Struct AuthClient 

pub struct AuthClient { /* private fields */ }

Client for auth operations.

Implementations

impl AuthClient

pub fn new(client: Client) -> Self

pub async fn create_user_action_signature( &self, body: CreateUserActionSignatureRequest, ) -> Result<CreateUserActionSignatureResponse, Error>

Completes the user action signing process and provides a signing token that can be used to verify the user intended to perform the action.

This is the first step of the User Action Signing flow.

pub async fn create_user_action_challenge( &self, body: CreateUserActionChallengeRequest, ) -> Result<CreateUserActionChallengeResponse, Error>

Starts a user action signing session, returning a challenge that will be used to verify the user’s intent to perform an action.

This is the first step of the User Action Signing flow.

pub async fn list_audit_logs( &self, query: Option<ListAuditLogsQuery>, ) -> Result<(), Error>

Gets all signature events which have occurred in the over the timeframe. The time range is unbounded, but the export is capped at 100,000 rows. When the result is truncated, the X-Dfns-Result-Truncated: true response header is set and a trailing # TRUNCATED ... line is appended to the CSV; narrow the time range to retrieve all data.

StartTime and EndTime are URL-encoded UTC ISO timestamps: startTime=2025-08-29T02%3A46%3A40Z

pub async fn get_audit_log( &self, id: String, ) -> Result<GetAuditLogResponse, Error>

Gets detailed information for a particular audit log. Specifically, the API returns the action performed, as well as the firstFactorCredential in which you will find the signature information required to validate it.

Dfns maintains a script which can be used for audit log signature validation: WebAuthn Signature Verifier

pub async fn list_applications(&self) -> Result<ListApplicationsResponse, Error>

👎Deprecated:

This endpoint is deprecated.

Applications are deprecated and will be removed in a future release. See details [here](https://docs.dfns.co/deprecation/applications-deprecation).

pub async fn get_application( &self, app_id: String, ) -> Result<GetApplicationResponse, Error>

👎Deprecated:

This endpoint is deprecated.

Applications are deprecated and will be removed in a future release. See details [here](https://docs.dfns.co/deprecation/applications-deprecation).

pub async fn list_credentials(&self) -> Result<ListCredentialsResponse, Error>

List all credentials for a user.

pub async fn create_credential( &self, body: CreateCredentialRequest, ) -> Result<CreateCredentialResponse, Error>

Part of the flow Create Credential Regular flow.

Adds a new credential to a user’s account. See Credential Kinds for all supported credential types.

pub async fn create_credential_challenge( &self, body: CreateCredentialChallengeRequest, ) -> Result<Value, Error>

Part of the flow Create Credential Regular flow.

Starts a create user credential session, returning a challenge that will be used to verify the user’s identity.

pub async fn activate_credential( &self, body: ActivateCredentialRequest, ) -> Result<ActivateCredentialResponse, Error>

Activates a credential that was previously deactivated. If the credential is already activated no action is taken.

pub async fn delete_credential( &self, credential_uuid: String, ) -> Result<DeleteCredentialResponse, Error>

Delete a specific credential.

pub async fn deactivate_credential( &self, body: DeactivateCredentialRequest, ) -> Result<DeactivateCredentialResponse, Error>

Deactivates a credential that was previously active. If the credential is already deactivated no action is taken.

pub async fn create_credential_code( &self, body: CreateCredentialCodeRequest, ) -> Result<CreateCredentialCodeResponse, Error>

Part of the Create Credential With Code flow.

Creates a one-time-code that can then be used to create a new credential from a place you don’t have access to one of your existing credential.

pub async fn create_credential_challenge_with_code( &self, body: CreateCredentialChallengeWithCodeRequest, ) -> Result<Value, Error>

Part of the flow Create Credential With Code.

Creates a credential challenge using a one time code-time-code. This challenge must then be signed by the new credential, before finalizing the flow.

pub async fn create_credential_with_code( &self, body: CreateCredentialWithCodeRequest, ) -> Result<CreateCredentialWithCodeResponse, Error>

Finalizes the flow Create Credential With Code.

Adds a new credential to a user’s account. This endpoint is similar to the Create Credential endpoint, except:

• it does not need the user to be authenticated

pub async fn create_login_challenge( &self, body: CreateLoginChallengeRequest, ) -> Result<CreateLoginChallengeResponse, Error>

Start a user login session, returning a challenge that will be used to verify the user’s identity.

If the user has a credential of kind PasswordProtectedKey a temporary one time code needs to be passed in the loginCode field.

pub async fn delegated_login( &self, body: DelegatedLoginRequest, ) -> Result<DelegatedLoginResponse, Error>

Only a [Service Account](https://docs.dfns.co/api-reference/auth/service-accounts) can use this endpoint.

pub async fn complete_user_login( &self, body: CompleteUserLoginRequest, ) -> Result<Value, Error>

Completes the login process and provides the authenticated user with their authentication token.

