# SecurityEnforcementPostureDto

A model the API reference uses in a request or a response. The operation pages link every field typed as this model here.

## Fields
- `mfaRequirement` ([MfaRequirement](https://devportal.signapay-sbx.winkpg.io/docs/api/models/MfaRequirement.md)): Whether a second factor is optional, required or turned off for this account.
  Values:
  - `Optional`: The account holder chooses. This is the platform default.
  - `Required`: A second factor is required and the account holder cannot turn it off.
  - `Disabled`: Two-factor authentication is turned off for the account and cannot be enrolled.
- `mfaRequirementSource` ([MfaRequirementSource](https://devportal.signapay-sbx.winkpg.io/docs/api/models/MfaRequirementSource.md)): Which switch decided `mfaRequirement`.
  Values:
  - `AccountHolder`: Nothing forces the outcome: the account holder decides.
  - `SubscriptionFeature`: The subscription feature, which a reseller or the platform operator sets and a tenant administrator cannot override.
  - `TenantPolicy`: The tenant's own two-factor setting.
- `usersCanChangeMfa` (boolean): Whether the account holder may turn their own second factor on and off.
- `idleTimeoutMinutes` (integer(int32)): How many minutes of inactivity end the session, from the tenant's idle-circuit setting.
- `preventConcurrentLogin` (boolean): Whether the tenant allows only one concurrent login per account.
- `signInIpRestrictionEnforced` (boolean): Whether interactive portal access is restricted by source address.
- `administratorPasskeyRequired` (boolean): Whether the administrator passkey policy's Required value reaches this account: the passkey is its only second factor, unless an exception is live.
- `administratorPasskeyExceptionEndsAt` (string(date-time)): When this account's live exception to the administrator passkey policy ends, in UTC, or `null` when none is live. While it is, the account may sign in with an authenticator app. (nullable)
- `passwordRules` ([SecurityPasswordRulesEnforcementDto](https://devportal.signapay-sbx.winkpg.io/docs/api/models/SecurityPasswordRulesEnforcementDto.md)): The password and lockout rules in force for the tenant, as the PCI DSS password policy leaves them: the effective values, so they reflect the policy switch and its bounds.
  Fields:
  - `pciPolicyEnabled` (boolean): Whether the PCI DSS password policy is on in this environment.
  - `minimumLength` (integer(int32)): The fewest characters a new password may have.
  - `lockoutMaxFailedAttempts` (integer(int32)): How many failed sign-in attempts lock the account.
  - `lockoutDurationSeconds` (integer(int32)): How long a lockout lasts, in seconds.
  - `historyEnabled` (boolean): Whether a new password may not repeat a recent one.
  - `historyCount` (integer(int32)): How many previous passwords a new one may not repeat, while history is on.
  - `rotationEnforced` (boolean): Whether passwords must be changed periodically.
  - `rotationPeriodDays` (integer(int32)): How often, in days, a password must be changed while rotation is on.

## See also

- [All documentation](https://devportal.signapay-sbx.winkpg.io/llms.txt): the machine-readable index of every public page on this site.