{
  "sections": [
    "title",
    "description",
    "fields",
    "special_access_rules",
    "field_reference"
  ],
  "title": "NetworkAuthApiSettings - Data API",
  "description": "Represents the settings that control enablement, access, and security for the Headless Registration Flow, Headless Forgot Password Flow, Headless Passwordless Login Flow, and their associated APIs. This object is available in API version 58.0 and later.",
  "fields_columns": [
    "type",
    "properties",
    "description",
    "relationship_name",
    "refers_to",
    "descriptions",
    "notes",
    "relationship_type"
  ],
  "fields": {
    "CustomOtpDeliveryHandlerId": {
      "type": "reference",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "This field is a relationship field. The ID of a custom one-time password (OTP) delivery handler that implements the Auth.CustomOneTimePasswordDeliveryHandler interface."
    },
    "DoesForgotPasswordRequireAuth": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether authentication is required to access Headless Forgot Password API when a password reset is requested. If true, an access token issued to an internal integration user in your initial POST request to the /services/auth/headless/forgot_password endpoint is required. The access token must include the forgot_password scope. The default value is false."
    },
    "DoesPasswordLoginRequireAuth": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether reCAPTCHA is required for headless username-password login that uses the OAuth 2.0 for First-Party Applications draft protocol."
    },
    "DoesPwdlessLoginRequireAuth": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether authentication is required to access Headless Passwordless Login API when user information is submitted to Salesforce. If true, an access token issued to an internal integration user is required in your initial POST request to the /services/auth/headless/init/passwordless/login endpoint. The access token must include the pwdless_login_api scope. The default value is false. This field is available in API version 59.0 and later."
    },
    "DoesRegistrationRequireAuth": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether authentication is required to access Headless Registration API when user registration information is submitted to Salesforce. If true, an access token issued to an internal integration user in your initial POST request to the /services/auth/headless/init/registration endpoint is required. The access token must include the user_registration_api scope. The default value is false."
    },
    "HeadlessDiscoveryExecutionUserId": {
      "type": "reference",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "This field is a relationship field. The ID of an integration user account to run a headless user discovery Apex handler.",
      "relationship_name": "HeadlessDiscoveryExecutionUser",
      "refers_to": "User"
    },
    "HeadlessDiscoveryHandlerId": {
      "type": "reference",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "This field is a relationship field. The ID of an Apex class that implements the Auth.HeadlessUserDiscoveryHandler interface.",
      "relationship_name": "HeadlessDiscoveryHandler",
      "refers_to": "ApexClass"
    },
    "isFirstPartyAppsAllowed": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether the Experience Cloud site can use headless identity flows that use the OAuth 2.0 for First-Party Applications draft protocol."
    },
    "IsForgotPwdAllowed": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether the Headless Forgot Password Flow is enabled. The default value is false."
    },
    "IsForgotPwdEmailTemplateAllowlistingEnabled": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "descriptions": "Determines whether email template allowlisting is enabled for the Headless Registration Flow, Headless Passwordless Login Flow, and Headless Forgot Password Flow. If true, the initial request to the headless API must include an emailtemplate parameter that contains only allowlisted email templates.",
      "notes": "The default value is false."
    },
    "IsHeadlessUserRegistrationAllowed": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether the Headless Registration Flow is enabled. The default value is false."
    },
    "IsPwdlessLoginAllowed": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether the Headless Passwordless Login Flow is enabled (true) or not (false). The flow is disabled by default. This field is available in API version 59.0 and later."
    },
    "IsRecaptchaRequiredForgotPwd": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether a reCAPTCHA token is required to access Headless Forgot Password API when a password reset is requested. If true, a reCAPTCHA token is required in your initial POST request to the /services/auth/headless/forgot_password endpoint. The default value is false."
    },
    "IsRecaptchaRequiredPwdlessLogin": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether a reCAPTCHA token is required to access Headless Passwordless Login API when user information is submitted to Salesforce. If true, a reCAPTCHA token is required in your initial POST request to the /services/auth/headless/init/passwordless/login endpoint. By default, a reCAPTCHA token isn’t required (false). This field is available in API version 59.0 and later."
