Create a new MFA Provider.

  • Published on Mar 2, 2026
  • 3 minute read
Prev Next
Post
/mfa-providers

Create a new MFA Provider.

Security
HTTP
Type bearer
Body parameters

MFA Provider object.

object
id
string (uuid)

ID of the object.

Example4c07bc67-57ea-42dd-b702-c2d6c45419fc
name
string Required

Name of the object.

Exampleobject
notes
string

Notes for the object. Used for documentation purposes.

ExampleThis object has been created for test purposes.
tags
Array of string

Array of tags.

Example[ "developer", "api-created" ]
string
type
string Required

The type of the MFA Provider. "DefaultTimeBased" and "Fido2" are built-in, new ones cannot be created.

Valid values[ "Radius", "DefaultTimeBased", "Fido2" ]
hostnames
Array of string

Hostnames/IP addresses to connect.

string
Examplemfa.company.com
port
number

Port to connect.

Example1812.0
inputType
string

The input type used in the client to enter the MFA code.

  • "Masked" - The input is masked the same way as a password field.
  • "Numeric" - The input is marked as a numeric input.
  • "Text" - The input is handled as a regular plain text field.
Valid values[ "Masked", "Numeric", "Text" ]
Default"Masked"
ExampleNumber
sharedSecret
string

Radius shared secret to authenticate to the server.

authenticationProtocol
string

Radius protocol to use while authenticating users.

Valid values[ "PAP", "CHAP" ]
Default"CHAP"
timeout
number

Timeout in seconds before giving up on response.

Default6.0
mode
string

Defines the multi-factor authentication flow for RADIUS.

  • "OneFactor" - The input from the user is sent as password and the response is used for result.
  • "Challenge" - Before prompting the user, Controller sends a challenge request to the RADIUS server using "challengeSharedSecret" or the user password. Data from the response is used with user input to send the second RADIUS authentication request.
  • "Push" - "challengeSharedSecret" or the user password is sent to RADIUS which triggers an external authentication flow. When the external authentication flow returns success, the MFA attempt is authenticated.
Valid values[ "OneFactor", "Challenge", "Push" ]
Default"Challenge"
useUserPassword
boolean

-> If enabled, the Client will send the cached password instead of using challengeSharedSecret" to initiate the multi-factor authentication.

challengeSharedSecret
string (password)

-> Password sent to RADIUS to initiate multi-factor authentication. Required if "useUserPassword" is not enabled.

Responses
200

MFA Provider object.

object
id
string (uuid)

ID of the object.

Example4c07bc67-57ea-42dd-b702-c2d6c45419fc
name
string

Name of the object.

Exampleobject
notes
string

Notes for the object. Used for documentation purposes.

ExampleThis object has been created for test purposes.
created
string (date-time)

Create date.

updated
string (date-time)

Last update date.

tags
Array of string

Array of tags.

Example[ "developer", "api-created" ]
string
type
string

The type of the MFA Provider. "DefaultTimeBased" and "Fido2" are built-in, new ones cannot be created.

Valid values[ "Radius", "DefaultTimeBased", "Fido2" ]
hostnames
Array of string

Hostnames/IP addresses to connect.

string
Examplemfa.company.com
port
number

Port to connect.

Example1812.0
inputType
string

The input type used in the client to enter the MFA code.

  • "Masked" - The input is masked the same way as a password field.
  • "Numeric" - The input is marked as a numeric input.
  • "Text" - The input is handled as a regular plain text field.
Valid values[ "Masked", "Numeric", "Text" ]
Default"Masked"
ExampleNumber
authenticationProtocol
string

Radius protocol to use while authenticating users.

Valid values[ "PAP", "CHAP" ]
Default"CHAP"
timeout
number

Timeout in seconds before giving up on response.

Default6.0
mode
string

Defines the multi-factor authentication flow for RADIUS.

  • "OneFactor" - The input from the user is sent as password and the response is used for result.
  • "Challenge" - Before prompting the user, Controller sends a challenge request to the RADIUS server using "challengeSharedSecret" or the user password. Data from the response is used with user input to send the second RADIUS authentication request.
  • "Push" - "challengeSharedSecret" or the user password is sent to RADIUS which triggers an external authentication flow. When the external authentication flow returns success, the MFA attempt is authenticated.
Valid values[ "OneFactor", "Challenge", "Push" ]
Default"Challenge"
useUserPassword
boolean

-> If enabled, the Client will send the cached password instead of using challengeSharedSecret" to initiate the multi-factor authentication.

400

JSON error. Check the JSON format.

object

Generic HTTP error.

id
string

Machine readable error code.

message
string

Human readable error details.

401

Token error. Login again.

object

Generic HTTP error.

id
string

Machine readable error code.

message
string

Human readable error details.

403

Insufficient permissions to access this resource.

object

Generic HTTP error.

id
string

Machine readable error code.

message
string

Human readable error details.

406

Invalid 'Accept' header.

object

Generic HTTP error.

id
string

Machine readable error code.

message
string

Human readable error details.

409

The submitted resource conflicts with another.

object

Generic HTTP error.

id
string

Machine readable error code.

message
string

Human readable error details.

422

Request validation error. Check "errors" array for details.

Expand All
object

Http 422 error for object validation.

id
string

Machine readable error code.

message
string

Human readable error details.

errors
Array of object

List of fields with validation errors.

object
field
string

Name of the field that failed validation.

Examplename
message
string

Failure reason.

Examplemay not be null
500

Unexpected server side error.

object

Generic HTTP error.

id
string

Machine readable error code.

message
string

Human readable error details.

©AppGate 2026. All Rights Reserved.