The type of credentials used to login is determined by the kind field in the nested objects (firstFactor and secondFactor). Supported credential kinds are:

• Fido2: Login challenge is signed by a user’s signing device using WebAuthn.

pub async fn logout(&self, body: LogoutRequest) -> Result<LogoutResponse, Error>

Completes the user logout process.

pub async fn complete_oidc_login( &self, body: CompleteOidcLoginRequest, ) -> Result<Value, Error>

Completes the OIDC login process by exchanging the authorization code obtained from the identity provider. If the verified user has no active first-factor credential yet, it returns a registration challenge to complete via Complete User Registration; otherwise it returns the user’s authentication token.

pub async fn initiate_oidc_login( &self, body: InitiateOidcLoginRequest, ) -> Result<InitiateOidcLoginResponse, Error>

Initialize the OIDC login process by returning the identity provider authorization URL to redirect the user to.

pub async fn send_login_code( &self, body: SendLoginCodeRequest, ) -> Result<SendLoginCodeResponse, Error>

Sends a temporary one time code to the user that can be used during login flow.

If the user has a credential of kind PasswordProtectedKey a temporary one time code needs to be passed in the loginCode field. That’s because the Create Login Challenge is unauthenticated and returns the encrypted private key of the user. So we need a first step to verify the identity of the user to prevent anybody from fetching the encrypted private key and trying to brute force it offline.

pub async fn social_login( &self, body: SocialLoginRequest, ) -> Result<SocialLoginResponse, Error>

Logs a user in with a JWT id token issued by a social login provider and provides the authenticated user with their authentication token.

pub async fn complete_sso_login( &self, body: CompleteSsoLoginRequest, ) -> Result<CompleteSsoLoginResponse, Error>

Completes the SSO login process by exchanging the authorization code obtained from the identity provider for the user’s authentication token.

pub async fn initiate_sso_login( &self, body: InitiateSsoLoginRequest, ) -> Result<InitiateSsoLoginResponse, Error>

Initialize the login process with SSO by returning the IdP URL to call.

pub async fn exchange_access_token( &self, body: ExchangeAccessTokenRequest, ) -> Result<ExchangeAccessTokenResponse, Error>

Only for TenantUsers - Exchanges the current user access token, for an org-bound or tenant-bound token. The user must have access to the target org / tenant. The new access token expiration won’t exceed the current token’s one.

pub async fn list_personal_access_tokens( &self, ) -> Result<ListPersonalAccessTokensResponse, Error>

Retrieve the list of your Personal Access Tokens.

pub async fn create_personal_access_token( &self, body: CreatePersonalAccessTokenRequest, ) -> Result<CreatePersonalAccessTokenResponse, Error>

Create a new Personal Access Token for the caller.

pub async fn get_personal_access_token( &self, token_id: String, ) -> Result<GetPersonalAccessTokenResponse, Error>

Retrieve a specific Personal Access Token.

pub async fn update_personal_access_token( &self, token_id: String, body: UpdatePersonalAccessTokenRequest, ) -> Result<UpdatePersonalAccessTokenResponse, Error>

Update a specific Personal Access Token.

pub async fn delete_personal_access_token( &self, token_id: String, ) -> Result<DeletePersonalAccessTokenResponse, Error>

Delete a specific Personal Access Token.

pub async fn activate_personal_access_token( &self, token_id: String, ) -> Result<ActivatePersonalAccessTokenResponse, Error>

Activate a specific Personal Access Token.

pub async fn deactivate_personal_access_token( &self, token_id: String, ) -> Result<DeactivatePersonalAccessTokenResponse, Error>

Deactivates a personal access token that was previously active. If the token is already deactivated no action is taken.

pub async fn create_delegated_recovery_challenge( &self, body: CreateDelegatedRecoveryChallengeRequest, ) -> Result<CreateDelegatedRecoveryChallengeResponse, Error>

Only a [Service Account](https://docs.dfns.co/api-reference/auth/service-accounts) can use this endpoint.

pub async fn recover_user( &self, body: RecoverUserRequest, ) -> Result<RecoverUserResponse, Error>

Recovers a user, using a recovery credential. After successfully recovering the user, all of the user’s previous credentials and personal access tokens will be invalidated.

