Id of the application you are creating the scope for. You can optionally specify an Id for the OAuth scope on the URL, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application to create the OAuth scope on. - `requestBody` (object): The Application Scope API request object. - `scopeId` (string, required): The Id of the OAuth scope. If not provided a secure random UUID will be generated. ### `deleteOAuthScopeWithId` (~117 tokens) Hard deletes a custom OAuth scope. OAuth workflows that are still requesting the deleted OAuth scope may fail depending on the application's unknown scope policy. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application that the OAuth scope belongs to. - `scopeId` (string, required): The Id of the OAuth scope to delete. ### `patchOAuthScopeWithId` (~121 tokens) Updates, via PATCH, the custom OAuth scope with the given Id for the application. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application that the OAuth scope belongs to. - `requestBody` (object): The Application Scope API request object. - `scopeId` (string, required): The Id of the OAuth scope to update. ### `createConnector` (~43 tokens) Creates a connector. You can optionally specify an Id for the connector, if not provided one will be generated. Input parameters: - `requestBody` (object): The JSON request body. ### `retrieveConnectorWithId` (~31 tokens) Retrieves the connector with the given Id. Input parameters: - `connectorId` (string, required): The Id of the connector. ### `updateConnectorWithId` (~45 tokens) Updates the connector with the given Id. Input parameters: - `connectorId` (string, required): The Id of the connector to update. - `requestBody` (object): The JSON request body. ### `createConnectorWithId` (~69 tokens) Creates a connector. You can optionally specify an Id for the connector, if not provided one will be generated. Input parameters: - `connectorId` (string, required): The Id for the connector. If not provided a secure random UUID will be generated. - `requestBody` (object): The JSON request body. ### `deleteConnectorWithId` (~33 tokens) Deletes the connector for the given Id. Input parameters: - `connectorId` (string, required): The Id of the connector to delete. ### `patchConnectorWithId` (~49 tokens) Updates, via PATCH, the connector with the given Id. Input parameters: - `connectorId` (string, required): The Id of the connector to update. - `requestBody` (object): The JSON request body. ### `createConsent` (~91 tokens) Creates a user consent type. You can optionally specify an Id for the consent type, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): API request for User consent types. ### `searchConsentsWithId` (~34 tokens) Searches consents with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for Consents ### `retrieveConsentWithId` (~75 tokens) Retrieves the Consent for the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `consentId` (string, required): The Id of the consent. ### `updateConsentWithId` (~91 tokens) Updates the consent with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `consentId` (string, required): The Id of the consent to update. - `requestBody` (object): API request for User consent types. ### `createConsentWithId` (~117 tokens) Creates a user consent type. You can optionally specify an Id for the consent type, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `consentId` (string, required): The Id for the consent. If not provided a secure random UUID will be generated. - `requestBody` (object): API request for User consent types. ### `deleteConsentWithId` (~77 tokens) Deletes the consent for the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `consentId` (string, required): The Id of the consent to delete. ### `patchConsentWithId` (~95 tokens) Updates, via PATCH, the consent with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `consentId` (string, required): The Id of the consent to update. - `requestBody` (object): API request for User consent types. ### `sendEmailWithId` (~67 tokens) Send an email using an email template Id. You can optionally provide requestData to access key value pairs in the email template. Input parameters: - `emailTemplateId` (string, required): The Id for the template. - `requestBody` (object): The JSON request body. ### `retrieveEmailTemplate` (~77 tokens) Retrieves the email template for the given Id. If you don't specify the Id, this will return all the email templates. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. ### `createEmailTemplate` (~87 tokens) Creates an email template. You can optionally specify an Id for the template, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): Email template request. ### `retrieveEmailTemplatePreviewWithId` (~78 tokens) Creates a preview of the email template provided in the request. This allows you to preview an email template that hasn't been saved to the database yet. The entire email template does not need to be provided on the request. This will create the preview based on whatever is given. Input parameters: - `requestBody` (object): The JSON request body. ### `searchEmailTemplatesWithId` (~34 tokens) Searches email templates with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for email templates ### `retrieveEmailTemplateWithId` (~94 tokens) Retrieves the email template for the given Id. If you don't specify the Id, this will return all the email templates. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `emailTemplateId` (string, required): The Id of the email template. ### `updateEmailTemplateWithId` (~92 tokens) Updates the email template with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `emailTemplateId` (string, required): The Id of the email template to update. - `requestBody` (object): Email template request. ### `createEmailTemplateWithId` (~114 tokens) Creates an email template. You can optionally specify an Id for the template, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `emailTemplateId` (string, required): The Id for the template. If not provided a secure random UUID will be generated. - `requestBody` (object): Email template request. ### `deleteEmailTemplateWithId` (~81 tokens) Deletes the email template for the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `emailTemplateId` (string, required): The Id of the email template to delete. ### `patchEmailTemplateWithId` (~96 tokens) Updates, via PATCH, the email template with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `emailTemplateId` (string, required): The Id of the email template to update. - `requestBody` (object): Email template request. ### `createEntity` (~86 tokens) Creates an Entity. You can optionally specify an Id for the Entity. If not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): Entity API request object. ### `searchEntityGrantsWithId` (~35 tokens) Searches Entity Grants with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for entity grants. ### `searchEntitiesByIdsWithId` (~44 tokens) Retrieves the entities for the given Ids. If any Id is invalid, it is ignored. Input parameters: - `ids` (string): The entity ids to search for. ### `searchEntitiesWithId` (~31 tokens) Searches entities with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for entities ### `createEntityType` (~46 tokens) Creates a Entity Type. You can optionally specify an Id for the Entity Type, if not provided one will be generated. Input parameters: - `requestBody` (object): Entity Type API request object. ### `searchEntityTypesWithId` (~35 tokens) Searches the entity types with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for entity types. ### `retrieveEntityTypeWithId` (~35 tokens) Retrieves the Entity Type for the given Id. Input parameters: - `entityTypeId` (string, required): The Id of the Entity Type. ### `updateEntityTypeWithId` (~50 tokens) Updates the Entity Type with the given Id. Input parameters: - `entityTypeId` (string, required): The Id of the Entity Type to update. - `requestBody` (object): Entity Type API request object. ### `createEntityTypeWithId` (~74 tokens) Creates a Entity Type. You can optionally specify an Id for the Entity Type, if not provided one will be generated. Input parameters: - `entityTypeId` (string, required): The Id for the Entity Type. If not provided a secure random UUID will be generated. - `requestBody` (object): Entity Type API request object. ### `deleteEntityTypeWithId` (~37 tokens) Deletes the Entity Type for the given Id. Input parameters: - `entityTypeId` (string, required): The Id of the Entity Type to delete. ### `patchEntityTypeWithId` (~54 tokens) Updates, via PATCH, the Entity Type with the given Id. Input parameters: - `entityTypeId` (string, required): The Id of the Entity Type to update. - `requestBody` (object): Entity Type API request object. ### `createEntityTypePermission` (~93 tokens) Creates a new permission for an entity type. You must specify the Id of the entity type you are creating the permission for. You can optionally specify an Id for the permission inside the EntityTypePermission object itself, if not provided one will be generated. Input parameters: - `entityTypeId` (string, required): The Id of the entity type to create the permission on. - `requestBody` (object): Entity Type API request object. ### `updateEntityTypePermissionWithId` (~72 tokens) Updates the permission with the given Id for the entity type. Input parameters: - `entityTypeId` (string, required): The Id of the entityType that the permission belongs to. - `permissionId` (string, required): The Id of the permission to update. - `requestBody` (object): Entity Type API request object. ### `createEntityTypePermissionWithId` (~119 tokens) Creates a new permission for an entity type. You must specify the Id of the entity type you are creating the permission for. You can optionally specify an Id for the permission inside the EntityTypePermission object itself, if not provided one will be generated. Input parameters: - `entityTypeId` (string, required): The Id of the entity type to create the permission