# SecurityOverviewDto

A model the API reference uses in a request or a response. The operation pages link every field typed as this model here.

## Fields
- `userId` (string(uuid)): The account this overview describes.
- `userName` (string): The account's sign-in name, for the administrator view's header. (nullable)
- `mfa` ([SecurityMfaStatusDto](https://devportal.demo.winkpg.io/docs/api/models/SecurityMfaStatusDto.md)): Multi-factor enrolment state.
  Fields:
  - `enabled` (boolean): Whether the account has a second factor enrolled.
- `password` ([SecurityPasswordStatusDto](https://devportal.demo.winkpg.io/docs/api/models/SecurityPasswordStatusDto.md)): Password age and the tenant's expiry policy applied to it.
  Fields:
  - `hasPassword` (boolean): Whether the account has a local password at all.
  - `isExternal` (boolean): Whether the account signs in through an external identity provider, in which case the  password and its rotation are that provider's concern and not the platform's.
  - `lastChangedUtc` (string(date-time)): When the password was last changed, in UTC, or `null` for an account whose password  predates the field and has not been changed since. (nullable)
  - `ageDays` (integer(int32)): Whole days since the last change, or `null` when `lastChangedUtc` is. (nullable)
  - `expiryEnforced` (boolean): Whether the tenant forces passwords to be changed periodically.
  - `expiryPeriodDays` (integer(int32)): The tenant's rotation period in days. Meaningful only when `expiryEnforced` is  `true`; the setting carries a value either way.
  - `expiresUtc` (string(date-time)): When the current password stops being accepted, in UTC, or `null` when rotation is not  enforced or the last-changed instant is unknown. (nullable)
  - `daysUntilExpiry` (integer(int32)): Whole days until `expiresUtc`, negative once it has passed, or `null` when  there is no expiry to count towards. (nullable)
- `sessions` ([SecuritySessionStatusDto](https://devportal.demo.winkpg.io/docs/api/models/SecuritySessionStatusDto.md)): Active login sessions.
  Fields:
  - `activeCount` (integer(int32)): How many sessions the account currently has, including the one making this request.
- `enforcement` ([SecurityEnforcementPostureDto](https://devportal.demo.winkpg.io/docs/api/models/SecurityEnforcementPostureDto.md)): What the platform actually enforces for this account right now.
  Fields:
  - `mfaRequirement` ([MfaRequirement](https://devportal.demo.winkpg.io/docs/api/models/MfaRequirement.md)): Whether a second factor is optional, required or turned off for this account.
    Values:
    - `Optional`: The account holder chooses. This is the platform default.
    - `Required`: A second factor is required and the account holder cannot turn it off.
    - `Disabled`: Two-factor authentication is turned off for the account and cannot be enrolled.
  - `mfaRequirementSource` ([MfaRequirementSource](https://devportal.demo.winkpg.io/docs/api/models/MfaRequirementSource.md)): Which switch decided `mfaRequirement`.
    Values:
    - `AccountHolder`: Nothing forces the outcome: the account holder decides.
    - `SubscriptionFeature`: The subscription feature, which a reseller or the platform operator sets and a tenant administrator cannot override.
    - `TenantPolicy`: The tenant's own two-factor setting.
  - `usersCanChangeMfa` (boolean): Whether the account holder may turn their own second factor on and off.
  - `idleTimeoutMinutes` (integer(int32)): How many minutes of inactivity end the session, from the tenant's idle-circuit setting.
  - `preventConcurrentLogin` (boolean): Whether the tenant allows only one concurrent login per account.
  - `signInIpRestrictionEnforced` (boolean): Whether interactive portal access is restricted by source address.

## See also

- [All documentation](https://devportal.demo.winkpg.io/llms.txt): the machine-readable index of every public page on this site.