This flow requires cryptographic validation of newly created credential(s) using a recovery credential. The recovery.credentialAssertion.clientData field’s challenge must be the base64url-encoded representation of the newCredential object.

pub async fn create_recovery_challenge( &self, body: CreateRecoveryChallengeRequest, ) -> Result<CreateRecoveryChallengeResponse, Error>

Starts a user recovery session, returning a challenge that will be used to verify the user’s identity.

pub async fn send_recovery_code_email( &self, body: SendRecoveryCodeEmailRequest, ) -> Result<SendRecoveryCodeEmailResponse, Error>

Send the user a recovery verification code. This code is used as a second factor to verify the user initiated the recovery request.

pub async fn create_delegated_registration_challenge( &self, body: CreateDelegatedRegistrationChallengeRequest, ) -> Result<CreateDelegatedRegistrationChallengeResponse, Error>

Only a [Service Account](https://docs.dfns.co/api-reference/auth/service-accounts) can use this endpoint.

pub async fn create_registration_challenge( &self, body: CreateRegistrationChallengeRequest, ) -> Result<CreateRegistrationChallengeResponse, Error>

Starts a user registration session. It returns a challenge that will need to be signed by a passkey and used to perform the step Complete User Registration

pub async fn create_social_registration_challenge( &self, body: CreateSocialRegistrationChallengeRequest, ) -> Result<CreateSocialRegistrationChallengeResponse, Error>

Starts an end-user registration session by passing a JWT obtained by an IdP. It returns a challenge that will need to be signed by a passkey and used to perform Complete End User Registration with Wallets.

pub async fn complete_user_registration( &self, body: CompleteUserRegistrationRequest, ) -> Result<CompleteUserRegistrationResponse, Error>

Completes the user registration process and creates the user’s initial credentials.

All credentials submitted in this call (firstFactorCredential, secondFactorCredential, recoveryCredential) sign the same challenge returned by the registration init endpoint (Create Registration Challenge, Create Delegated Registration Challenge, or Create Social Registration Challenge).

pub async fn complete_end_user_registration_with_wallets( &self, body: CompleteEndUserRegistrationWithWalletsRequest, ) -> Result<CompleteEndUserRegistrationWithWalletsResponse, Error>

Completes the end user registration process and creates the user’s initial credentials along with delegated wallets for the new end user.

All credentials submitted in this call (firstFactorCredential, secondFactorCredential, recoveryCredential) sign the same challenge returned by the registration init endpoint (Create Delegated Registration Challenge or Create Social Registration Challenge).

pub async fn resend_registration_code( &self, body: ResendRegistrationCodeRequest, ) -> Result<ResendRegistrationCodeResponse, Error>

Sends the user a new registration code. The previous registration code will be marked invalid. If the user has already completed their registration no action will be taken.

pub async fn list_service_accounts( &self, ) -> Result<ListServiceAccountsResponse, Error>

List all Service Accounts in your organization.

pub async fn create_service_account( &self, body: CreateServiceAccountRequest, ) -> Result<CreateServiceAccountResponse, Error>

Create a new Service Account for your organization.

pub async fn get_service_account( &self, service_account_id: String, ) -> Result<GetServiceAccountResponse, Error>

Get information about a specific Service Account.

pub async fn update_service_account( &self, service_account_id: String, body: UpdateServiceAccountRequest, ) -> Result<UpdateServiceAccountResponse, Error>

Update a specific Service Account.

pub async fn delete_service_account( &self, service_account_id: String, query: Option<DeleteServiceAccountQuery>, ) -> Result<DeleteServiceAccountResponse, Error>

Delete a specific Service Account.

pub async fn activate_service_account( &self, service_account_id: String, ) -> Result<ActivateServiceAccountResponse, Error>

Activate a specific Service Account.

pub async fn deactivate_service_account( &self, service_account_id: String, body: DeactivateServiceAccountRequest, ) -> Result<DeactivateServiceAccountResponse, Error>

Deactivate a specific Service Account.

pub async fn activate_user( &self, user_id: String, ) -> Result<ActivateUserResponse, Error>

Activate a specific User.

pub async fn deactivate_user( &self, user_id: String, ) -> Result<DeactivateUserResponse, Error>

Deactivate a specific User.

pub async fn get_user(&self, user_id: String) -> Result<GetUserResponse, Error>

Retrieve information about a specific User.

pub async fn update_user( &self, user_id: String, body: UpdateUserRequest, ) -> Result<UpdateUserResponse, Error>

Update a specific User.

pub async fn delete_user( &self, user_id: String, ) -> Result<DeleteUserResponse, Error>

Delete a specific User.

pub async fn list_users( &self, query: Option<ListUsersQuery>, ) -> Result<ListUsersResponse, Error>

List all Users in your organization.

pub async fn create_user( &self, body: CreateUserRequest, ) -> Result<CreateUserResponse, Error>

Invite a new user in the caller’s org. This will create the user and send a registration email to the created User’s email, with a registration code, and pointing him to complete his registration on Dfns Dashboard. The user is created without any permissions.

If you want the created User to not know about about Dfns, and don’t want him to receive the registration email from Dfns, you should rather use the Delegated Registration

pub async fn invite_tenant_user( &self, body: InviteTenantUserRequest, ) -> Result<InviteTenantUserResponse, Error>

Invite an existing Tenant User in the caller’s org. The invited Tenant User starts without any permissions within the org.

Trait Implementations

impl Clone for AuthClient

fn clone(&self) -> AuthClient

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.