on. - `permissionId` (string, required): The Id of the permission. If not provided a secure random UUID will be generated. - `requestBody` (object): Entity Type API request object. ### `deleteEntityTypePermissionWithId` (~79 tokens) Hard deletes a permission. This is a dangerous operation and should not be used in most circumstances. This permanently removes the given permission from all grants that had it. Input parameters: - `entityTypeId` (string, required): The Id of the entityType the the permission belongs to. - `permissionId` (string, required): The Id of the permission to delete. ### `patchEntityTypePermissionWithId` (~73 tokens) Patches the permission with the given Id for the entity type. Input parameters: - `entityTypeId` (string, required): The Id of the entityType that the permission belongs to. - `permissionId` (string, required): The Id of the permission to patch. - `requestBody` (object): Entity Type API request object. ### `retrieveEntityWithId` (~75 tokens) Retrieves the Entity for the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `entityId` (string, required): The Id of the Entity. ### `updateEntityWithId` (~89 tokens) Updates the Entity with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `entityId` (string, required): The Id of the Entity to update. - `requestBody` (object): Entity API request object. ### `createEntityWithId` (~112 tokens) Creates an Entity. You can optionally specify an Id for the Entity. If not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `entityId` (string, required): The Id for the Entity. If not provided a secure random UUID will be generated. - `requestBody` (object): Entity API request object. ### `deleteEntityWithId` (~77 tokens) Deletes the Entity for the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `entityId` (string, required): The Id of the Entity to delete. ### `patchEntityWithId` (~94 tokens) Updates, via PATCH, the Entity with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `entityId` (string, required): The Id of the Entity Type to update. - `requestBody` (object): Entity API request object. ### `retrieveEntityGrantWithId` (~120 tokens) Retrieves an Entity Grant for the given Entity and User/Entity. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `entityId` (string, required): The Id of the Entity. - `recipientEntityId` (string): The Id of the Entity that the Entity Grant is for. - `userId` (string): The Id of the User that the Entity Grant is for. ### `upsertEntityGrantWithId` (~113 tokens) Creates or updates an Entity Grant. This is when a User/Entity is granted permissions to an Entity. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `entityId` (string, required): The Id of the Entity that the User/Entity is being granted access to. - `requestBody` (object): Entity grant API request object. ### `deleteEntityGrantWithId` (~126 tokens) Deletes an Entity Grant for the given User or Entity. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `entityId` (string, required): The Id of the Entity that the Entity Grant is being deleted for. - `recipientEntityId` (string): The Id of the Entity that the Entity Grant is for. - `userId` (string): The Id of the User that the Entity Grant is for. ### `createForm` (~41 tokens) Creates a form. You can optionally specify an Id for the form, if not provided one will be generated. Input parameters: - `requestBody` (object): Form response. ### `createFormField` (~47 tokens) Creates a form field. You can optionally specify an Id for the form, if not provided one will be generated. Input parameters: - `requestBody` (object): The FormField API request object. ### `retrieveFormFieldWithId` (~34 tokens) Retrieves the form field with the given Id. Input parameters: - `fieldId` (string, required): The Id of the form field. ### `updateFormFieldWithId` (~50 tokens) Updates the form field with the given Id. Input parameters: - `fieldId` (string, required): The Id of the form field to update. - `requestBody` (object): The FormField API request object. ### `createFormFieldWithId` (~74 tokens) Creates a form field. You can optionally specify an Id for the form, if not provided one will be generated. Input parameters: - `fieldId` (string, required): The Id for the form field. If not provided a secure random UUID will be generated. - `requestBody` (object): The FormField API request object. ### `deleteFormFieldWithId` (~36 tokens) Deletes the form field for the given Id. Input parameters: - `fieldId` (string, required): The Id of the form field to delete. ### `patchFormFieldWithId` (~51 tokens) Patches the form field with the given Id. Input parameters: - `fieldId` (string, required): The Id of the form field to patch. - `requestBody` (object): The FormField API request object. ### `retrieveFormWithId` (~31 tokens) Retrieves the form with the given Id. Input parameters: - `formId` (string, required): The Id of the form. ### `updateFormWithId` (~43 tokens) Updates the form with the given Id. Input parameters: - `formId` (string, required): The Id of the form to update. - `requestBody` (object): Form response. ### `createFormWithId` (~67 tokens) Creates a form. You can optionally specify an Id for the form, if not provided one will be generated. Input parameters: - `formId` (string, required): The Id for the form. If not provided a secure random UUID will be generated. - `requestBody` (object): Form response. ### `deleteFormWithId` (~33 tokens) Deletes the form for the given Id. Input parameters: - `formId` (string, required): The Id of the form to delete. ### `patchFormWithId` (~44 tokens) Patches the form with the given Id. Input parameters: - `formId` (string, required): The Id of the form to patch. - `requestBody` (object): Form response. ### `createGroup` (~86 tokens) Creates a group. You can optionally specify an Id for the group, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): Group API request object. ### `updateGroupMembersWithId` (~29 tokens) Creates a member in a group. Input parameters: - `requestBody` (object): Group Member Request ### `createGroupMembersWithId` (~29 tokens) Creates a member in a group. Input parameters: - `requestBody` (object): Group Member Request ### `deleteGroupMembersWithId` (~31 tokens) Removes users as members of a group. Input parameters: - `requestBody` (object): Group Member Delete Request ### `searchGroupMembersWithId` (~34 tokens) Searches group members with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for Group Members. ### `searchGroupsWithId` (~31 tokens) Searches groups with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for Groups. ### `retrieveGroupWithId` (~75 tokens) Retrieves the group for the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `groupId` (string, required): The Id of the group. ### `updateGroupWithId` (~89 tokens) Updates the group with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `groupId` (string, required): The Id of the group to update. - `requestBody` (object): Group API request object. ### `createGroupWithId` (~112 tokens) Creates a group. You can optionally specify an Id for the group, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `groupId` (string, required): The Id for the group. If not provided a secure random UUID will be generated. - `requestBody` (object): Group API request object. ### `deleteGroupWithId` (~77 tokens) Deletes the group for the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `groupId` (string, required): The Id of the group to delete. ### `patchGroupWithId` (~93 tokens) Updates, via PATCH, the group with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `groupId` (string, required): The Id of the group to update. - `requestBody` (object): Group API request object. ### `retrieveSystemHealthWithId` (~41 tokens) Retrieves the FusionAuth system health. This API will return 200 if the system is healthy, and 500 if the system is un-healthy. ### `retrieveIdentityProviderByTypeWithId` (~89 tokens) Retrieves one or more identity provider for the given type. For types such as Google, Facebook, Twitter and LinkedIn, only a single identity provider can exist. For types such as OpenID Connect and SAMLv2 more than one identity provider can be configured so this request may return multiple identity providers. Input parameters: - `type` (string): The type of the identity provider. ### `createIdentityProvider` (~45 tokens) Creates an identity provider. You can optionally specify an Id for the identity provider, if not provided one will be generated. Input parameters: - `requestBody` (object): The JSON request body. ### `retrieveIdentityProviderLink` (~117 tokens) Retrieve all Identity Provider users (links) for the user. Specify the optional identityProviderId to retrieve links for a particular IdP. OR Retrieve a single Identity Provider user (link). Input parameters: - `identityProviderId` (string): The unique Id of the identity provider. Specify this value to reduce the links returned to those for a particular IdP. - `identityProviderUserId` (string): The unique Id of the user in the 3rd party identity provider. - `userId` (string): The unique Id of the user. ### `createUserLinkWithId` (~41 tokens) Link an external user from a 3rd party identity provider to a FusionAuth user. Input parameters: - `requestBody` (object): The JSON request body. ### `deleteUserLinkWithId` (~93 tokens) Remove an existing link that has been made from a 3rd party identity provider to a FusionAuth user. Input parameters: - `identityProviderId` (string): The unique Id of the identity provider. - `identityProviderUserId` (string): The unique Id of the user in the 3rd party identity provider to unlink. - `userId` (string): The unique Id of the FusionAuth user to unlink. ### `retrievePendingLinkWithId` (~81 tokens) Retrieve a pending identity provider link. This is useful to validate a pending link and retrieve meta-data about the identity provider link. Input parameters: - `pendingLinkId` (string, required): The pending link Id. - `userId` (string): The optional userId. When provided additional meta-data will be provided to identify how many links if any the user already has. ### `identityProviderLoginWithId` (~103 tokens) Handles login via third-parties including Social login, external OAuth and OpenID Connect, and other login systems. