---
title: "Get organization authentication methods"
method: GET
path: "/orgAuthConfig/authMethods"
tags: ["Organization Auth Config"]
---

# Get organization authentication methods

`GET /orgAuthConfig/authMethods`

Retrieve the configured authentication methods for the organization.

**Response Structure:**

Returns an array of authentication steps, each containing:
- `order`: Step number (1-3)
- `allowedMethods`: Array of methods allowed for that step

**Example Response:**

```json
{
  "authMethods": [
    { "order": 1, "allowedMethods": [{ "type": "password" }, { "type": "google" }] },
    { "order": 2, "allowedMethods": [{ "type": "otp" }] }
  ]
}
```

**Admin Access Required:** Only organization admins can view auth configuration.

## Response `200`

Authentication methods retrieved successfully

- AuthConfig — Organization authentication configuration. Supports 1-3 authentication steps for multi-factor authentication. **Validation Rules:** - Minimum 1 step, maximum 3 steps - Each step must have unique order - No duplicate methods within the same step - No method can appear in multiple steps
  - `authMethods` AuthStep[], required — List of authentication steps in order
    - `order` integer, required — Order of the authentication step (1-3, must be unique across steps)
    - `allowedMethods` AuthMethod[], required — List of allowed authentication methods for this step. User can choose any one method from this list.
      - `type` 'samlSso' | 'otp' | 'password' | 'google' | 'microsoft' | 'azureAd' | 'oauth', required — Type of authentication method: - `password`: Email/password authentication - `otp`: One-time password via email (6-digit, expires in 10 minutes) - `google`: Google OAuth 2.0 - `microsoft`: Microsoft OAuth 2.0 - `azureAd`: Azure Active Directory - `samlSso`: SAML 2.0 Single Sign-On - `oauth`: Generic OAuth 2.0 provider

## Other responses

- `400` — Bad request. Possible causes: - User is not an organization admin - User not authenticated (token decoded but `req.user` is null) - Organization ID missing from token payload
- `401` — Unauthorized - invalid or expired access token
- `404` — Not found. Possible causes: - Auth container not found - Account not found (userId or orgId missing) - Admin check failed in IAM service - Organization auth configuration not found
- `500` — Internal server error

---

[API](https://skmtc.net/pipeshub-ai/apis/pipeshub-api.md) · [All operations](https://skmtc.net/pipeshub-ai/apis/pipeshub-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pipeshub-ai/pipeshub-api/versions/abd27cfefc73/schema)