    },
    "IsRecaptchaRequiredRgstr": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether a reCAPTCHA token is required to access Headless Registration API when user registration information is submitted to Salesforce. If true, a reCAPTCHA token is required in your initial POST request to the /services/auth/headless/init/registration endpoint. The default value is false."
    },
    "IsUniversalClientRgstrAllowed": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether self-registration and passwordless login via Universal Registration API are enabled. The default value is false."
    },
    "IsUserDisambiguationAllowedForgotPwd": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether the Headless Forgot Password Flow uses the headless user discovery Apex handler that's specified in the HeadlessDiscoveryHandlerId field. The handler enables users to reset their password with an identifier other than their username, such as an email address, phone number, or order number. The default value is false."
    },
    "IsUserDisambiguationAllowedUsernamePwd": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Determines whether headless login flows use the headless user discovery Apex handler that's specified in the HeadlessDiscoveryHandlerId field. The handler enables users to log in with an identifier other than their username, such as an email address, phone number, or order number. This field applies to the Authorization Code and Credentials Flow and the OAuth 2.0 for First-Party Applications login flow. The default value is false."
    },
    "MaxPasswordResetAttempts": {
      "type": "int",
      "properties": "Create, Defaulted on create, Filter, Group, Nillable, Sort, Update",
      "description": "The maximum number of password reset attempts you allow for the Headless Forgot Password Flow before the user must request a new one-time password (OTP)."
    },
    "NetworkId": {
      "type": "reference",
      "properties": "Create, Filter, Group, Sort",
      "description": "The ID of your Experience Cloud site. This ID is unique within your org. This field is a relationship field.",
      "relationship_name": "Network",
      "relationship_type": "Lookup",
      "refers_to": "Network"
    },
    "RecaptchaScoreThreshold": {
      "type": "double",
      "properties": "Create, Filter, Nillable, Sort, Update",
      "description": "The lowest reCAPTCHA score that is accepted before rejecting a request to access Headless Identity APIs. This value must be between 0.5 and 1. Scores closer to 0.5 are more likely to be bots, while scores closer to 1 are more likely to be valid users. You must set a score threshold if DoesForgotPasswordRequireAuth or DoesRegistrationRequireAuth fields are set to true. reCAPTCHA settings apply to both the Headless Registration Flow and the Headless Forgot Password Flow. Google issues a reCAPTCHA score only for reCAPTCHA v3 implementations. If you implement reCAPTCHA v2, this field doesn’t apply."
    },
    "RecaptchaSecretKey": {
      "type": "encryptedstring",
      "properties": "Create, Nillable, Update",
      "description": "The reCAPTCHA secret key from your API key pair. You get the API key pair from Google when you set up reCAPTCHA. The secret key helps your app securely communicate with Google. You must enter a secret key if DoesForgotPasswordRequireAuth or DoesRegistrationRequireAuth are set to true. reCAPTCHA settings apply to both the Headless Registration Flow and the Headless Forgot Password Flow."
    },
    "RegistrationExecutionUserId": {
      "type": "reference",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "The ID of the user who runs your headless registration Apex handler. This field is a relationship field.",
      "relationship_name": "RegistrationExecutionUser",
      "relationship_type": "Lookup",
      "refers_to": "User"
    },
    "RegistrationHandlerId": {
      "type": "reference",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "The ID of your headless registration Apex handler. This field is a relationship field.",
      "relationship_name": "RegistrationHandler",
      "relationship_type": "Lookup",
      "refers_to": "ApexClass"
    },
    "RegistrationUserDefaultProfileId": {
      "type": "reference",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "The ID of the default profile that gets assigned to new users when they register. This field is a relationship field.",
      "relationship_name": "RegistrationUserDefaultProfile",
      "relationship_type": "Lookup",
      "refers_to": "Profile"
    }
  },