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): Login API request object used for login to third-party systems (i.e. Login with Facebook). ### `lookupIdentityProviderWithId` (~60 tokens) Retrieves the identity provider for the given domain. A 200 response code indicates the domain is managed by a registered identity provider. A 404 indicates the domain is not managed. Input parameters: - `domain` (string): The domain or email address to lookup. ### `searchIdentityProvidersWithId` (~34 tokens) Searches identity providers with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for Identity Providers ### `startIdentityProviderLoginWithId` (~44 tokens) Begins a login request for a 3rd party login that requires user interaction such as HYPR. Input parameters: - `requestBody` (object): The JSON request body. ### `retrieveIdentityProviderWithId` (~43 tokens) Retrieves the identity provider for the given Id or all the identity providers if the Id is null. Input parameters: - `identityProviderId` (string, required): The identity provider Id. ### `updateIdentityProviderWithId` (~49 tokens) Updates the identity provider with the given Id. Input parameters: - `identityProviderId` (string, required): The Id of the identity provider to update. - `requestBody` (object): The JSON request body. ### `createIdentityProviderWithId` (~73 tokens) Creates an identity provider. You can optionally specify an Id for the identity provider, if not provided one will be generated. Input parameters: - `identityProviderId` (string, required): The Id of the identity provider. If not provided a secure random UUID will be generated. - `requestBody` (object): The JSON request body. ### `deleteIdentityProviderWithId` (~37 tokens) Deletes the identity provider for the given Id. Input parameters: - `identityProviderId` (string, required): The Id of the identity provider to delete. ### `patchIdentityProviderWithId` (~53 tokens) Updates, via PATCH, the identity provider with the given Id. Input parameters: - `identityProviderId` (string, required): The Id of the identity provider to update. - `requestBody` (object): The JSON request body. ### `verifyIdentityWithId` (~36 tokens) Administratively verify a user identity. Input parameters: - `requestBody` (object): Identity verify request. Used to administratively verify an identity. ### `completeVerifyIdentityWithId` (~39 tokens) Completes verification of an identity using verification codes from the Verify Start API. Input parameters: - `requestBody` (object): Verify Complete API request object. ### `sendVerifyIdentityWithId` (~39 tokens) Send a verification code using the appropriate transport for the identity type being verified. Input parameters: - `requestBody` (object): Verify Send API request object. ### `startVerifyIdentityWithId` (~73 tokens) Start a verification of an identity by generating a code. This code can be sent to the User using the Verify Send API Verification Code API or using a mechanism outside of FusionAuth. The verification is completed by using the Verify Complete API with this code. Input parameters: - `requestBody` (object): The JSON request body. ### `updateIntegrationsWithId` (~27 tokens) Updates the available integrations. Input parameters: - `requestBody` (object): The Integration Request ### `patchIntegrationsWithId` (~31 tokens) Updates, via PATCH, the available integrations. Input parameters: - `requestBody` (object): The Integration Request ### `createIPAccessControlList` (~51 tokens) Creates an IP Access Control List. You can optionally specify an Id on this create request, if one is not provided one will be generated. Input parameters: - `requestBody` (object): The JSON request body. ### `searchIPAccessControlListsWithId` (~40 tokens) Searches the IP Access Control Lists with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for IP ACLs . ### `updateIPAccessControlListWithId` (~56 tokens) Updates the IP Access Control List with the given Id. Input parameters: - `accessControlListId` (string, required): The Id of the IP Access Control List to update. - `requestBody` (object): The JSON request body. ### `createIPAccessControlListWithId` (~82 tokens) Creates an IP Access Control List. You can optionally specify an Id on this create request, if one is not provided one will be generated. Input parameters: - `accessControlListId` (string, required): The Id for the IP Access Control List. If not provided a secure random UUID will be generated. - `requestBody` (object): The JSON request body. ### `patchIPAccessControlListWithId` (~56 tokens) Update the IP Access Control List with the given Id. Input parameters: - `accessControlListId` (string, required): The Id of the IP Access Control List to patch. - `requestBody` (object): The JSON request body. ### `retrieveIPAccessControlListWithId` (~43 tokens) Retrieves the IP Access Control List with the given Id. Input parameters: - `ipAccessControlListId` (string, required): The Id of the IP Access Control List. ### `deleteIPAccessControlListWithId` (~45 tokens) Deletes the IP Access Control List for the given Id. Input parameters: - `ipAccessControlListId` (string, required): The Id of the IP Access Control List to delete. ### `issueJWTWithId` (~150 tokens) Issue a new access token (JWT) for the requested Application after ensuring the provided JWT is valid. A valid access token is properly signed and not expired.

This API may be used in an SSO configuration to issue new tokens for another application after the user has obtained a valid token from authentication. Input parameters: - `applicationId` (string): The Application Id for which you are requesting a new access token be issued. - `refreshToken` (string): An existing refresh token used to request a refresh token in addition to a JWT in the response.

The target application represented by the applicationId request parameter must have refresh tokens e… ### `retrieveJwtPublicKey` (~90 tokens) Retrieves the Public Key configured for verifying the JSON Web Tokens (JWT) issued by the Login API by the Application Id. OR Retrieves the Public Key configured for verifying JSON Web Tokens (JWT) by the key Id (kid). Input parameters: - `applicationId` (string): The Id of the Application for which this key is used. - `keyId` (string): The Id of the public key (kid). ### `reconcileJWTWithId` (~51 tokens) Reconcile a User to FusionAuth using JWT issued from another Identity Provider. Input parameters: - `requestBody` (object): Login API request object used for login to third-party systems (i.e. Login with Facebook). ### `retrieveRefreshTokensWithId` (~38 tokens) Retrieves the refresh tokens that belong to the user with the given Id. Input parameters: - `userId` (string): The Id of the user. ### `exchangeRefreshTokenForJWTWithId` (~34 tokens) Exchange a refresh token for a new JWT. Input parameters: - `requestBody` (object): The JSON request body. ### `deleteJwtRefresh` (~413 tokens) Revokes refresh tokens using the information in the JSON body. The handling for this method is the same as the revokeRefreshToken method and is based on the information you provide in the RefreshDeleteRequest object. See that method for additional information. OR Revoke all refresh tokens that belong to a user by user Id for a specific application by applicationId. OR Revoke all refresh tokens that belong to a user by user Id. OR Revoke all refresh tokens that belong to an application by applicationId. OR Revokes a single refresh token by using the actual refresh token value. This refresh token value is sensitive, so be careful with this API request. OR Revokes refresh tokens. Usage examples: - Delete a single refresh token, pass in only the token. revokeRefreshToken(token) - Delete all refresh tokens for a user, pass in only the userId. revokeRefreshToken(null, userId) - Delete all refresh tokens for a user for a specific application, pass in both the userId and the applicationId. revokeRefreshToken(null, userId, applicationId) - Delete all refresh tokens for an application revokeRefreshToken(null, null, applicationId) Note: null may be handled differently depending upon the programming language. See also: (method names may vary by language... but you'll figure it out) - revokeRefreshTokenById - revokeRefreshTokenByToken - revokeRefreshTokensByUserId - revokeRefreshTokensByApplicationId - revokeRefreshTokensByUserIdForApplication Input parameters: - `applicationId` (string): The unique Id of the application that you want to delete refresh tokens for. - `requestBody` (object): Request for the Refresh Token API to revoke a refresh token rather than using the URL parameters. - `token` (string): The refresh token to delete. - `userId` (string): The unique Id of the user that you want to delete all refresh tokens for. ### `retrieveRefreshTokenByIdWithId` (~62 tokens) Retrieves a single refresh token by unique Id. This is not the same thing as the string value of the refresh token. If you have that, you already have what you need. Input parameters: - `tokenId` (string, required): The Id of the token. ### `revokeRefreshTokenByIdWithId` (~56 tokens) Revokes a single refresh token by the unique Id. The unique Id is not sensitive as it cannot be used to obtain another JWT. Input parameters: - `tokenId` (string, required): The unique Id of the token to delete. ### `validateJWTWithId` (~63 tokens) Validates the provided JWT (encoded JWT string) to ensure the token is valid. A valid access token is properly signed and not expired.

This API may be used to verify the JWT as well as decode the encoded JWT into human readable identity claims. ### `vendJWTWithId` (~150 tokens) It's a JWT vending machine! Issue a new access token (JWT) with the provided claims in the request. This JWT is not scoped to a tenant or user, it is a free form token that will contain what claims you provide.

