> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cyrisma.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set a tenant's authentication policy



## OpenAPI

````yaml /api/partner-api/provisioning.json put /v1/msp/admin/tenants/{tenantId}/auth-policy
openapi: 3.1.1
info:
  title: 'Cyrisma New Partner API: Provisioning'
  version: v1
servers:
  - url: https://{instance}.cyrisma.com/ta
    description: Tenant Authority, served under the partner's own CYRISMA instance host.
    variables:
      instance:
        default: ccnnnnnn
        description: The instance label of the tenant host issued to the partner.
security:
  - bearerAuth: []
tags:
  - name: Auth
  - name: MSP Administration
paths:
  /v1/msp/admin/tenants/{tenantId}/auth-policy:
    put:
      tags:
        - MSP Administration
      summary: Set a tenant's authentication policy
      operationId: UpdateMspAdminTenantAuthPolicyV1
      parameters:
        - name: tenantId
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TenantAuthPolicyPutRequest'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantAuthPolicyResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProblemDetails'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProblemDetails'
components:
  schemas:
    TenantAuthPolicyPutRequest:
      required:
        - mfa_requirement
        - allowed_mfa_methods
        - expected_version
      type: object
      properties:
        mfa_requirement:
          type: string
        allowed_mfa_methods:
          type: array
          items:
            $ref: '#/components/schemas/CanonicalMfaType'
        expected_version:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
            - integer
            - string
          format: int32
        require_sso:
          type: boolean
          default: false
    TenantAuthPolicyResponse:
      required:
        - tenant_id
        - mfa_requirement
        - allowed_mfa_methods
        - version
        - updated_at
      type: object
      properties:
        tenant_id:
          type: string
          format: uuid
        mfa_requirement:
          type: string
        allowed_mfa_methods:
          type: array
          items:
            $ref: '#/components/schemas/CanonicalMfaType'
        version:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
            - integer
            - string
          format: int32
        updated_at:
          type: string
          format: date-time
        require_sso:
          type: boolean
          default: false
    AuthProblemDetails:
      required:
        - status
        - code
        - trace_id
      type: object
      properties:
        status:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
            - integer
            - string
          format: int32
        code:
          type: string
        trace_id:
          type: string
        denied_scopes:
          type:
            - 'null'
            - array
          items:
            type: string
        attempts_remaining:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
            - 'null'
            - integer
            - string
          format: int32
        retry_after_seconds:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
            - 'null'
            - integer
            - string
          format: int32
    CanonicalMfaType:
      enum:
        - email
        - totp
  securitySchemes:
    bearerAuth:
      type: http
      description: >-
        A machine-client token from POST /v1/auth/client-token. Provisioning and
        user management need the pulse.write scope; reads need pulse.read.
      scheme: bearer
      bearerFormat: JWT

````