  "special_access_rules": "Headless identity features are set up via Experience Cloud sites. You must have an Experience Cloud site to access Headless Identity APIs and store users, even if users never interact with the site directly.\n\nHeadless identity features are set up via\n         Experience Cloud sites. You must have an Experience Cloud site to access Headless Identity\n         APIs and store users, even if users never interact with the site directly.",
  "field_reference": {
    "CreatedById": {
      "field_label": "Created By ID",
      "type": "reference",
      "length": "18"
    },
    "CreatedDate": {
      "field_label": "Created Date",
      "type": "datetime"
    },
    "CustomOtpDeliveryHandlerId": {
      "field_label": "Class ID",
      "type": "reference",
      "length": "18"
    },
    "DoesForgotPasswordRequireAuth": {
      "field_label": "Does reset password require authentication",
      "type": "boolean"
    },
    "DoesPasswordLoginRequireAuth": {
      "field_label": "Require reCAPTCHA for Username Password",
      "type": "boolean"
    },
    "DoesPwdlessLoginRequireAuth": {
      "field_label": "Require authentication for headless passwordless login",
      "type": "boolean"
    },
    "DoesRegistrationRequireAuth": {
      "field_label": "Require authentication for registration (Is only authenticated user allowed)",
      "type": "boolean"
    },
    "HeadlessDiscoveryExecutionUserId": {
      "field_label": "User ID",
      "type": "reference",
      "length": "18"
    },
    "HeadlessDiscoveryHandlerId": {
      "field_label": "Class ID",
      "type": "reference",
      "length": "18"
    },
    "Id": {
      "field_label": "Network Auth API Setting ID",
      "type": "id",
      "length": "18"
    },
    "IsDeleted": {
      "field_label": "Deleted",
      "type": "boolean"
    },
    "IsFirstPartyAppsAllowed": {
      "field_label": "Enable OAuth 2.0 for First Party Applications",
      "type": "boolean"
    },
    "IsForgotPwdAllowed": {
      "field_label": "Enable Headless Forgot Password Flow",
      "type": "boolean"
    },
    "IsForgotPwdEmailTemplateAllowlistingEnabled": {
      "field_label": "Enable forgot password email template allowlisting",
      "type": "boolean"
    },
    "IsHeadlessUserRegistrationAllowed": {
      "field_label": "Enable headless user registration",
      "type": "boolean"
    },
    "IsPwdlessLoginAllowed": {
      "field_label": "Enable headless passwordless login",
      "type": "boolean"
    },
    "IsRecaptchaRequiredForgotPwd": {
      "field_label": "Require reCAPTCHA for Forgot Password",
      "type": "boolean"
    },
    "IsRecaptchaRequiredPwdlessLogin": {
      "field_label": "Require reCAPTCHA for headless passwordless login",
      "type": "boolean"
    },
    "IsRecaptchaRequiredRgstr": {
      "field_label": "Require reCAPTCHA for registration",
      "type": "boolean"
    },
    "IsUniversalClientRgstrAllowed": {
      "field_label": "Allow self-registration and passwordless login via the Universal Registration API",
      "type": "boolean"
    },
    "IsUserDisambiguationAllowedForgotPwd": {
      "field_label": "Enable User Disambiguation Handler for Forgot Password Flow",
      "type": "boolean"
    },
    "IsUserDisambiguationAllowedUsernamePwd": {
      "field_label": "Enable User Disambiguation Handler for Username Password Flow",
      "type": "boolean"
    },
    "LastModifiedById": {
      "field_label": "Last Modified By ID",
      "type": "reference",
      "length": "18"
    },
    "LastModifiedDate": {
      "field_label": "Last Modified Date",
      "type": "datetime"
    },
    "MaxPasswordResetAttempts": {
      "field_label": "Maximum reset password attempts allowed",
      "type": "int",
      "digits": "9"
    },
    "NetworkId": {
      "field_label": "Network ID",
      "type": "reference",
      "length": "18"
    },
    "RecaptchaScoreThreshold": {
      "field_label": "ReCAPTCHA score threshold",
      "type": "double",
      "precision": "18",
      "scale": "0"
    },
    "RecaptchaSecretKey": {
      "field_label": "ReCAPTCHA secret key",
      "type": "encryptedstring",
      "length": "1020"
    },
    "RegistrationExecutionUserId": {
      "field_label": "User ID",
      "type": "reference",
      "length": "18"
    },
    "RegistrationHandlerId": {
      "field_label": "Class ID",
      "type": "reference",
      "length": "18"
    },
    "RegistrationUserDefaultProfileId": {
      "field_label": "Profile ID",
      "type": "reference",
      "length": "18"
    },
    "SystemModstamp": {
      "field_label": "System Modstamp",
      "type": "datetime"
    }
  },
  "field_reference_columns": [
    "field_label",
    "type",
    "length",
    "digits",
    "precision",
    "scale"
  ]
}