The iat, exp and jti claims will be added by FusionAuth, all other claims must be provided by the caller. If a TTL is not provided in the request, the TTL will be retrieved from the default Tenant or the Tenant specified on the request either by way of the X-FusionAuth-TenantId request header, or a tenant scoped API key. Input parameters: - `requestBody` (object): The JSON request body. ### `retrieveKeysWithId` (~15 tokens) Retrieves all the keys. ### `generateKey` (~34 tokens) Generate a new RSA or EC key pair or an HMAC secret. Input parameters: - `requestBody` (object): Key API request object. ### `generateKeyWithId` (~60 tokens) Generate a new RSA or EC key pair or an HMAC secret. Input parameters: - `keyId` (string, required): The Id for the key. If not provided a secure random UUID will be generated. - `requestBody` (object): Key API request object. ### `importKey` (~34 tokens) Import an existing RSA or EC key pair or an HMAC secret. Input parameters: - `requestBody` (object): Key API request object. ### `importKeyWithId` (~60 tokens) Import an existing RSA or EC key pair or an HMAC secret. Input parameters: - `keyId` (string, required): The Id for the key. If not provided a secure random UUID will be generated. - `requestBody` (object): Key API request object. ### `searchKeysWithId` (~31 tokens) Searches keys with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for Keys ### `retrieveKeyWithId` (~31 tokens) Retrieves the key for the given Id. Input parameters: - `keyId` (string, required): The Id of the key. ### `updateKeyWithId` (~45 tokens) Updates the key with the given Id. Input parameters: - `keyId` (string, required): The Id of the key to update. - `requestBody` (object): Key API request object. ### `deleteKeyWithId` (~33 tokens) Deletes the key for the given Id. Input parameters: - `keyId` (string, required): The Id of the key to delete. ### `retrieveLambdasByTypeWithId` (~38 tokens) Retrieves all the lambdas for the provided type. Input parameters: - `type` (string): The type of the lambda to return. ### `createLambda` (~42 tokens) Creates a Lambda. You can optionally specify an Id for the lambda, if not provided one will be generated. Input parameters: - `requestBody` (object): Lambda API request object. ### `searchLambdasWithId` (~35 tokens) Searches lambdas with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for Lambdas ### `retrieveLambdaWithId` (~31 tokens) Retrieves the lambda for the given Id. Input parameters: - `lambdaId` (string, required): The Id of the lambda. ### `updateLambdaWithId` (~45 tokens) Updates the lambda with the given Id. Input parameters: - `lambdaId` (string, required): The Id of the lambda to update. - `requestBody` (object): Lambda API request object. ### `createLambdaWithId` (~68 tokens) Creates a Lambda. You can optionally specify an Id for the lambda, if not provided one will be generated. Input parameters: - `lambdaId` (string, required): The Id for the lambda. If not provided a secure random UUID will be generated. - `requestBody` (object): Lambda API request object. ### `deleteLambdaWithId` (~33 tokens) Deletes the lambda for the given Id. Input parameters: - `lambdaId` (string, required): The Id of the lambda to delete. ### `patchLambdaWithId` (~49 tokens) Updates, via PATCH, the lambda with the given Id. Input parameters: - `lambdaId` (string, required): The Id of the lambda to update. - `requestBody` (object): Lambda API request object. ### `loginPingWithRequestWithId` (~135 tokens) Sends a ping to FusionAuth indicating that the user was automatically logged into an application. When using FusionAuth's SSO or your own, you should call this if the user is already logged in centrally, but accesses an application where they no longer have a session. This helps correctly track login counts, times and helps with reporting. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): Login Ping API request object. ### `loginWithId` (~95 tokens) Authenticates a user to FusionAuth. This API optionally requires an API key. See Application.loginConfiguration.requireAuthentication. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): Login API request object. ### `loginPingWithId` (~196 tokens) Sends a ping to FusionAuth indicating that the user was automatically logged into an application. When using FusionAuth's SSO or your own, you should call this if the user is already logged in centrally, but accesses an application where they no longer have a session. This helps correctly track login counts, times and helps with reporting. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application that they logged into. - `callerIPAddress` (string): The IP address of the end-user that is logging in. If a null value is provided the IP address will be that of the client or last proxy that sent the request. - `userId` (string, required): The Id of the user that was logged in. ### `createLogout` (~181 tokens) The Logout API is intended to be used to remove the refresh token and access token cookies if they exist on the client and revoke the refresh token stored. This API takes the refresh token in the JSON body. OR The Logout API is intended to be used to remove the refresh token and access token cookies if they exist on the client and revoke the refresh token stored. This API does nothing if the request does not contain an access token or refresh token cookies. Input parameters: - `global` (string): When this value is set to true all the refresh tokens issued to the owner of the provided token will be revoked. - `refreshToken` (string): The refresh_token as a request parameter instead of coming in via a cookie. If provided this takes precedence over the cookie. - `requestBody` (object): Request for the Logout API that can be used as an alternative to URL parameters. ### `retrieveMessageTemplate` (~33 tokens) Retrieves the message template for the given Id. If you don't specify the Id, this will return all the message templates. ### `createMessageTemplate` (~47 tokens) Creates an message template. You can optionally specify an Id for the template, if not provided one will be generated. Input parameters: - `requestBody` (object): A Message Template Request to the API ### `retrieveMessageTemplatePreviewWithId` (~42 tokens) Creates a preview of the message template provided in the request, normalized to a given locale. Input parameters: - `requestBody` (object): The JSON request body. ### `retrieveMessageTemplateWithId` (~50 tokens) Retrieves the message template for the given Id. If you don't specify the Id, this will return all the message templates. Input parameters: - `messageTemplateId` (string, required): The Id of the message template. ### `updateMessageTemplateWithId` (~52 tokens) Updates the message template with the given Id. Input parameters: - `messageTemplateId` (string, required): The Id of the message template to update. - `requestBody` (object): A Message Template Request to the API ### `createMessageTemplateWithId` (~74 tokens) Creates an message template. You can optionally specify an Id for the template, if not provided one will be generated. Input parameters: - `messageTemplateId` (string, required): The Id for the template. If not provided a secure random UUID will be generated. - `requestBody` (object): A Message Template Request to the API ### `deleteMessageTemplateWithId` (~37 tokens) Deletes the message template for the given Id. Input parameters: - `messageTemplateId` (string, required): The Id of the message template to delete. ### `patchMessageTemplateWithId` (~56 tokens) Updates, via PATCH, the message template with the given Id. Input parameters: - `messageTemplateId` (string, required): The Id of the message template to update. - `requestBody` (object): A Message Template Request to the API ### `createMessenger` (~43 tokens) Creates a messenger. You can optionally specify an Id for the messenger, if not provided one will be generated. Input parameters: - `requestBody` (object): The JSON request body. ### `retrieveMessengerWithId` (~31 tokens) Retrieves the messenger with the given Id. Input parameters: - `messengerId` (string, required): The Id of the messenger. ### `updateMessengerWithId` (~45 tokens) Updates the messenger with the given Id. Input parameters: - `messengerId` (string, required): The Id of the messenger to update. - `requestBody` (object): The JSON request body. ### `createMessengerWithId` (~69 tokens) Creates a messenger. You can optionally specify an Id for the messenger, if not provided one will be generated. Input parameters: - `messengerId` (string, required): The Id for the messenger. If not provided a secure random UUID will be generated. - `requestBody` (object): The JSON request body. ### `deleteMessengerWithId` (~33 tokens) Deletes the messenger for the given Id. Input parameters: - `messengerId` (string, required): The Id of the messenger to delete. ### `patchMessengerWithId` (~49 tokens) Updates, via PATCH, the messenger with the given Id. Input parameters: - `messengerId` (string, required): The Id of the messenger to update. - `requestBody` (object): The JSON request body. ### `passwordlessLoginWithId` (~33 tokens) Complete a login request using a passwordless code Input parameters: - `requestBody` (object): The JSON request body. ### `sendPasswordlessCodeWithId` (~37 tokens) Send a passwordless authentication code in an email to complete login. Input parameters: - `requestBody` (object): The JSON request body. ### `startPasswordlessLoginWithId` (~78 tokens) Start a passwordless login request by generating a passwordless code. This code can be sent to the User using the Send Passwordless Code API or using a mechanism outside of FusionAuth. The passwordless login is completed by using the Passwordless Login API with this code. Input parameters: - `requestBody` (object): The JSON request body. ### `activateReactorWithId` (~49 tokens) Activates the FusionAuth Reactor using a license Id and optionally a license text (for air-gapped deployments) Input parameters: - `requestBody` (object): Request for managing FusionAuth Reactor and licenses. ### `retrieveReactorMetricsWithId` (~19 tokens) Retrieves the FusionAuth Reactor metrics. ### `retrieveDailyActiveReportWithId` (~84 tokens) Retrieves the daily active user report between the two instants. If you specify an application Id, it will only return the daily active counts for that application. Input parameters: - `applicationId` (string): The application Id. - `end` (string): The end instant as UTC milliseconds since Epoch. - `start` (string): The start instant as UTC milliseconds since Epoch. ### `retrieveReportLogin` (~236 tokens) Retrieves the login report between the two instants for a particular user by login Id, using specific loginIdTypes. If you specify an application id, it will only return the login counts for that application. OR Retrieves the login report between the two instants for a particular user by login Id. If you specify an application Id, it will only return the login counts for that application. OR