Bulk Endpoint Auth Settings
Set the auth mode — and optionally HTTPS enforcement — on many endpoints in one call, for example on every open endpoint the Exposure Summary lists. Each endpoint is applied on its own and gets its own result: an endpoint that fails never stops the rest, and the call answers 200 even when some (or all) of them failed. Read failed and results.
Only the mode changes (and enforce_https, when you send it). Each endpoint keeps its other auth settings — login page and protected paths, session TTL and its enabled sign-in methods; with sso the SSO sign-in method is also turned on. The mode alone creates no credentials: basic admits only the endpoint's Access Control clients, and sso signs visitors in through the endpoint's OAuth providers — add those per endpoint. To change one endpoint's full auth configuration use Update Endpoint Auth.
The edges in every region are notified when the changes are saved. Requires the endpoints:update permission in the active account. On a suspended account the call is refused (403, account_suspended).
Request body
uuids (despite the field name, uuids only), from List Endpoints or the exposure summary. 1 to 200 entries. An entry that names no endpoint of the active account is reported as not found in results.none, basic or sso (case-insensitive). sso is stored as basic with SSO sign-in turned on. Any other mode is refused with 400 before any endpoint is changed.true) or stop requiring it (false). When omitted, each endpoint keeps its current setting.Response (200 OK)
endpoint_ids entry, in request order.true when the endpoint was changed.not found; the quota-pause sentence (the endpoint is paused over your plan's limits and is read-only); could not verify the endpoint's plan status; or failed to apply. Omitted when ok is true.quota_paused when the endpoint was skipped because it is paused. Omitted otherwise.Errors
Invalid JSON); endpoint_ids is required; more than 200 entries (too many endpoints in one request); auth_mode is required: none, basic or sso; or an unsupported mode — token (removed: use Access Control clients with mode basic), header, cookie, jwt (use a jwt-validation traffic policy rule) or an unknown one, each with its own message.endpoints:update, you are not a member of the active account, or the account is suspended (account_suspended).Content-Type: application/json header.