Get the environment settings

GET /v1/environment-settings · permission environment-settings:read

Returns the environment's language, time zone, session, sign-up, security notification, account recovery, MFA, Front-Channel Logout and allowed first factor settings (one resource per environment). If the settings were never written, the defaults are returned with ETag: "0" and updated_at: null. The ETag response header carries the version to send as If-Match on PATCH. Durations are whole seconds.

Request

This operation takes no path, query or body fields. The environment comes from the credential.

Response

200 OK with the settings and the ETag header.

allowed_first_factors lists the first factors allowed in the environment and is always returned in this order: password, passkey, email_otp, magic_link, sms_otp, social, enterprise. The default is ["password", "passkey", "social", "enterprise"]; email_otp, magic_link and sms_otp are on only when you add them. An application or organization policy can only narrow this set.

{
  "locales": {"enabled": ["en", "tr"], "default": "tr"},
  "default_zoneinfo": "Europe/Istanbul",
  "session": {"idle_timeout_s": 3600, "absolute_timeout_s": 2592000, "max_concurrent": 5, "concurrent_mode": "evict_oldest", "anomaly_action": "enforce"},
  "signup": {"mode": "invite_only", "email_domain_mode": "allowlist", "email_domains": ["example.com"]},
  "security_notifications": {"enabled": true, "events": ["password_changed", "password_reset"]},
  "account_recovery": {"mode": "self_service_waiting", "waiting_hours": 72, "support_url": ""},
  "mfa": {"email_second_factor_enabled": false, "email_second_factor_acr": "1fa", "totp_issuer_label": "Acme", "recovery_codes_enabled": true, "recovery_code_count": 10, "required": false, "min_acr": "1fa", "enrollment_grace_days": 0},
  "frontchannel_logout_enabled": false,
  "allowed_first_factors": ["password", "passkey", "social", "enterprise"],
  "updated_at": "2026-10-05T09:30:00.123456Z"
}

Errors

Example

curl https://api.eu.keenauth.com/v1/environment-settings \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"