Retrieves the login report between the two instants for a particular user by Id. If you specify an application Id, it will only return the login counts for that application. OR Retrieves the login report between the two instants. If you specify an application Id, it will only return the login counts for that application. Input parameters: - `applicationId` (string): The application id. - `end` (string): The end instant as UTC milliseconds since Epoch. - `loginId` (string): The userId id. - `loginIdTypes` (array): the identity types that FusionAuth will compare the loginId to. - `start` (string): The start instant as UTC milliseconds since Epoch. - `userId` (string): The userId Id. ### `retrieveMonthlyActiveReportWithId` (~84 tokens) Retrieves the monthly active user report between the two instants. If you specify an application Id, it will only return the monthly active counts for that application. Input parameters: - `applicationId` (string): The application Id. - `end` (string): The end instant as UTC milliseconds since Epoch. - `start` (string): The start instant as UTC milliseconds since Epoch. ### `retrieveRegistrationReportWithId` (~80 tokens) Retrieves the registration report between the two instants. If you specify an application Id, it will only return the registration counts for that application. Input parameters: - `applicationId` (string): The application Id. - `end` (string): The end instant as UTC milliseconds since Epoch. - `start` (string): The start instant as UTC milliseconds since Epoch. ### `retrieveTotalReportWithId` (~31 tokens) Retrieves the totals report. This contains all the total counts for each application and the global registration count. ### `retrieveStatus` (~84 tokens) Retrieves the FusionAuth system status using an API key. Using an API key will cause the response to include the product version, health checks and various runtime metrics. OR Retrieves the FusionAuth system status. This request is anonymous and does not require an API key. When an API key is not provided the response will contain a single value in the JSON response indicating the current health check. ### `updateSystemConfigurationWithId` (~30 tokens) Updates the system configuration. Input parameters: - `requestBody` (object): Request for the system configuration API. ### `patchSystemConfigurationWithId` (~34 tokens) Updates, via PATCH, the system configuration. Input parameters: - `requestBody` (object): Request for the system configuration API. ### `createAuditLogWithId` (~89 tokens) Creates an audit log with the message and user name (usually an email). Audit logs should be written anytime you make changes to the FusionAuth database. When using the FusionAuth App web interface, any changes are automatically written to the audit log. However, if you are accessing the API, you must write the audit logs yourself. Input parameters: - `requestBody` (object): The JSON request body. ### `searchAuditLogsWithId` (~34 tokens) Searches the audit logs with the specified criteria and pagination. Input parameters: - `requestBody` (object): The JSON request body. ### `retrieveAuditLogWithId` (~38 tokens) Retrieves a single audit log for the given Id. Input parameters: - `auditLogId` (string, required): The Id of the audit log to retrieve. ### `searchEventLogsWithId` (~34 tokens) Searches the event logs with the specified criteria and pagination. Input parameters: - `requestBody` (object): The JSON request body. ### `retrieveEventLogWithId` (~38 tokens) Retrieves a single event log for the given Id. Input parameters: - `eventLogId` (string, required): The Id of the event log to retrieve. ### `searchLoginRecordsWithId` (~34 tokens) Searches the login records with the specified criteria and pagination. Input parameters: - `requestBody` (object): The JSON request body. ### `reindexWithId` (~108 tokens) Requests Elasticsearch to delete and rebuild the index for FusionAuth users or entities. Be very careful when running this request as it will increase the CPU and I/O load on your database until the operation completes. Generally speaking you do not ever need to run this operation unless instructed by FusionAuth support, or if you are migrating a database another system and you are not brining along the Elasticsearch index. You have been warned. Input parameters: - `requestBody` (object): Reindex API request ### `retrieveVersionWithId` (~17 tokens) Retrieves the FusionAuth version string. ### `retrieveWebhookAttemptLogWithId` (~42 tokens) Retrieves a single webhook attempt log for the given Id. Input parameters: - `webhookAttemptLogId` (string, required): The Id of the webhook attempt log to retrieve. ### `searchWebhookEventLogsWithId` (~38 tokens) Searches the webhook event logs with the specified criteria and pagination. Input parameters: - `requestBody` (object): Webhook event log search request. ### `retrieveWebhookEventLogWithId` (~42 tokens) Retrieves a single webhook event log for the given Id. Input parameters: - `webhookEventLogId` (string, required): The Id of the webhook event log to retrieve. ### `createTenant` (~86 tokens) Creates a tenant. You can optionally specify an Id for the tenant, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): The JSON request body. ### `retrievePasswordValidationRulesWithId` (~68 tokens) Retrieves the password validation rules for a specific tenant. This method requires a tenantId to be provided through the use of a Tenant scoped API key or an HTTP header X-FusionAuth-TenantId to specify the Tenant Id. This API does not require an API key. ### `retrievePasswordValidationRulesWithTenantIdWithId` (~48 tokens) Retrieves the password validation rules for a specific tenant. This API does not require an API key. Input parameters: - `tenantId` (string, required): The Id of the tenant. ### `searchTenantsWithId` (~33 tokens) Searches tenants with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for Tenants ### `retrieveTenantWithId` (~75 tokens) Retrieves the tenant for the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `tenantId` (string, required): The Id of the tenant. ### `updateTenantWithId` (~89 tokens) Updates the tenant with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): The JSON request body. - `tenantId` (string, required): The Id of the tenant to update. ### `createTenantWithId` (~112 tokens) Creates a tenant. You can optionally specify an Id for the tenant, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): The JSON request body. - `tenantId` (string, required): The Id for the tenant. If not provided a secure random UUID will be generated. ### `deleteTenantWithId` (~210 tokens) Deletes the tenant based on the given request (sent to the API as JSON). This permanently deletes all information, metrics, reports and data associated with the tenant and everything under the tenant (applications, users, etc). OR Deletes the tenant for the given Id asynchronously. This method is helpful if you do not want to wait for the delete operation to complete. OR Deletes the tenant based on the given Id on the URL. This permanently deletes all information, metrics, reports and data associated with the tenant and everything under the tenant (applications, users, etc). Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `async` (string) - `requestBody` (object): Request for the Tenant API to delete a tenant rather than using the URL parameters. - `tenantId` (string, required): The Id of the tenant to delete. ### `patchTenantWithId` (~93 tokens) Updates, via PATCH, the tenant with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): The JSON request body. - `tenantId` (string, required): The Id of the tenant to update. ### `createTheme` (~42 tokens) Creates a Theme. You can optionally specify an Id for the theme, if not provided one will be generated. Input parameters: - `requestBody` (object): Theme API request object. ### `searchThemesWithId` (~31 tokens) Searches themes with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for Themes. ### `retrieveThemeWithId` (~31 tokens) Retrieves the theme for the given Id. Input parameters: - `themeId` (string, required): The Id of the theme. ### `updateThemeWithId` (~45 tokens) Updates the theme with the given Id. Input parameters: - `requestBody` (object): Theme API request object. - `themeId` (string, required): The Id of the theme to update. ### `createThemeWithId` (~68 tokens) Creates a Theme. You can optionally specify an Id for the theme, if not provided one will be generated. Input parameters: - `requestBody` (object): Theme API request object. - `themeId` (string, required): The Id for the theme. If not provided a secure random UUID will be generated. ### `deleteThemeWithId` (~33 tokens) Deletes the theme for the given Id. Input parameters: - `themeId` (string, required): The Id of the theme to delete. ### `patchThemeWithId` (~49 tokens) Updates, via PATCH, the theme with the given Id. Input parameters: - `requestBody` (object): Theme API request object. - `themeId` (string, required): The Id of the theme to update. ### `twoFactorLoginWithId` (~32 tokens) Complete login using a 2FA challenge Input parameters: - `requestBody` (object): The JSON request body. ### `generateTwoFactorSecretUsingJWTWithId` (~69 tokens) Generate a Two Factor secret that can be used to enable Two Factor authentication for a User. The response will contain both the secret and a Base32 encoded form of the secret which can be shown to a User when using a 2 Step Authentication application such as Google Authenticator. ### `sendTwoFactorCodeForEnableDisableWithId` (~44 tokens) Send a Two Factor authentication code to assist in setting up Two Factor authentication or disabling. Input parameters: - `requestBody` (object): The JSON request body. ### `sendTwoFactorCodeForLoginUsingMethodWithId` (~65 tokens) Send a Two Factor authentication code to allow the completion of Two Factor authentication. Input parameters: - `requestBody` (object): The JSON request body. - `twoFactorId` (string, required): The Id returned by the Login API necessary to complete Two Factor authentication. ### `startTwoFactorLoginWithId` (~156 tokens) Start a Two-Factor login request by generating a two-factor identifier. This code can then be sent to the Two Factor Send API (/api/two-factor/send)in order to send a one-time use code to a user. You can also use one-time use code returned to send the code out-of-band. The Two-Factor login is completed by making a request to the Two-Factor Login API (/api/two-factor/login). with the two-factor identifier and the one-time use code. This API is intended to allow you to begin a Two-Factor login outside a normal login that originated from the Login API (/api/login). Input parameters: - `requestBody` (object): The JSON request body. ### `retrieveTwoFactorStatusWithId` (~106 tokens) Retrieve a user's two-factor status. This can be used to see if a user will need to complete a two-factor challenge to complete a login, and optionally identify the state of the two-factor trust across various applications. Input parameters: - `applicationId` (string): The optional applicationId to verify. - `twoFactorTrustId` (string, required): The optional two-factor trust Id to verify. - `userId` (string): The user Id to retrieve the Two-Factor status. ### `retrieveUser` (~321 tokens) Retrieves the user for the given Id. This method does not use an API key, instead it uses a JSON Web Token (JWT) for authentication. OR Retrieves the user by a verificationId. The intended use of this API is to retrieve a user after the forgot password workflow has been initiated and you may not know the user's email or username. OR Retrieves the user for the given username. OR Retrieves the user for the loginId, using specific loginIdTypes. OR Retrieves the user for the loginId. The loginId can be either the username or the email. OR Retrieves the user for the given email. OR Retrieves the user by a change password Id. The intended use of this API is to retrieve a user after the forgot password workflow has been initiated and you may not know the user's email or username. