---
title: "Update organization authentication methods"
method: POST
path: "/orgAuthConfig/updateAuthMethod"
tags: ["Organization Auth Config"]
---

# Update organization authentication methods

`POST /orgAuthConfig/updateAuthMethod`

Update the authentication methods configuration for an organization.
This allows admins to configure single or multi-factor authentication.

**Validation Rules:**
- Minimum 1 step, maximum 3 steps
- Each step must have a unique order (1, 2, or 3)
- No duplicate methods within the same step
- No method can appear in multiple steps
- Each step must have at least one allowed method

**Available Methods:**
- `password`: Email/password authentication
- `otp`: One-time password via email
- `google`: Google OAuth 2.0
- `microsoft`: Microsoft OAuth 2.0
- `azureAd`: Azure Active Directory
- `samlSso`: SAML 2.0 Single Sign-On
- `oauth`: Generic OAuth 2.0 provider

**Example - Single Factor (Password or Google):**

```json
{
  "authMethod": [
    { "order": 1, "allowedMethods": [{ "type": "password" }, { "type": "google" }] }
  ]
}
```

**Example - Two Factor (Password + OTP):**

```json
{
  "authMethod": [
    { "order": 1, "allowedMethods": [{ "type": "password" }] },
    { "order": 2, "allowedMethods": [{ "type": "otp" }] }
  ]
}
```

**Admin Access Required:** Only organization admins can update auth configuration.

## Request body

- object
  - `authMethod` AuthStep[], required — Authentication steps to set for the organization (1-3 steps)
    - `order` integer, required — Order of the authentication step (1-3, must be unique across steps)
    - `allowedMethods` AuthMethod[], required — List of allowed authentication methods for this step. User can choose any one method from this list.
      - `type` 'samlSso' | 'otp' | 'password' | 'google' | 'microsoft' | 'azureAd' | 'oauth', required — Type of authentication method: - `password`: Email/password authentication - `otp`: One-time password via email (6-digit, expires in 10 minutes) - `google`: Google OAuth 2.0 - `microsoft`: Microsoft OAuth 2.0 - `azureAd`: Azure Active Directory - `samlSso`: SAML 2.0 Single Sign-On - `oauth`: Generic OAuth 2.0 provider

## Response `200`

Authentication methods updated successfully

- UpdateAuthMethodResponse — Response after updating organization authentication methods
  - `message` string, required
  - `authMethod` AuthStep[], required — Updated authentication steps (same shape as request body)
    - `order` integer, required — Order of the authentication step (1-3, must be unique across steps)
    - `allowedMethods` AuthMethod[], required — List of allowed authentication methods for this step. User can choose any one method from this list.
      - `type` 'samlSso' | 'otp' | 'password' | 'google' | 'microsoft' | 'azureAd' | 'oauth', required — Type of authentication method: - `password`: Email/password authentication - `otp`: One-time password via email (6-digit, expires in 10 minutes) - `google`: Google OAuth 2.0 - `microsoft`: Microsoft OAuth 2.0 - `azureAd`: Azure Active Directory - `samlSso`: SAML 2.0 Single Sign-On - `oauth`: Generic OAuth 2.0 provider

## Other responses

- `400` — Bad request. Possible causes: - User is not an organization admin - `authMethod` field missing from request body - Validation failure (duplicate steps, duplicate methods, out-of-range order, empty methods array)
- `401` — Unauthorized. Possible causes: - Invalid or expired access token - User not authenticated (token decoded but `req.user` is null)
- `404` — Not found. Possible causes: - Auth container not found - Account not found (userId or orgId missing) - Admin check failed in IAM service - Organization auth configuration not found
- `500` — Internal server error

---

[API](https://skmtc.net/pipeshub-ai/apis/pipeshub-api.md) · [All operations](https://skmtc.net/pipeshub-ai/apis/pipeshub-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pipeshub-ai/pipeshub-api/versions/abd27cfefc73/schema)