Skip to main content
Version: Latest (4.0.3)

Verification Options

Verification Options define the MFA / step-up enforcement rules for an application: whether verification is required, which methods are allowed, the time interval for time-based re-verification, the password policy that applies, suggested verification methods, and app attestation. In Trustdesk this lives under SecureOps → Verification Options; applications reference a profile by ID via verification_options_id.

A Verification Options profile is also where a password policy is assigned to an application. Creating a password policy does not apply it on its own — the policy is referenced from a Verification Options profile (password_policy_ref), and that profile is then linked to the app.

How Verification Options relate to password policy and applications​

LayerTrustdeskServiceWhat it stores
Password policySettings → Password policyverification-actions-srvPassword strength rules (min/max length, digits, special chars, expiry, compromised-credential blocking)
Verification Options profileSecureOps → Verification Optionsverification-actions-srvMFA mode, allowed methods, password_policy_ref, suggest verification, app attestation
Application linkIntegrations → Applicationsapp-srvverification_options_id pointing to a Verification Options profile
Password Policy  →  Verification Options profile  →  Application (verification_options_id)
(strength rules)     (MFA rules + password_policy_ref)   (reference only)

Multiple applications can share one Verification Options profile, or each app can use its own.

Profile settings​

Each Verification Options profile (verificationOption in the API) has a name, a description, and a nested verification_options object:

SettingDescription
settingMFA / step-up enforcement mode: OFF (not enforced), ALWAYS (every login), SMART (based on risk/context signals), TIME_BASED (after time_interval_in_seconds elapsed), or SMART_PLUS_TIME_BASED (combines both). Defaults to OFF.
time_interval_in_secondsRequired when setting is TIME_BASED or SMART_PLUS_TIME_BASED. Seconds since the last verification before it is required again.
allowed_methodsVerification methods available for this profile. Either empty, or at least 2 methods when MFA is active.
password_policy_refReference to the password policy applied alongside this verification profile. See Password Policy.
suggest_verification_method_idReference to a Suggest Verification config that recommends additional methods to the user.
app_attestApp attestation configuration (Android / iOS) used to validate that verification requests originate from a genuine app installation.

Ownership Profiles are either system-owned (built-in defaults) or user-owned (tenant-created). A GET on a system-owned entry returns 403 Forbidden.

  1. Create a password policy (Trustdesk Settings → Password policy or the Password Policy API). See Password Policy.
  2. Create a Verification Options profile (Trustdesk SecureOps → Verification Options or the Verification Options API) and set password_policy_ref (and any MFA rules) on it.
  3. Create or update the application and set verification_options_id to the profile ID. See App management.

Linking to an application​

Applications store only the profile ID — not the full Verification Options document:

App fieldAPI path to resolve
verification_options_idGET /verification-actions-srv/verification-options/{id}

Configure this on the application under Integrations → Applications (Trustdesk) or via the App Configuration API.

API reference​

Verification Options are managed by verification-actions-srv under /verification-actions-srv/verification-options. Endpoint details, request schemas, and examples are in the Verification Options API OpenAPI reference.

Access requires OAuth2 scope cidaas:verification_read, cidaas:verification_write, or cidaas:verification_delete depending on the operation. Create, update, and delete additionally require the CIDAAS_ADMINS role.

info
Need Support?

For assistance, visit our Support Portal.