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `changePasswordId` (string): The unique change password Id that was sent via email or returned by the Forgot Password API. - `email` (string): The email of the user. - `loginId` (string): The email or username of the user. - `loginIdTypes` (array): the identity types that FusionAuth will compare the loginId to. - `username` (string): The username of the user. - `verificationId` (string): The unique verification Id that has been set on the user object. ### `createUser` (~86 tokens) Creates a user. You can optionally specify an Id for the user, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): User API request object. ### `retrieveUserAction` (~97 tokens) Retrieves the user action for the given Id. If you pass in null for the Id, this will return all the user actions. OR Retrieves all the user actions that are currently inactive. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `inactive` (string) ### `createUserAction` (~98 tokens) Creates a user action. This action cannot be taken on a user until this call successfully returns. Anytime after that the user action can be applied to any user. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): User Action API request object. ### `retrieveUserActionReason` (~38 tokens) Retrieves the user action reason for the given Id. If you pass in null for the Id, this will return all the user action reasons. ### `createUserActionReason` (~58 tokens) Creates a user reason. This user action reason cannot be used when actioning a user until this call completes successfully. Anytime after that the user action reason can be used. Input parameters: - `requestBody` (object): User Action Reason API request object. ### `retrieveUserActionReasonWithId` (~57 tokens) Retrieves the user action reason for the given Id. If you pass in null for the Id, this will return all the user action reasons. Input parameters: - `userActionReasonId` (string, required): The Id of the user action reason. ### `updateUserActionReasonWithId` (~55 tokens) Updates the user action reason with the given Id. Input parameters: - `requestBody` (object): User Action Reason API request object. - `userActionReasonId` (string, required): The Id of the user action reason to update. ### `createUserActionReasonWithId` (~88 tokens) Creates a user reason. This user action reason cannot be used when actioning a user until this call completes successfully. Anytime after that the user action reason can be used. Input parameters: - `requestBody` (object): User Action Reason API request object. - `userActionReasonId` (string, required): The Id for the user action reason. If not provided a secure random UUID will be generated. ### `deleteUserActionReasonWithId` (~41 tokens) Deletes the user action reason for the given Id. Input parameters: - `userActionReasonId` (string, required): The Id of the user action reason to delete. ### `patchUserActionReasonWithId` (~59 tokens) Updates, via PATCH, the user action reason with the given Id. Input parameters: - `requestBody` (object): User Action Reason API request object. - `userActionReasonId` (string, required): The Id of the user action reason to update. ### `retrieveUserActionWithId` (~96 tokens) Retrieves the user action for the given Id. If you pass in null for the Id, this will return all the user actions. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `userActionId` (string, required): The Id of the user action. ### `updateUserActionWithId` (~114 tokens) Updates the user action with the given Id. OR Reactivates the user action with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `reactivate` (string) - `requestBody` (object): User Action API request object. - `userActionId` (string, required): The Id of the user action to update. ### `createUserActionWithId` (~126 tokens) Creates a user action. This action cannot be taken on a user until this call successfully returns. Anytime after that the user action can be applied to any user. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): User Action API request object. - `userActionId` (string, required): The Id for the user action. If not provided a secure random UUID will be generated. ### `deleteUserActionWithId` (~122 tokens) Deletes the user action for the given Id. This permanently deletes the user action and also any history and logs of the action being applied to any users. OR Deactivates the user action with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `hardDelete` (string) - `userActionId` (string, required): The Id of the user action to delete. ### `patchUserActionWithId` (~98 tokens) Updates, via PATCH, the user action with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): User Action API request object. - `userActionId` (string, required): The Id of the user action to update. ### `retrieveUserActioning` (~175 tokens) Retrieves all the actions for the user with the given Id that are currently inactive. An inactive action means one that is time based and has been canceled or has expired, or is not time based. OR Retrieves all the actions for the user with the given Id that are currently active. An active action means one that is time based and has not been canceled, and has not ended. OR Retrieves all the actions for the user with the given Id that are currently preventing the User from logging in. OR Retrieves all the actions for the user with the given Id. This will return all time based actions that are active, and inactive as well as non-time based actions. Input parameters: - `active` (string) - `preventingLogin` (string) - `userId` (string): The Id of the user to fetch the actions for. ### `actionUserWithId` (~65 tokens) Takes an action on a user. The user being actioned is called the "actionee" and the user taking the action is called the "actioner". Both user ids are required in the request object. Input parameters: - `requestBody` (object): The user action request object. ### `retrieveActionWithId` (~50 tokens) Retrieves a single action log (the log of a user action that was taken on a user previously) for the given Id. Input parameters: - `actionId` (string, required): The Id of the action to retrieve. ### `modifyActionWithId` (~69 tokens) Modifies a temporal user action by changing the expiration of the action and optionally adding a comment to the action. Input parameters: - `actionId` (string, required): The Id of the action to modify. This is technically the user action log Id. - `requestBody` (object): The user action request object. ### `cancelActionWithId` (~45 tokens) Cancels the user action. Input parameters: - `actionId` (string, required): The action Id of the action to cancel. - `requestBody` (object): The user action request object. ### `deleteUserBulk` (~164 tokens) Deletes the users with the given Ids, or users matching the provided JSON query or queryString. The order of preference is Ids, query and then queryString, it is recommended to only provide one of the three for the request. This method can be used to deactivate or permanently delete (hard-delete) users based upon the hardDelete boolean in the request body. Using the dryRun parameter you may also request the result of the action without actually deleting or deactivating any users. OR Deactivates the users with the given Ids. Input parameters: - `dryRun` (string) - `hardDelete` (string) - `requestBody` (object): User API delete request object. - `userIds` (string): The ids of the users to deactivate. ### `retrieveUserChangePassword` (~228 tokens) Check to see if the user must obtain a Trust Request Id in order to complete a change password request. When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change your password, you must obtain a Trust Request Id by completing a Two-Factor Step-Up authentication. An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API. OR Check to see if the user must obtain a Trust Token Id in order to complete a change password request. When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change your password, you must obtain a Trust Token by completing a Two-Factor Step-Up authentication. An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API. Input parameters: - `loginId` (string): The loginId of the User that you intend to change the password for. ### `createUserChangePassword` (~135 tokens) Changes a user's password using their access token (JWT) instead of the changePasswordId A common use case for this method will be if you want to allow the user to change their own password. Remember to send refreshToken in the request body if you want to get a new refresh token when login using the returned oneTimePassword. OR Changes a user's password using their identity (loginId and password). Using a loginId instead of the changePasswordId bypasses the email verification and allows a password to be changed directly without first calling the #forgotPassword method. Input parameters: - `requestBody` (object): Change password request object. ### `checkChangePasswordUsingIdWithId` (~144 tokens) Check to see if the user must obtain a Trust Token Id in order to complete a change password request. When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change your password, you must obtain a Trust Token by completing a Two-Factor Step-Up authentication. An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API. Input parameters: - `changePasswordId` (string, required): The change password Id used to find the user. This value is generated by FusionAuth once the change password workflow has been initiated. ### `changePasswordWithId` (~129 tokens) Changes a user's password using the change password Id. This usually occurs after an email has been sent to the user and they clicked on a link to reset their password. As of version 1.32.2, prefer sending the changePasswordId in the request body. To do this, omit the first parameter, and set the value in the request body. Input parameters: - `changePasswordId` (string, required): The change password Id used to find the user. This value is generated by FusionAuth once the change password workflow has been initiated. - `requestBody` (object): Change password request object. ### `commentOnUserWithId` (~75 tokens) Adds a comment to the user's account. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): The JSON request body. ### `searchUserCommentsWithId` (~34 tokens) Searches user comments with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for user comments ### `retrieveUserCommentsWithId` (~80 tokens) Retrieves all the comments for the user with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `userId` (string, required): The Id of the user. ### `retrieveUserConsentsWithId` (~33 tokens) Retrieves all the consents for a User. Input parameters: - `userId` (string): The User's Id ### `createUserConsent` (~28 tokens) Creates a single User consent. Input parameters: - `requestBody` (object): API response for User consent. ### `retrieveUserConsentWithId` (~32 tokens) Retrieve a single User consent by Id. Input parameters: - `userConsentId` (string, required): The User consent Id ### `updateUserConsentWithId` (~45 tokens) Updates a single User consent by Id. Input parameters: - `requestBody` (object): API response for User consent. - `userConsentId` (string, required): The User Consent Id ### `createUserConsentWithId` (~56 tokens) Creates a single User consent. Input parameters: - `requestBody` (object): API response for User consent. - `userConsentId` (string, required): The Id for the User consent. If not provided a secure random UUID will be generated. ### `revokeUserConsentWithId` (~33 tokens) Revokes a single User consent by Id. Input parameters: - `userConsentId` (string, required): The User Consent Id ### `patchUserConsentWithId` (~49 tokens) Updates, via PATCH, a single User consent by Id. Input parameters: - `requestBody` (object): API response for User consent. - `userConsentId` (string, required): The User Consent Id ### `retrieveFamiliesWithId` (~76 tokens) Retrieves all the families that a user belongs to. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `userId` (string): The User's id ### `createFamily` (~105 tokens) Creates a family with the user Id in the request as the owner and sole member of the family. You can optionally specify an Id for the family, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): API request for managing families and members. ### `retrievePendingChildrenWithId` (~35 tokens) Retrieves all the children for the given parent email address. Input parameters: - `parentEmail` (string): The email of the parent. ### `sendFamilyRequestEmailWithId` (~59 tokens) Sends out an email to a parent that they need to register and create a family or need to log in and add a child to their existing family. Input parameters: - `requestBody` (object): API request for sending out family requests to parent's. ### `retrieveFamilyMembersByFamilyIdWithId` (~85 tokens) Retrieves all the members of a family by the unique Family Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `familyId` (string, required): The unique Id of the Family. ### `updateUserFamilyWithId` (~109 tokens) Updates a family with a given Id. OR Adds a user to an existing family. The family Id must be specified. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `familyId` (string, required): The Id of the family to update. - `requestBody` (object): API request for managing families and members. ### `createFamilyWithId` (~131 tokens) Creates a family with the user Id in the request as the owner and sole member of the family. You can optionally specify an Id for the family, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `familyId` (string, required): The Id for the family. If not provided a secure random UUID will be generated. - `requestBody` (object): API request for managing families and members. ### `removeUserFromFamilyWithId` (~103 tokens) Removes a user from the family with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `familyId` (string, required): The Id of the family to remove the user from. - `userId` (string, required): The Id of the user to remove from the family. ### `forgotPasswordWithId` (~44 tokens) Begins the forgot password sequence, which kicks off an email to the user so that they can reset their password. Input parameters: - `requestBody` (object): Forgot password request object. ### `importUsersWithId` (~138 tokens) Bulk imports users. This request performs minimal validation and runs batch inserts of users with the expectation that each user does not yet exist and each registration corresponds to an existing FusionAuth Application. This is done to increases the insert performance. Therefore, if you encounter an error due to a database key violation, the response will likely offer a generic explanation. If you encounter an error, you may optionally enable additional validation to receive a JSON response body with specific validation errors. This will slow the request down but will allow you to identify the cause of the failure. See the validateDbConstraints request parameter. Input parameters: - `requestBody` (object): Import request. ### `retrieveUserRecentLogin` (~96 tokens) Retrieves the last number of login records for a user. OR Retrieves the last number of login records. Input parameters: - `limit` (string): (Optional, defaults to 10) The number of records to retrieve. - `offset` (string): The initial record. e.g. 0 is the last login, 100 will be the 100th most recent login. - `userId` (string): The Id of the user. ### `importRefreshTokensWithId` (~144 tokens) Bulk imports refresh tokens. This request performs minimal validation and runs batch inserts of refresh tokens with the expectation that each token represents a user that already exists and is registered for the corresponding FusionAuth Application. This is done to increases the insert performance. Therefore, if you encounter an error due to a database key violation, the response will likely offer a generic explanation. If you encounter an error, you may optionally enable additional validation to receive a JSON response body with specific validation errors. This will slow the request down but will allow you to identify the cause of the failure. See the validateDbConstraints request parameter. Input parameters: - `requestBody` (object): Refresh Token Import request. ### `register` (~161 tokens) Registers a user for an application. If you provide the User and the UserRegistration object on this request, it will create the user as well as register them for the application. This is called a Full Registration. However, if you only provide the UserRegistration object, then the user must already exist and they will be registered for the application. The user Id can also be provided and it will either be used to look up an existing user or it will be used for the newly created User. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): Registration API request object. ### `updateRegistrationWithId` (~104 tokens) Updates the registration for the user with the given Id and the application defined in the request. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): Registration API request object. - `userId` (string, required): The Id of the user whose registration is going to be updated. ### `registerWithId` (~184 tokens) Registers a user for an application. If you provide the User and the UserRegistration object on this request, it will create the user as well as register them for the application. This is called a Full Registration. However, if you only provide the UserRegistration object, then the user must already exist and they will be registered for the application. The user Id can also be provided and it will either be used to look up an existing user or it will be used for the newly created User. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): Registration API request object. - `userId` (string, required): The Id of the user being registered for the application and optionally created. ### `patchRegistrationWithId` (~108 tokens) Updates, via PATCH, the registration for the user with the given Id and the application defined in the request. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): Registration API request object. - `userId` (string, required): The Id of the user whose registration is going to be updated. ### `retrieveRegistrationWithId` (~97 tokens) Retrieves the user registration for the user with the given Id and the given application Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application. - `userId` (string, required): The Id of the user. ### `deleteUserRegistrationWithId` (~138 tokens) Deletes the user registration for the given user and application along with the given JSON body that contains the event information. OR Deletes the user registration for the given user and application. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `applicationId` (string, required): The Id of the application to remove the registration for. - `requestBody` (object): Registration delete API request object. - `userId` (string, required): The Id of the user whose registration is being deleted. ### `searchUsersByIdsWithId` (~45 tokens) Retrieves the users for the given Ids. If any Id is invalid, it is ignored. Input parameters: - `ids` (string): The user Ids to search for. ### `searchUsersByQueryWithId` (~34 tokens) Retrieves the users for the given search criteria and pagination. Input parameters: - `requestBody` (object): Search API request. ### `retrieveTwoFactorRecoveryCodesWithId` (~41 tokens) Retrieve two-factor recovery codes for a user. Input parameters: - `userId` (string, required): The Id of the user to retrieve Two Factor recovery codes. ### `generateTwoFactorRecoveryCodesWithId` (~55 tokens) Generate two-factor recovery codes for a user. Generating two-factor recovery codes will invalidate any existing recovery codes. Input parameters: - `userId` (string, required): The Id of the user to generate new Two Factor recovery codes. ### `enableTwoFactorWithId` (~49 tokens) Enable two-factor authentication for a user. Input parameters: - `requestBody` (object): The JSON request body. - `userId` (string, required): The Id of the user to enable two-factor authentication. ### `deleteUserTwoFactorWithId` (~107 tokens) Disable two-factor authentication for a user using a JSON body rather than URL parameters. OR Disable two-factor authentication for a user. Input parameters: - `code` (string): The two-factor code used verify the the caller knows the two-factor secret. - `methodId` (string): The two-factor method identifier you wish to disable - `requestBody` (object): The JSON request body. - `userId` (string, required): The Id of the User for which you're disabling two-factor authentication. ### `updateUserVerifyEmail` (~146 tokens) Re-sends the verification email to the user. If the Application has configured a specific email template this will be used instead of the tenant configuration. OR Re-sends the verification