---
updatedAt: 2026-06-04T19:58:43.000Z
agentTools:
  projectIndex: https://docs.wristband.dev/llms.txt
---

# Resolve Application MFA Policy Overrides

Resolves the MFA policy overrides at the application level. MFA policies support default values; therefore, if there are no overrides defined at the application level, then this API will return the defaults instead.

### Required Permissions

Below is the list of required permissions needed to interact with this API.  For each permission, the allowed permission boundaries are also specified.

| Permission          | Boundary    | Description                                                                                                 |
| ------------------- | ----------- | ----------------------------------------------------------------------------------------------------------- |
| **mfa-policy:read** | Application | The subject can perform this request if they are associated with the application specified in the URL path. |

# OpenAPI definition

```json
{
  "openapi": "3.1.0",
  "info": {
    "title": "Resource Management APIs",
    "version": "1.0.0",
    "description": "Resource Management APIs",
    "license": {
      "name": "Private",
      "url": "https://wristband.dev/terms/"
    },
    "termsOfService": "https://wristband.dev/terms/",
    "contact": {
      "name": "Wristband Support",
      "email": "support@wristband.dev",
      "url": "https://wristband.dev/contact/"
    }
  },
  "servers": [
    {
      "url": "https://{application_vanity_domain}",
      "description": "Wristband application scoped URL.",
      "variables": {
        "application_vanity_domain": {
          "default": "yourapp-yourorg.us.wristband.dev",
          "description": "Wristband vanity domain scoped to a specific application."
        }
      }
    }
  ],
  "tags": [
    {
      "name": "MFA Policies",
      "description": "MFA Policies",
      "x-displayName": "MFA Policies"
    }
  ],
  "paths": {
    "/api/v1/applications/{applicationId}/mfa-policies/resolve-overrides": {
      "parameters": [
        {
          "$ref": "#/components/parameters/Resource_Management_APIs_ApplicationId"
        }
      ],
      "post": {
        "summary": "Resolve Application MFA Policy Overrides",
        "operationId": "resolveApplicationMfaPolicyOverridesV1",
        "tags": [
          "MFA Policies"
        ],
        "parameters": [
          {
            "$ref": "#/components/parameters/Resource_Management_APIs_Fields"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Resource_Management_APIs_MfaPolicyOverrideResults"
                },
                "examples": {
                  "Example 1 - All Overrides Defined at Application Level": {
                    "$ref": "#/components/examples/Resource_Management_APIs_MfaPolicyOverridesNonDefaultValue"
                  },
                  "Example 2 - No Overrides Defined at Application Level (Defaults Used Instead)": {
                    "$ref": "#/components/examples/Resource_Management_APIs_MfaPolicyOverridesDefaultValue"
                  }
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/Resource_Management_APIs_400-default"
          },
          "401": {
            "$ref": "#/components/responses/Resource_Management_APIs_401"
          },
          "403": {
            "$ref": "#/components/responses/Resource_Management_APIs_403"
          },
          "404": {
            "$ref": "#/components/responses/Resource_Management_APIs_404-application-not-found"
          },
          "405": {
            "$ref": "#/components/responses/Resource_Management_APIs_405"
          },
          "406": {
            "$ref": "#/components/responses/Resource_Management_APIs_406"
          },
          "500": {
            "$ref": "#/components/responses/Resource_Management_APIs_500"
          },
          "503": {
            "$ref": "#/components/responses/Resource_Management_APIs_503"
          }
        },
        "security": [
          {
            "Resource_Management_APIs_BearerAuth": []
          }
        ]
      }
    }
  },
  "components": {
    "securitySchemes": {
      "Resource_Management_APIs_BearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT"
      }
    },
    "parameters": {
      "Resource_Management_APIs_ApplicationId": {
        "name": "applicationId",
        "description": "The ID of the application that the resource or action is scoped to.",
        "in": "path",
        "required": true,
        "schema": {
          "type": "string",
          "minLength": 1,
          "maxLength": 26,
          "example": "jkuik2gzzvbsbfdepwyqpreryh"
        }
      },
      "Resource_Management_APIs_Fields": {
        "name": "fields",
        "in": "query",
        "required": false,
        "schema": {
          "type": "string",
          "default": "*",
          "example": "field1,field2",
          "minLength": 0
        },
        "description": "List of resource fields that should be returned in a response.  The wildcard value of `*` can be used to return all fields for the resource.",
        "style": "form"
      }
    },
    "schemas": {
