--- title: Create Sign-On Policy Action (MFA) description: The POST {{apiPath}}/v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions operation creates a new sign-on policy action resource. The priority property specifies the order in which this action (and its conditions) is evaluated when evaluating the policy. Property values range from 1 to {maxInt}. The action with a priority value of 1 is evaluated first. component: pingone-api page_id: pingone-api:platform:sign-on-policies/sign-on-policy-actions/create-sign-on-policy-action-mfa canonical_url: https://developer.pingidentity.com/pingone-api/platform/sign-on-policies/sign-on-policy-actions/create-sign-on-policy-action-mfa.html section_ids: prerequisites: Prerequisites headers: Headers body: Body example-request: Example Request example-response: Example Response --- # Create Sign-On Policy Action (MFA) ## ```none POST {{apiPath}}/v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions ``` The `POST {{apiPath}}/v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions` operation creates a new sign-on policy action resource. The `priority` property specifies the order in which this action (and its conditions) is evaluated when evaluating the policy. Property values range from `1` to `{maxInt}`. The action with a `priority` value of `1` is evaluated first. | | | | - | ---------------------------------------------------------------------------------- | | | To add MFA actions to sign-on policies, you must have a license that includes MFA. | | | | | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The `condition` property for the sign-on policy action specifies the conditions associated with the action. At least one condition must be met to execute the action. If the `conditions` attribute is omitted from the sign-on policy action, the action is always executed. | A POST request for a sign-on policy action with the `type` attribute set to `MULTI_FACTOR_AUTHENTICATION` requires that you provide the ID of an existing MFA policy. The sample shows the request body for an MFA sign-on policy action. ### Prerequisites * Refer to [Sign-On Policies](../../sign-on-policies.html) and [Sign-On Policy Actions](../sign-on-policy-actions.html) for important overview information. * [Create a sign-on policy](../sign-on-policies-1/create-sign-on-policy.html) to get a `policyID` for the endpoint. * [Create a device authentication policy for multi-factor authentication](../../../mfa/device-authentication-policy/create-device-authentication-policy.html) to get a `deviceAuthenticationPolicyID` for the body. Refer also to [PingOne MFA](../../../mfa/introduction.html), especially [Device Authentication Policies](../../../mfa/introduction.html#device-authentication-policies). * [Create an application](../../applications/applications-1/create-application-oidc-protocol---web-app.html) to get an `appID` for the body. Refer also to [Application Management](../../applications/application-management.html), especially [Application Operations](../../applications/applications-1.html). > **Collapse: Request Model** > > | Property | Type | Required? | > | ------------------------------- | ------- | --------- | > | `deviceAuthenticationPolicy.id` | String | Required | > | `priority` | Integer | Required | > | `recovery.enabled` | Boolean | Optional | > | `type` | String | Required | > > Refer to the [Sign-on policy actions base data model](../sign-on-policy-actions.html#sign-on-policy-actions-base-data-model) for full property descriptions. ### Headers Authorization      Bearer {{accessToken}} Content-Type      application/json ### Body raw ( application/json ) ```json { "priority": 30, "type": "MULTI_FACTOR_AUTHENTICATION", "condition": { "anonymousNetwork": [ "1.1.1.1/10" ], "valid": "${flow.request.http.remoteIp}" }, "recovery": { "enabled": false }, "deviceAuthenticationPolicy": { "id": "{{mfaPolicyID}}" } } ``` ## ### Example Request * cURL * C# * Go * HTTP * Java * jQuery * NodeJS * Python * PHP * Ruby * Swift ```shell curl --location --globoff '{{apiPath}}/v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer {{accessToken}}' \ --data '{ "priority": 30, "type": "MULTI_FACTOR_AUTHENTICATION", "condition": { "anonymousNetwork": [ "1.1.1.1/10" ], "valid": "${flow.request.http.remoteIp}" }, "recovery": { "enabled": false }, "deviceAuthenticationPolicy": { "id": "{{mfaPolicyID}}" } }' ``` ```csharp var options = new RestClientOptions("{{apiPath}}/v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions") { MaxTimeout = -1, }; var client = new RestClient(options); var request = new RestRequest("", Method.Post); request.AddHeader("Content-Type", "application/json"); request.AddHeader("Authorization", "Bearer {{accessToken}}"); var body = @"{" + "\n" + @" ""priority"": 30," + "\n" + @" ""type"": ""MULTI_FACTOR_AUTHENTICATION""," + "\n" + @" ""condition"": {" + "\n" + @" ""anonymousNetwork"": [" + "\n" + @" ""1.1.1.1/10""" + "\n" + @" ]," + "\n" + @" ""valid"": ""${flow.request.http.remoteIp}""" + "\n" + @" }," + "\n" + @" ""recovery"": {" + "\n" + @" ""enabled"": false" + "\n" + @" }," + "\n" + @" ""deviceAuthenticationPolicy"": {" + "\n" + @" ""id"": ""{{mfaPolicyID}}""" + "\n" + @" }" + "\n" + @"}"; request.AddStringBody(body, DataFormat.Json); RestResponse response = await client.ExecuteAsync(request); Console.WriteLine(response.Content); ``` ```golang package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "{{apiPath}}/v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions" method := "POST" payload := strings.NewReader(`{ "priority": 30, "type": "MULTI_FACTOR_AUTHENTICATION", "condition": { "anonymousNetwork": [ "1.1.1.1/10" ], "valid": "${flow.request.http.remoteIp}" }, "recovery": { "enabled": false }, "deviceAuthenticationPolicy": { "id": "{{mfaPolicyID}}" } }`) client := &http.Client { } req, err := http.NewRequest(method, url, payload) if err != nil { fmt.Println(err) return } req.Header.Add("Content-Type", "application/json") req.Header.Add("Authorization", "Bearer {{accessToken}}") res, err := client.Do(req) if err != nil { fmt.Println(err) return } defer res.Body.Close() body, err := io.ReadAll(res.Body) if err != nil { fmt.Println(err) return } fmt.Println(string(body)) } ``` ```http POST /v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions HTTP/1.1 Host: {{apiPath}} Content-Type: application/json Authorization: Bearer {{accessToken}} { "priority": 30, "type": "MULTI_FACTOR_AUTHENTICATION", "condition": { "anonymousNetwork": [ "1.1.1.1/10" ], "valid": "${flow.request.http.remoteIp}" }, "recovery": { "enabled": false }, "deviceAuthenticationPolicy": { "id": "{{mfaPolicyID}}" } } ``` ```java OkHttpClient client = new OkHttpClient().newBuilder() .build(); MediaType mediaType = MediaType.parse("application/json"); RequestBody body = RequestBody.create(mediaType, "{\n \"priority\": 30,\n \"type\": \"MULTI_FACTOR_AUTHENTICATION\",\n \"condition\": {\n \"anonymousNetwork\": [\n \"1.1.1.1/10\"\n ],\n \"valid\": \"${flow.request.http.remoteIp}\"\n },\n \"recovery\": {\n \"enabled\": false\n },\n \"deviceAuthenticationPolicy\": {\n \"id\": \"{{mfaPolicyID}}\"\n }\n}"); Request request = new Request.Builder() .url("{{apiPath}}/v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions") .method("POST", body) .addHeader("Content-Type", "application/json") .addHeader("Authorization", "Bearer {{accessToken}}") .build(); Response response = client.newCall(request).execute(); ``` ```javascript var settings = { "url": "{{apiPath}}/v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions", "method": "POST", "timeout": 0, "headers": { "Content-Type": "application/json", "Authorization": "Bearer {{accessToken}}" }, "data": JSON.stringify({ "priority": 30, "type": "MULTI_FACTOR_AUTHENTICATION", "condition": { "anonymousNetwork": [ "1.1.1.1/10" ], "valid": "${flow.request.http.remoteIp}" }, "recovery": { "enabled": false }, "deviceAuthenticationPolicy": { "id": "{{mfaPolicyID}}" } }), }; $.ajax(settings).done(function (response) { console.log(response); }); ``` ```javascript var request = require('request'); var options = { 'method': 'POST', 'url': '{{apiPath}}/v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions', 'headers': { 'Content-Type': 'application/json', 'Authorization': 'Bearer {{accessToken}}' }, body: JSON.stringify({ "priority": 30, "type": "MULTI_FACTOR_AUTHENTICATION", "condition": { "anonymousNetwork": [ "1.1.1.1/10" ], "valid": "${flow.request.http.remoteIp}" }, "recovery": { "enabled": false }, "deviceAuthenticationPolicy": { "id": "{{mfaPolicyID}}" } }) }; request(options, function (error, response) { if (error) throw new Error(error); console.log(response.body); }); ``` ```python import requests import json url = "{{apiPath}}/v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions" payload = json.dumps({ "priority": 30, "type": "MULTI_FACTOR_AUTHENTICATION", "condition": { "anonymousNetwork": [ "1.1.1.1/10" ], "valid": "${flow.request.http.remoteIp}" }, "recovery": { "enabled": False }, "deviceAuthenticationPolicy": { "id": "{{mfaPolicyID}}" } }) headers = { 'Content-Type': 'application/json', 'Authorization': 'Bearer {{accessToken}}' } response = requests.request("POST", url, headers=headers, data=payload) print(response.text) ``` ```php setUrl('{{apiPath}}/v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions'); $request->setMethod(HTTP_Request2::METHOD_POST); $request->setConfig(array( 'follow_redirects' => TRUE )); $request->setHeader(array( 'Content-Type' => 'application/json', 'Authorization' => 'Bearer {{accessToken}}' )); $request->setBody('{\n "priority": 30,\n "type": "MULTI_FACTOR_AUTHENTICATION",\n "condition": {\n "anonymousNetwork": [\n "1.1.1.1/10"\n ],\n "valid": "${flow.request.http.remoteIp}"\n },\n "recovery": {\n "enabled": false\n },\n "deviceAuthenticationPolicy": {\n "id": "{{mfaPolicyID}}"\n }\n}'); try { $response = $request->send(); if ($response->getStatus() == 200) { echo $response->getBody(); } else { echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' . $response->getReasonPhrase(); } } catch(HTTP_Request2_Exception $e) { echo 'Error: ' . $e->getMessage(); } ``` ```ruby require "uri" require "json" require "net/http" url = URI("{{apiPath}}/v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions") http = Net::HTTP.new(url.host, url.port); request = Net::HTTP::Post.new(url) request["Content-Type"] = "application/json" request["Authorization"] = "Bearer {{accessToken}}" request.body = JSON.dump({ "priority": 30, "type": "MULTI_FACTOR_AUTHENTICATION", "condition": { "anonymousNetwork": [ "1.1.1.1/10" ], "valid": "\${flow.request.http.remoteIp}" }, "recovery": { "enabled": false }, "deviceAuthenticationPolicy": { "id": "{{mfaPolicyID}}" } }) response = http.request(request) puts response.read_body ``` ```swift let parameters = "{\n \"priority\": 30,\n \"type\": \"MULTI_FACTOR_AUTHENTICATION\",\n \"condition\": {\n \"anonymousNetwork\": [\n \"1.1.1.1/10\"\n ],\n \"valid\": \"${flow.request.http.remoteIp}\"\n },\n \"recovery\": {\n \"enabled\": false\n },\n \"deviceAuthenticationPolicy\": {\n \"id\": \"{{mfaPolicyID}}\"\n }\n}" let postData = parameters.data(using: .utf8) var request = URLRequest(url: URL(string: "{{apiPath}}/v1/environments/{{envID}}/signOnPolicies/{{policyID}}/actions")!,timeoutInterval: Double.infinity) request.addValue("application/json", forHTTPHeaderField: "Content-Type") request.addValue("Bearer {{accessToken}}", forHTTPHeaderField: "Authorization") request.httpMethod = "POST" request.httpBody = postData let task = URLSession.shared.dataTask(with: request) { data, response, error in guard let data = data else { print(String(describing: error)) return } print(String(data: data, encoding: .utf8)!) } task.resume() ``` ### Example Response 201 Created ```json { "_links": { "self": { "href": "https://api.pingone.eu/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/signOnPolicies/f4d72e42-017c-4f4e-9e6a-d8a272778759/actions/904e9450-735d-448b-bda2-0984edb422ae" }, "environment": { "href": "https://api.pingone.eu/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6" }, "signOnPolicy": { "href": "https://api.pingone.eu/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/signOnPolicies/f4d72e42-017c-4f4e-9e6a-d8a272778759" } }, "id": "904e9450-735d-448b-bda2-0984edb422ae", "environment": { "id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6" }, "type": "MULTI_FACTOR_AUTHENTICATION", "condition": { "anonymousNetwork": [ "1.1.1.1/10" ], "valid": "${flow.request.http.remoteIp}" }, "signOnPolicy": { "id": "f4d72e42-017c-4f4e-9e6a-d8a272778759" }, "priority": 30, "deviceAuthenticationPolicy": { "id": "61cf9806-1d18-4eda-92c0-109fc79d4495" } } ```