email to the user. OR Generate a new Email Verification Id to be used with the Verify Email API. This API will not attempt to send an email to the User. This API may be used to collect the verificationId for use with a third party system. Input parameters: - `applicationId` (string): The unique Application Id to used to resolve an application specific email template. - `email` (string): The email address of the user that needs a new verification email. - `sendVerifyEmail` (string) ### `createUserVerifyEmail` (~182 tokens) Administratively verify a user's email address. Use this method to bypass email verification for the user. The request body will contain the userId to be verified. An API key is required when sending the userId in the request body. OR Confirms a user's email address. The request body will contain the verificationId. You may also be required to send a one-time use code based upon your configuration. When the tenant is configured to gate a user until their email address is verified, this procedures requires two values instead of one. The verificationId is a high entropy value and the one-time use code is a low entropy value that is easily entered in a user interactive form. The two values together are able to confirm a user's email address and mark the user's email address as verified. Input parameters: - `requestBody` (object): The JSON request body. ### `updateUserVerifyRegistration` (~115 tokens) Re-sends the application registration verification email to the user. OR Generate a new Application Registration Verification Id to be used with the Verify Registration API. This API will not attempt to send an email to the User. This API may be used to collect the verificationId for use with a third party system. Input parameters: - `applicationId` (string): The Id of the application to be verified. - `email` (string): The email address of the user that needs a new verification email. - `sendVerifyPasswordEmail` (string) ### `verifyUserRegistrationWithId` (~131 tokens) Confirms a user's registration. The request body will contain the verificationId. You may also be required to send a one-time use code based upon your configuration. When the application is configured to gate a user until their registration is verified, this procedures requires two values instead of one. The verificationId is a high entropy value and the one-time use code is a low entropy value that is easily entered in a user interactive form. The two values together are able to confirm a user's registration and mark the user's registration as verified. Input parameters: - `requestBody` (object): The JSON request body. ### `retrieveUserWithId` (~75 tokens) Retrieves the user for the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `userId` (string, required): The Id of the user. ### `updateUserWithId` (~108 tokens) Updates the user with the given Id. OR Reactivates the user with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `reactivate` (string) - `requestBody` (object): User API request object. - `userId` (string, required): The Id of the user to update. ### `createUserWithId` (~112 tokens) Creates a user. You can optionally specify an Id for the user, if not provided one will be generated. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): User API request object. - `userId` (string, required): The Id for the user. If not provided a secure random UUID will be generated. ### `deleteUserWithId` (~164 tokens) Deletes the user based on the given request (sent to the API as JSON). This permanently deletes all information, metrics, reports and data associated with the user. OR Deletes the user for the given Id. This permanently deletes all information, metrics, reports and data associated with the user. OR Deactivates the user with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `hardDelete` (string) - `requestBody` (object): User API delete request object for a single user. - `userId` (string, required): The Id of the user to delete (required). ### `patchUserWithId` (~93 tokens) Updates, via PATCH, the user with the given Id. Input parameters: - `X-FusionAuth-TenantId` (string): The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. - `requestBody` (object): User API request object. - `userId` (string, required): The Id of the user to update. ### `retrieveWebAuthnCredentialsForUserWithId` (~37 tokens) Retrieves all WebAuthn credentials for the given user. Input parameters: - `userId` (string): The user's ID. ### `completeWebAuthnAssertionWithId` (~52 tokens) Complete a WebAuthn authentication ceremony by validating the signature against the previously generated challenge without logging the user in Input parameters: - `requestBody` (object): Request to complete the WebAuthn registration ceremony ### `importWebAuthnCredentialWithId` (~39 tokens) Import a WebAuthn credential Input parameters: - `requestBody` (object): API request to import an existing WebAuthn credential(s) ### `completeWebAuthnLoginWithId` (~53 tokens) Complete a WebAuthn authentication ceremony by validating the signature against the previously generated challenge and then login the user in Input parameters: - `requestBody` (object): Request to complete the WebAuthn registration ceremony ### `completeWebAuthnRegistrationWithId` (~53 tokens) Complete a WebAuthn registration ceremony by validating the client request and saving the new credential Input parameters: - `requestBody` (object): Request to complete the WebAuthn registration ceremony for a new credential,. ### `startWebAuthnRegistrationWithId` (~47 tokens) Start a WebAuthn registration ceremony by generating a new challenge for the user Input parameters: - `requestBody` (object): API request to start a WebAuthn registration ceremony ### `startWebAuthnLoginWithId` (~47 tokens) Start a WebAuthn authentication ceremony by generating a new challenge for the user Input parameters: - `requestBody` (object): API request to start a WebAuthn authentication ceremony ### `retrieveWebAuthnCredentialWithId` (~39 tokens) Retrieves the WebAuthn credential for the given Id. Input parameters: - `id` (string, required): The Id of the WebAuthn credential. ### `deleteWebAuthnCredentialWithId` (~41 tokens) Deletes the WebAuthn credential for the given Id. Input parameters: - `id` (string, required): The Id of the WebAuthn credential to delete. ### `retrieveWebhook` (~33 tokens) Retrieves the webhook for the given Id. If you pass in null for the Id, this will return all the webhooks. ### `createWebhook` (~43 tokens) Creates a webhook. You can optionally specify an Id for the webhook, if not provided one will be generated. Input parameters: - `requestBody` (object): Webhook API request object. ### `searchWebhooksWithId` (~34 tokens) Searches webhooks with the specified criteria and pagination. Input parameters: - `requestBody` (object): Search request for webhooks ### `retrieveWebhookWithId` (~48 tokens) Retrieves the webhook for the given Id. If you pass in null for the Id, this will return all the webhooks. Input parameters: - `webhookId` (string, required): The Id of the webhook. ### `updateWebhookWithId` (~46 tokens) Updates the webhook with the given Id. Input parameters: - `requestBody` (object): Webhook API request object. - `webhookId` (string, required): The Id of the webhook to update. ### `createWebhookWithId` (~69 tokens) Creates a webhook. You can optionally specify an Id for the webhook, if not provided one will be generated. Input parameters: - `requestBody` (object): Webhook API request object. - `webhookId` (string, required): The Id for the webhook. If not provided a secure random UUID will be generated. ### `deleteWebhookWithId` (~33 tokens) Deletes the webhook for the given Id. Input parameters: - `webhookId` (string, required): The Id of the webhook to delete. ### `patchWebhookWithId` (~47 tokens) Patches the webhook with the given Id. Input parameters: - `requestBody` (object): Webhook API request object. - `webhookId` (string, required): The Id of the webhook to update. ### `approveDeviceWithId` (~16 tokens) Approve a device grant. ### `retrieveDeviceUserCode` (~90 tokens) Retrieve a user_code that is part of an in-progress Device Authorization Grant. This API is useful if you want to build your own login workflow to complete a device grant. This request will require an API key. OR Retrieve a user_code that is part of an in-progress Device Authorization Grant. This API is useful if you want to build your own login workflow to complete a device grant. ### `validateDeviceWithId` (~74 tokens) Validates the end-user provided user_code from the user-interaction of the Device Authorization Grant. If you build your own activation form you should validate the user provided code prior to beginning the Authorization grant. Input parameters: - `client_id` (string): The client Id. - `user_code` (string): The end-user verification code. ### `createIntrospect` (~58 tokens) Inspect an access token issued as the result of the Client Credentials Grant. OR Inspect an access token issued as the result of the User based grant such as the Authorization Code Grant, Implicit Grant, the User Credentials Grant or the Refresh Grant. ### `createToken` (~180 tokens) Exchange User Credentials for a Token. If you will be using the Resource Owner Password Credential Grant, you will make a request to the Token endpoint to exchange the user’s email and password for an access token. OR Exchange a Refresh Token for an Access Token. If you will be using the Refresh Token Grant, you will make a request to the Token endpoint to exchange the user’s refresh token for an access token. OR Exchanges an OAuth authorization code and code_verifier for an access token. Makes a request to the Token endpoint to exchange the authorization code returned from the Authorize endpoint and a code_verifier for an access token. OR Exchanges an OAuth authorization code for an access token. Makes a request to the Token endpoint to exchange the authorization code returned from the Authorize endpoint for an access token. OR Make a Client Credentials grant request to obtain an access token. ### `retrieveUserInfoFromAccessTokenWithId` (~32 tokens) Call the UserInfo endpoint to retrieve User Claims from the access token issued by FusionAuth. ## Diagnostics Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/io-fusionauth-mcp-api/fusionauth-mcp-api#diagnostics ## Score history - 2026-08-03: 66 - 2026-08-02: 66 - 2026-08-01: 36 - 2026-07-31: 21 - 2026-07-30: 46 - 2026-07-28: 46 - 2026-07-27: 46 ## Links - npm package: https://www.npmjs.com/package/@fusionauth/mcp-api - Socket report: https://socket.dev/npm/package/@fusionauth/mcp-api - Repository: https://github.com/FusionAuth/fusionauth-mcp-api - Changelog RSS feed: https://verifymcp.io/servers/io-fusionauth-mcp-api/fusionauth-mcp-api/changelog.xml - Changelog JSON feed: https://verifymcp.io/servers/io-fusionauth-mcp-api/fusionauth-mcp-api/changelog.json - HTML version of this page: https://verifymcp.io/servers/io-fusionauth-mcp-api/fusionauth-mcp-api