/primary-authenticate/requirements

Request

Returns the list of authenticator enrollments available for primary authentication in a direct authentication flow. Use this endpoint to discover which authenticators the user can use before initiating authentication.

Note: The /primary-authenticate/requirements endpoint requires client authentication. The method is configured per client app. See Client authentication methods.

Path

authorizationServerIdstringrequired

id of the authorization server

Bodyapplication/x-www-form-urlencoded

challenge_types_supportedstring

Space-separated list of primary authentication challenge types supported by the client

intentstringrequired

The purpose of the authentication request

Enum Value	Description
sso	Standard sign-on authentication
recovery	Self-service password reset flow. Evaluates recovery policy instead of sign-on policy
device_bound_sso	Device-bound SSO authentication

Example:"sso"

login_hintstringrequired

The user sign-in identifier (username or email) for whom authentication requirements are being requested

curl -i -X POST \
  'https://subdomain.okta.com/oauth2/{authorizationServerId}/v1/primary-authenticate/requirements' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d login_hint=testuser@example.com \
  -d intent=sso \
  -d 'challenge_types_supported=urn:okta:params:oauth:grant-type:otp urn:okta:params:oauth:grant-type:oob'

Responses

Returns the list of authenticator enrollments available for the user.

Bodyapplication/json

requirementsobject

Response

{
  "requirements": {
    "challenge": [ … ]
  }
}