      "Resource_Management_APIs_id": {
        "type": "string",
        "minLength": 1,
        "maxLength": 26,
        "example": "pl4a4aa4jzydksmrf3jnu5yfcw",
        "description": "Globally unique Id of the resource.",
        "readOnly": true
      },
      "Resource_Management_APIs_api-error": {
        "title": "ApiError",
        "type": "object",
        "description": "API error object",
        "x-examples": {
          "Example 1": {
            "code": "invalid_request",
            "message": "The request was invalid",
            "ticket": "11t7n71hi5e6t"
          }
        },
        "properties": {
          "type": {
            "type": "string",
            "example": "base_error",
            "minLength": 1,
            "description": "The type of the API error.",
            "readOnly": true
          },
          "code": {
            "type": "string",
            "example": "invalid_request",
            "minLength": 1,
            "description": "A code identifying the error that occurred.",
            "readOnly": true
          },
          "message": {
            "type": "string",
            "example": "The request was invalid",
            "description": "A free text message describing the error.  This error message is only meant to help developers understand the cause of the error.  It should not be used for programmatic purposes.",
            "readOnly": true
          },
          "ticket": {
            "type": "string",
            "example": "11t7n71hi5e6t",
            "description": "Ticket that can help correlate the error to the backend",
            "readOnly": true
          },
          "details": {
            "type": "object",
            "description": "A map of details about the error. The keys are defined by the API.",
            "additionalProperties": {},
            "example": {
              "attemptsRemaining": 4
            }
          }
        },
        "required": [
          "type",
          "code"
        ]
      },
      "Resource_Management_APIs_constraint-violations-api-error": {
        "title": "ConstraintViolationsApiError",
        "description": "An API error that occurred due to a constraint violation",
        "allOf": [
          {
            "$ref": "#/components/schemas/Resource_Management_APIs_api-error"
          },
          {
            "type": "object",
            "readOnly": true,
            "required": [
              "violations"
            ],
            "properties": {
              "violations": {
                "type": "object",
                "readOnly": true,
                "required": [
                  "code"
                ],
                "properties": {
                  "code": {
                    "type": "string",
                    "description": "A code identifying the constraint violation.",
                    "minLength": 1,
                    "example": "too_long"
                  },
                  "constraintAttributes": {
                    "type": "object",
                    "description": "A map of constraint attribute values.",
                    "additionalProperties": {
                      "type": "string"
                    },
                    "example": {
                      "maxLength": "10"
                    }
                  }
                }
              }
            }
          }
        ],
        "x-examples": {
          "Example 1": {
            "type": "constraint_violations_error",
            "code": "message_body_constraint_violations",
            "message": "The request contained invalid fields",
            "ticket": "11t7n71hi5e6t",
            "violations": {
              "field1": {
                "code": "too_long",
                "constraintAttributes": {
                  "maxLength": "10"
                }
              },
              "field2": {
                "code": "not_null"
              }
            }
          }
        }
      },
      "Resource_Management_APIs_upsertOwnerType": {
        "description": "[Required on Create and Upsert] The type of the owner of the resource.",
        "type": "string",
        "enum": [
          "APPLICATION",
          "TENANT"
        ],
        "minLength": 1,
        "maxLength": 30,
        "example": "APPLICATION"
      },
      "Resource_Management_APIs_upsertOwnerId": {
        "description": "[Required on Create and Upsert] The ID of the owner of the resource.",
        "type": "string",
        "minLength": 1,
        "maxLength": 26,
        "example": "d7aml4q5lza3fdi2gavzdliouy"
      },
      "Resource_Management_APIs_version-metadata": {
        "title": "VersionMetadata",
        "type": "object",
        "description": "Version metadata associated to a resource.",
        "properties": {
          "version": {
            "type": "string",
            "example": "1.0",
            "description": "The version of the resource",
            "readOnly": true
          },
          "lastModifiedTime": {
            "type": "string",
            "format": "date-time",
            "example": "2016-06-13T19:49:31.686Z",
