# SecurityOverviewDto

A model the API reference uses in a request or a response. The operation pages link every field typed as this model here.

## Fields
- `userId` (string(uuid)): The account this overview describes.
- `userName` (string): The account's sign-in name, for the administrator view's header. (nullable)
- `mfa` ([SecurityMfaStatusDto](https://devportal.signapay-sbx.winkpg.io/docs/api/models/SecurityMfaStatusDto.md)): Multi-factor enrolment state.
  Fields:
  - `enabled` (boolean): Whether the account has a second factor enrolled.
- `password` ([SecurityPasswordStatusDto](https://devportal.signapay-sbx.winkpg.io/docs/api/models/SecurityPasswordStatusDto.md)): Password age and the tenant's expiry policy applied to it.
  Fields:
  - `hasPassword` (boolean): Whether the account has a local password at all.
  - `isExternal` (boolean): Whether the account signs in through an external identity provider, in which case the password and its rotation are that provider's concern and not the platform's.
  - `lastChangedUtc` (string(date-time)): When the password was last changed, in UTC, or `null` for an account whose password predates the field and has not been changed since. (nullable)
  - `ageDays` (integer(int32)): Whole days since the last change, or `null` when `lastChangedUtc` is. (nullable)
  - `expiryEnforced` (boolean): Whether the tenant forces passwords to be changed periodically.
  - `expiryPeriodDays` (integer(int32)): The tenant's rotation period in days. Meaningful only when `expiryEnforced` is `true`; the setting carries a value either way.
  - `expiresUtc` (string(date-time)): When the current password stops being accepted, in UTC, or `null` when rotation is not enforced or the last-changed instant is unknown. (nullable)
  - `daysUntilExpiry` (integer(int32)): Whole days until `expiresUtc`, negative once it has passed, or `null` when there is no expiry to count towards. (nullable)
- `passwordPolicy` ([SecurityPasswordPolicyDto](https://devportal.signapay-sbx.winkpg.io/docs/api/models/SecurityPasswordPolicyDto.md)): The rules a new password for this account must meet, so a change-password form can show them as the password is typed. Null when the rules could not be read.
  Fields:
  - `requiredLength` (integer(int32)): The minimum number of characters a new password must have.
  - `requiredUniqueChars` (integer(int32)): The minimum number of different characters a new password must contain.
  - `requireDigit` (boolean): Whether a new password must contain a digit, 0 to 9.
  - `requireLowercase` (boolean): Whether a new password must contain a lowercase letter, a to z.
  - `requireUppercase` (boolean): Whether a new password must contain an uppercase letter, A to Z.
  - `requireNonAlphanumeric` (boolean): Whether a new password must contain a character that is not a letter or a digit.
  - `minimumLengthSetBy` (string): Who set `requiredLength`, worded for the account holder (for example, `by your reseller`), when a reseller or merchant minimum raised it above the tenant's. Null when the minimum length is the tenant's own. (nullable)
  - `breachCheckEnabled` (boolean): Whether the tenant has the advisory password breach check on, so the password form also shows whether a new password appears in known data breaches. Advisory only: it is not a rule the server enforces, and a breached password is not refused on its account.
- `sessions` ([SecuritySessionStatusDto](https://devportal.signapay-sbx.winkpg.io/docs/api/models/SecuritySessionStatusDto.md)): Active login sessions.
  Fields:
  - `activeCount` (integer(int32)): How many sessions the account currently has, including the one making this request.
- `enforcement` ([SecurityEnforcementPostureDto](https://devportal.signapay-sbx.winkpg.io/docs/api/models/SecurityEnforcementPostureDto.md)): What the platform actually enforces for this account right now.
  Fields:
  - `mfaRequirement` ([MfaRequirement](https://devportal.signapay-sbx.winkpg.io/docs/api/models/MfaRequirement.md)): Whether a second factor is optional, required or turned off for this account.
    Values:
    - `Optional`: The account holder chooses. This is the platform default.
    - `Required`: A second factor is required and the account holder cannot turn it off.
    - `Disabled`: Two-factor authentication is turned off for the account and cannot be enrolled.
  - `mfaRequirementSource` ([MfaRequirementSource](https://devportal.signapay-sbx.winkpg.io/docs/api/models/MfaRequirementSource.md)): Which switch decided `mfaRequirement`.
    Values:
    - `AccountHolder`: Nothing forces the outcome: the account holder decides.
    - `SubscriptionFeature`: The subscription feature, which a reseller or the platform operator sets and a tenant administrator cannot override.
    - `TenantPolicy`: The tenant's own two-factor setting.
  - `usersCanChangeMfa` (boolean): Whether the account holder may turn their own second factor on and off.
  - `idleTimeoutMinutes` (integer(int32)): How many minutes of inactivity end the session, from the tenant's idle-circuit setting.
  - `preventConcurrentLogin` (boolean): Whether the tenant allows only one concurrent login per account.
  - `signInIpRestrictionEnforced` (boolean): Whether interactive portal access is restricted by source address.
  - `administratorPasskeyRequired` (boolean): Whether the administrator passkey policy's Required value reaches this account: the passkey is its only second factor, unless an exception is live.
  - `administratorPasskeyExceptionEndsAt` (string(date-time)): When this account's live exception to the administrator passkey policy ends, in UTC, or `null` when none is live. While it is, the account may sign in with an authenticator app. (nullable)
  - `passwordRules` ([SecurityPasswordRulesEnforcementDto](https://devportal.signapay-sbx.winkpg.io/docs/api/models/SecurityPasswordRulesEnforcementDto.md)): The password and lockout rules in force for the tenant, as the PCI DSS password policy leaves them: the effective values, so they reflect the policy switch and its bounds.

## See also

- [All documentation](https://devportal.signapay-sbx.winkpg.io/llms.txt): the machine-readable index of every public page on this site.