Policy management

This section explains how to manage authenticator policies using the authenticator policy admin API.

The authenticator policy admin API provides operations for configuring policies that control which types of authenticators can be used for registration and authentication.

The authenticator policy admin API allows you to:

• Define policies that specify allowed authenticator types.
• Control which authenticators can be used for registration.
• Control which authenticators can be used for authentication.
• Configure attestation requirements and validation rules.
• Manage policy lifecycle and updates.

Policy configuration

Authenticator policies typically include:

• Allowed authenticator types: Platform, cross-platform, or both
• Attestation requirements: None, indirect, direct, or enterprise
• User verification: Required, preferred, or discouraged
• Authenticator attachment: Platform, cross-platform, or unspecified
• Resident key requirements: Required, preferred, or discouraged

Authentication and authorization

All authenticator policy admin API operations require proper authentication:

• Operations require specific roles encoded in the JWT token passed as an HTTP Authorization request header with the Bearer authorization scheme.
• Each operation specifies the required role in its API documentation.

Next steps

• Review the authenticator policy admin API reference for detailed endpoint documentation.
• Explore authenticator policy samples for example configurations.
• Learn about authenticator management.
• Review user management.