# MerchantSecurityPostureDto

A model the API reference uses in a request or a response. The operation pages link every field typed as this model here.

## Fields
- `merchantId` (string(uuid)): The merchant the counts cover, when they cover exactly one. (nullable)
- `isTenantWide` (boolean): Whether the counts cover every account and key in the tenant, which only an administrator  reaches.
- `scopedMerchantCount` (integer(int32)): How many merchants the counts cover. Zero alongside `isTenantWide` being  `false` means the caller can act for no merchant, so there was nothing to count.
- `userCount` (integer(int32)): Accounts in scope among those the scan examined.
- `usersWithMfa` (integer(int32)): Accounts with a second factor enrolled.
- `usersWithStalePassword` (integer(int32)): Accounts whose password is older than `stalePasswordThresholdDays`, or that have  no recorded change at all.
- `stalePasswordThresholdDays` (integer(int32)): The age at which a password counts as stale here. Follows the tenant's own rotation period  when rotation is enforced, and otherwise falls back to a fixed default so the column still  means something for a tenant that has not set a policy.
- `userCountTruncated` (boolean): Whether the account scan reached its limit, in which case accounts in scope may never have  been examined and every account count here is a floor rather than a total.
- `apiKeyCount` (integer(int32)): API keys in scope. A total unless `apiKeyCountTruncated` is set.
- `dormantApiKeys` (integer(int32)): Keys with no recorded use for longer than `dormantApiKeyThresholdDays`. A key  that has never been used is measured from its creation, so one minted this morning is not  reported as dormant.
- `dormantApiKeyThresholdDays` (integer(int32)): The idle age at which a key counts as dormant.
- `apiKeysWithoutSourceRestriction` (integer(int32)): Keys not bound to any source address, and so usable from anywhere.
- `apiKeyCountTruncated` (boolean): Whether more keys are in scope than the scan examined. Unlike the account scan this one is  narrowed store-side, so the keys counted are all in scope and only the bound was reached.

## See also

- [All documentation](https://devportal.demo.winkpg.io/llms.txt): the machine-readable index of every public page on this site.