            "description": "The time at which the resource was last modified",
            "readOnly": true
          },
          "creationTime": {
            "type": "string",
            "format": "date-time",
            "example": "2016-06-13T19:49:31.686Z",
            "description": "The time at which the resource was created",
            "readOnly": true
          }
        }
      },
      "Resource_Management_APIs_isDefault": {
        "type": "boolean",
        "description": "Boolean indicating if the override result is a default value or not.",
        "readOnly": true,
        "example": true
      },
      "Resource_Management_APIs_MfaPolicy": {
        "title": "MFA Policy",
        "description": "MFA Policy",
        "type": "object",
        "x-tags": [
          "Models"
        ],
        "required": [
          "ownerType",
          "ownerId"
        ],
        "properties": {
          "id": {
            "$ref": "#/components/schemas/Resource_Management_APIs_id"
          },
          "ownerType": {
            "$ref": "#/components/schemas/Resource_Management_APIs_upsertOwnerType"
          },
          "ownerId": {
            "$ref": "#/components/schemas/Resource_Management_APIs_upsertOwnerId"
          },
          "enrollmentStrategy": {
            "type": "string",
            "description": "The strategy that should be used to enroll users in MFA.\n\n| Strategy   | Description           | \n| -----------| --------------------- | \n| OPTIONAL   | The user can optionally choose to enroll in MFA on their own accord. | \n| REQUIRED   | The user is required to enroll in MFA.  When users attempt to sign up or log in to the application, they will be required to enroll in MFA if they have not already done so. | ",
            "enum": [
              "OPTIONAL",
              "REQUIRED"
            ],
            "minLength": 1,
            "maxLength": 45,
            "default": "OPTIONAL",
            "example": "REQUIRED"
          },
          "allowedAuthFactors": {
            "type": "array",
            "uniqueItems": true,
            "description": "Array of auth factors that a user is allowed to enroll in.  If the `enrollmentStrategy` is set to `REQUIRED` then this value can't be empty.  Also, `RECOVERY_CODE` can't be the only allowed auth factor.",
            "items": {
              "type": "string",
              "enum": [
                "RECOVERY_CODE",
                "TOTP"
              ],
              "example": [
                "TOTP"
              ]
            },
            "example": [
              "TOTP",
              "RECOVERY_CODE"
            ]
          },
          "totpSettings": {
            "properties": {
              "issuer": {
                "type": "string",
                "description": "The issuer value that will be displayed in the authenticator application.  If this value is `null` then the issuer will default to the application's display name.  Note, the issuer string can't contain colon (`:`) values.",
                "minLength": 1,
                "maxLength": 30,
                "example": "My App"
              }
            }
          },
          "metadata": {
            "$ref": "#/components/schemas/Resource_Management_APIs_version-metadata"
          }
        },
        "example": {
          "id": "fcwpl4a4aa4jzydksmrf3jnu5y",
          "ownerType": "APPLICATION",
          "ownerId": "d7aml4q5lza3fdi2gavzdliouy",
          "enrollmentStrategy": "REQUIRED",
          "allowedAuthFactors": [
            "TOTP",
            "RECOVERY_CODE"
          ],
          "totpSettings": {
            "issuer": "My App"
          },
          "metadata": {
            "version": "0.0",
            "lastModifiedTime": "2021-06-13T19:49:31.686Z",
            "creationTime": "2021-06-13T19:49:31.686Z"
          }
        }
      },
      "Resource_Management_APIs_MfaPolicyOverrideResult": {
        "title": "MFA Policy Override Result",
        "description": "MFA Policy Override Result",
        "type": "object",
        "x-tags": [
          "Models"
        ],
        "readOnly": true,
        "additionalProperties": false,
        "required": [
          "isDefault",
          "item"
        ],
        "properties": {
          "isDefault": {
            "$ref": "#/components/schemas/Resource_Management_APIs_isDefault"
          },
          "item": {
            "$ref": "#/components/schemas/Resource_Management_APIs_MfaPolicy"
          }
        },
        "example": {
          "isDefault": false,
          "item": {
            "id": "fcwpl4a4aa4jzydksmrf3jnu5y",
            "ownerType": "APPLICATION",
            "ownerId": "d7aml4q5lza3fdi2gavzdliouy",
            "enrollmentStrategy": "REQUIRED",
            "allowedAuthFactors": [
              "TOTP",
              "RECOVERY_CODE"
            ],
            "totpSettings": {
              "issuer": "My App"
            },
            "metadata": {
              "version": "0.0",
              "lastModifiedTime": "2021-06-13T19:49:31.686Z",
              "creationTime": "2021-06-13T19:49:31.686Z"
            }
