Configure User Lock Policy

put

https://{jfrog_url}/access/api/v1/config/security/user_lock_policy

Replaces the user lock policy.

Send every field. The request model uses numeric and boolean values, so
a missing field is stored as 0 or false. That is not the server
default. Omitting attempts disables account locking. Omitting
passwordExpiryDays disables password expiry. Omitting
baseLoginDelayMillis disables temporary login suspension. Omitting
clientLoginSuspensionEnabled turns client login suspension off
(false), which is the opposite of the server default (true).

To change one setting, read the policy first and send the full object
back with that field updated.

attempts must be from 0 through 100. secondsToUnlock and
passwordExpiryDays must be greater than or equal to 0. A value
outside those ranges is rejected.

Replaces: PUT /artifactory/api/security/userLockPolicy.

Map enabled: true and loginAttempts to attempts. Map
enabled: false to attempts: 0.

Security: Requires an admin user.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

Full user lock policy. Every field is written. Omitted fields are stored as 0 or false.

Access user lock policy. JSON names are camelCase. The same settings in the Access YAML configuration are under security.user-lock-policy with kebab-case names.

attempts

integer

0 to 100

Failed login attempts before the user is locked. 0 disables account locking. YAML: security.user-lock-policy.attempts. Server default: 0.

secondsToUnlock

integer

≥ 0

Seconds before a locked user can sign in again. 0 keeps the user locked until an administrator unlocks them. When this is greater than 0, the next sign-in after the interval re-enables the user. YAML: security.user-lock-policy.seconds-to-unlock. Server default: 0.

passwordExpiryDays

integer

≥ 0

Days before an internal user's password expires. 0 means passwords do not expire. This replaces the deprecated Artifactory password expiration policy: enabled corresponds to passwordExpiryDays greater than 0, and passwordMaxAge corresponds to passwordExpiryDays. YAML: security.user-lock-policy.password-expiry-days. Server default: 0.

adminPasswordExpirable

boolean

When true, password expiry also applies to platform admin users. When false, admin passwords do not expire. YAML: security.user-lock-policy.admin-password-expirable. Server default: false.

maxLoginDelayIncorrectAttempts

integer

Failed attempts that are allowed before temporary login suspension starts. Failures below this number are not delayed. YAML: security.user-lock-policy.max-login-delay-incorrect-attempts. Server default: 2.

maxLoginDelayMillis

int64

Maximum delay, in milliseconds, between attempts after repeated failures. The delay grows with the square of the failure count, from baseLoginDelayMillis, and is capped here. YAML: security.user-lock-policy.max-login-delay-millis. Server default: 60000.

baseLoginDelayMillis

int64

Base delay, in milliseconds, used to calculate temporary login suspension. 0 or a negative value disables temporary login suspension. YAML: security.user-lock-policy.base-login-delay-millis. Server default: 1000.

clientLoginSuspensionEnabled

boolean

When true, basic-credential authentication checks temporary login suspension before accepting the attempt. When false, that check is skipped. YAML: security.user-lock-policy.client-login-suspension-enabled. Server default: true.

Responses

400

Bad Request. attempts is outside 0-100, or secondsToUnlock or passwordExpiryDays is negative.

401

Bad Credentials - Invalid credentials

403

Permission Denied - Requires an admin user

Language

Credentials

Bearer

URL

Loading…

Response

Choose an example:

application/json

200Policy replaced. The response is the policy that was stored, which is the request after missing fields are filled with 0 or false.