# Visa Platforms Login

## Advanced Security

### Multi-Factor Authentication

#### Multi-Factor Authentication

Visa Platforms Login supports Time-based One-Time Password (TOTP) multi-factor authentication for enhanced security. MFA implementation follows a strict enrollment sequence that must be completed properly to avoid integration failures.

#### MFA Enrollment Process

1. **Prerequisites:** User must be authenticated and have NOT_ENROLLED MFA status  
2. **Setup:** Call `POST /user/mfa/totp/setup` to generate TOTP secret  
3. **Configuration:** User configures authenticator app with provided secret key  
4. **Enrollment:** Call `POST /user/mfa/totp/enroll` with TOTP verification  
5. **Validation:** User status changes to ENROLLED upon successful completion

#### MFA Management Operations

- **Self-Service Unenrollment:** `POST /user/mfa/totp/unenroll` with user authentication token  
- **Administrative Unenrollment:** `POST /user/mfa/totp/unenroll/dashboard` with admin credentials and user email  
- **Status Requirements:** TOTP setup requires NOT_ENROLLED status; enrollment requires prior setup completion  
- **Permission Differences:** Admin unenrollment has different permissions than self-service operations

### VBA Password Security

#### Password Security Integration

Visa Behavioral Analytics (VBA) integration provides real-time password security assessment to identify compromised or unsafe passwords during authentication and password change operations.

#### VBA Password Checking

The `POST /user/vba/compromised-password` endpoint checks passwords against the VBA compromised database and returns structured recommendations.

**VBA Response Types:**

- **Accept:** Password is safe to use without additional verification  
- **Challenge:** Password flagged for additional verification steps  
- **Reject:** Password is compromised and must be changed immediately

#### VBA Integration Implementation

VBA responses include detailed arrays of reasons for recommendations, enabling informed security decisions. Integration should handle each recommendation type appropriately:

- **Challenge Response:** Implement additional verification or require password change  
- **Reject Response:** Require immediate password change before allowing access  
- **Response Analysis:** Use detailed reason arrays to provide user feedback

### Device Trust and Session Management

#### Device Trust and Session Management

Device trust capabilities enable secure session management and trusted device scenarios that reduce authentication friction while maintaining security.

#### Device Token Implementation

- **Device Registration:** deviceToken parameter in login requests enables trusted device scenarios  
- **Trust Management:** trustDevice parameter controls device trust establishment  
- **Session Benefits:** Trusted devices may bypass certain authentication steps  
- **Security Considerations:** Device trust affects session extension capabilities

#### Session Extension Management

Sessions can be extended rather than requiring full re-authentication, improving user experience while maintaining security.

- **Extension Endpoint:** `POST /user/extend-login`  
- **Requirements:** Valid user token and extendable session state  
- **Failure Handling:** 401 error indicates session cannot be extended; fall back to full authentication  
- **Device Integration:** Device tokens support session extension decision logic

### OpenID Connect Integration

#### OpenID Connect Integration

OpenID Connect integration enables SSO capabilities and standardized identity claim exchange for enterprise identity management scenarios.

#### UserInfo Endpoint

The `GET /oidc/userinfo` endpoint fetches user information based on user tokens from SSO systems.

- **Required Scope:** openid OAuth2 scope for OpenID Connect integration  
- **Optional Parameter:** gmap_id integer parameter for specific user targeting  
- **Response Format:** Encrypted claims response with userDetailsId and encryptedClaims

#### Encrypted Claims Handling

OpenID Connect responses include encrypted claims to protect sensitive user information during identity exchange.

- **Claim Format:** Claims are returned as encrypted JSON strings  
- **Decryption:** Use appropriate decryption methods for claim processing  
- **Identity Mapping:** userDetailsId provides unique identifier correlation

### Security Model

#### Authentication Separation

Visa Platforms Login intentionally separates enrollment from consumer authentication with important implications:

- **issuer Responsibility:** Issuers authenticate API calls using OAuth2  
- **Visa Ownership:** Visa owns the consumer login and credential lifecycle  
- **No Delegation:** No consumer-level authentication artifacts are exchanged via the API  
- **Integration Pattern:** Visa Platforms Login is a secure enrollment and activation platform, not a delegated identity service

#### Data Protection Features

- **Password Obfuscation:** Password fields use arrays for security obfuscation  
- **PII Protection:** National ID values are hashed for secure storage  
- **PAN Security:** Payment card numbers are hashed for payment card security  
- **Sensitive Operations:** Operations return minimal data to reduce exposure  
- **Security Responses:** Some endpoints deliberately return 200 OK even for non-existent users

#### Scope-Based Security Model

Security is enforced through granular OAuth2 scope assignments that control access to different functional areas.

- **User Operations:** USER_RW scopes for standard user operations  
- **System Operations:** SYSTEM_USER_RW/R scopes for administrative functions  
- **Guest Registration:** USER_REGISTRATION_GUEST scopes for enrollment operations  
- **Specialized Functions:** Dedicated scopes for migration, session extension, and user removal