          }
        }
      },
      "Resource_Management_APIs_MfaPolicyOverrideResults": {
        "title": "MFA Policy Override Results",
        "description": "MFA Policy Override Results",
        "type": "object",
        "x-tags": [
          "Models"
        ],
        "readOnly": true,
        "additionalProperties": false,
        "required": [
          "items"
        ],
        "properties": {
          "items": {
            "type": "array",
            "uniqueItems": true,
            "items": {
              "$ref": "#/components/schemas/Resource_Management_APIs_MfaPolicyOverrideResult"
            },
            "readOnly": true
          }
        },
        "example": {
          "items": [
            {
              "isDefault": false,
              "item": {
                "id": "fcwpl4a4aa4jzydksmrf3jnu5y",
                "ownerType": "APPLICATION",
                "ownerId": "d7aml4q5lza3fdi2gavzdliouy",
                "enrollmentStrategy": "REQUIRED",
                "allowedAuthFactors": [
                  "TOTP",
                  "RECOVERY_CODE"
                ],
                "totpSettings": {
                  "issuer": "My App"
                },
                "metadata": {
                  "version": "0.0",
                  "lastModifiedTime": "2021-06-13T19:49:31.686Z",
                  "creationTime": "2021-06-13T19:49:31.686Z"
                }
              }
            }
          ]
        }
      }
    },
    "examples": {
      "Resource_Management_APIs_MfaPolicyOverridesNonDefaultValue": {
        "description": "MFA policy override result that resolves to existing application-level values.",
        "value": {
          "items": [
            {
              "isDefault": false,
              "item": {
                "id": "fcwpl4a4aa4jzydksmrf3jnu5y",
                "ownerType": "APPLICATION",
                "ownerId": "d7aml4q5lza3fdi2gavzdliouy",
                "enrollmentStrategy": "REQUIRED",
                "allowedAuthFactors": [
                  "TOTP",
                  "RECOVERY_CODE"
                ],
                "totpSettings": {
                  "issuer": "My App"
                },
                "metadata": {
                  "version": "0.0",
                  "lastModifiedTime": "2021-06-13T19:49:31.686Z",
                  "creationTime": "2021-06-13T19:49:31.686Z"
                }
              }
            }
          ]
        }
      },
      "Resource_Management_APIs_MfaPolicyOverridesDefaultValue": {
        "description": "MFA policy override result that resolves to default values.",
        "value": {
          "items": [
            {
              "isDefault": true,
              "item": {
                "id": null,
                "ownerType": "APPLICATION",
                "ownerId": "362cbrxlubdydpeiojoaxiz3zm",
                "enrollmentStrategy": "OPTIONAL",
                "allowedAuthFactors": [],
                "totpSettings": {
                  "issuer": null
                },
                "metadata": {
                  "version": "0.0",
                  "lastModifiedTime": null,
                  "creationTime": null
                }
              }
            }
          ]
        }
      }
    },
    "responses": {
      "Resource_Management_APIs_401": {
        "description": "Unauthorized",
        "headers": {
          "WWW-Authenticate": {
            "description": "Includes details on the failed authentication condition. This header is set in accordance with the [OAuth2 specification](https://datatracker.ietf.org/doc/html/rfc6750#section-3).",
            "schema": {
              "type": "string",
              "example": "Bearer error=\"invalid_token\", error_description=\"The provided access token was invalid\""
            }
          }
        },
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Resource_Management_APIs_api-error"
            },
            "examples": {
              "code - unauthenticated": {
                "value": {
                  "type": "base_error",
                  "code": "invalid_access_token",
                  "message": "The provided access token was invalid",
                  "ticket": "1u0d0edhwbjsd"
                }
              }
            }
          }
        }
      },
      "Resource_Management_APIs_403": {
        "description": "Forbidden",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Resource_Management_APIs_api-error"
            },
            "examples": {
              "code - unauthorized": {
                "value": {
                  "type": "base_error",
                  "code": "unauthorized",
                  "message": "The request failed authorization",
                  "ticket": "11t7n71hi5e6t"
                }
              }
            }
          }
        }
      },
      "Resource_Management_APIs_405": {
        "description": "Method Not Allowed",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Resource_Management_APIs_api-error"
            },
            "examples": {
              "code - method_not_supported": {
                "value": {
                  "type": "base_error",
                  "code": "method_not_supported",
                  "message": "The specified HTTP method is not supported",
                  "ticket": "11t7n71hi5e6t"
                }
              }
            }
          }
        }
      },
      "Resource_Management_APIs_406": {
        "description": "Not Acceptable",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Resource_Management_APIs_api-error"
            },
            "examples": {
              "code - not_acceptable": {
                "value": {
                  "type": "base_error",
                  "code": "not_acceptable",
                  "message": "The Accept header was invalid",
                  "ticket": "11t7n71hi5e6t"
                }
              }
            }
          }
        }
      },
      "Resource_Management_APIs_500": {
        "description": "Internal Server Error",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Resource_Management_APIs_api-error"
            },
            "examples": {
              "code - internal_server_failure ": {
                "value": {
                  "type": "base_error",
                  "code": "internal_server_failure",
                  "message": "An unexpected error occurred while processing the request",
                  "ticket": "11t7n71hi5e6t"
                }
              }
            }
          }
        }
      },
      "Resource_Management_APIs_503": {
        "description": "Service Unavailable",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Resource_Management_APIs_api-error"
            },
            "examples": {
              "code - service_unavailable": {
                "value": {
                  "type": "base_error",
                  "code": "service_unavailable",
                  "message": "The service is currently unavailable",
                  "ticket": "11t7n71hi5e6t"
                }
              }
            }
          }
        }
      },
      "Resource_Management_APIs_400-default": {
        "description": "Bad Request",
        "content": {
          "application/json": {
            "schema": {
              "oneOf": [
                {
                  "$ref": "#/components/schemas/Resource_Management_APIs_api-error"
                },
                {
                  "$ref": "#/components/schemas/Resource_Management_APIs_constraint-violations-api-error"
                }
              ]
            },
            "examples": {
              "code - invalid_request": {
                "value": {
                  "type": "base_error",
                  "code": "invalid_request",
                  "message": "The request was invalid",
                  "ticket": "11t7n71hi5e6t"
                }
              },
              "code - request_constraint_violations": {
                "value": {
                  "type": "constraint_violations_error",
                  "code": "message_body_constraint_violations",
                  "message": "The message body contained invalid fields",
                  "ticket": "11t7n71hi5e6t",
                  "violations": {
                    "field1": {
                      "code": "too_long",
                      "constraintAttributes": {
                        "maxLength": 10
                      }
                    },
                    "field2": {
                      "code": "not_null"
                    }
                  }
                }
              }
            }
          }
        }
      },
      "Resource_Management_APIs_404-application-not-found": {
        "description": "Not Found",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Resource_Management_APIs_api-error"
            },
            "examples": {
              "code - application_not_found": {
                "value": {
                  "type": "base_error",
                  "code": "application_not_found",
                  "message": "Application could not be found",
                  "ticket": "11t7n71hi5e6t"
                }
              }
            }
          }
        }
      }
    }
  },
  "x-tagGroups": [
    {
      "name": "Resource Management APIs",
      "tags": [
        "Applications",
        "Auth Factors",
        "Auth Sessions",
        "Auth Session Policies",
        "Bot Detection Policies",
        "Custom Claims",
        "Custom Domains",
        "Email Brandings",
        "Email Domains",
        "Email Policies",
        "External IdP Profiles",
        "External IdP Tokens",
        "Identity Providers",
        "IdP Attribute Mappings",
        "IdP Role Mappings",
        "MFA Policies",
        "OAuth2 Clients",
        "Page Brandings",
        "Password Policies",
        "Permissions",
        "Permission Boundaries",
        "Permission Groups",
        "Refresh Tokens",
        "Remembered Tenants",
        "Roles",
        "Role Assignment Policies",
        "Signing Keys",
        "Tenants",
        "Users",
        "User Schemas",
        "Vanity Domains",
        "Webhook Policies",
        "Workflow Policies"
      ]
    }
  ]
}
```