# How to configure Account Lockout Policy

import DocButton from '~/components/webkit/DocButton.vue';
import Tag from '~/components/webkit/Tag.vue';

<Tag severity="info">Preview</Tag>

The **Account Lockout Policy** allows you to define the maximum number of failed attempts a user can complete before blocking the access, for a predefined period. During this period, the user can't attempt to log in again, preventing unauthorized access.

This guide walks you through configuring the Account Lockout Policy.

<DocButton href="/en/documentation/products/accounts/account-lockout-policy/" label="Go to Account Lockout Policy reference" kind="secondary" target="_blank" size="medium" />

:::note
When an organization sets up the Account Lockout Policy, it applies to all account levels.

It's available by default to customers with **Enterprise** and **Mission-Critical** [Support](https://www.azion.com/en/professional-services/).
:::

---

## Configuring an account lockout policy

:::note
To configure the Account Lockout Policy, you must have *Account Owner* privileges.

If you aren't an *Account Owner* or if the account doesn't have the policy activated, the system returns an *Error 403*.
:::

1. Run the following `GET` request in your terminal to obtain the current status of the Account Lockout Policy in your account. 
    - By default, it's *inactive*.

```bash
curl --request GET \
  --url https://api.azion.com/v4/auth/policies/lockout \
  --header 'Accept: application/json' \
  --header 'Authorization: 123'
```

2. You'll receive a response similar to this:

```bash
{
  "data": {
    "active": false,
    "max_attempts": 1,
    "blocking_period": 0
  }
}
```

3. Run the following `PUT` request in your terminal to update the status of the Account Lockout Policy in your account.

```bash
curl --request PUT \
  --url https://api.azion.com/v4/auth/policies/lockout \
  --header 'Accept: application/json' \
  --header 'Authorization: 123' \
  --header 'Content-Type: application/json' \
  --data '{
 	 "active": true,
  	"max_attempts": 1,
  	"blocking_period": 0
   }'
```

Where: 

| Key | Type | Description |
| ----------- | ----------- | ----------- |
| `active` | Boolean | Defines the status of the policy. Accepted values: `true` and `false`. Default value: `false`|
| `max_attempts` | Integer | Defines the maximum number of failed attempts before lockout. Default value: `3` |
| `blocking_period` | Integer | Defines the time a user account remains locked after reaching the maximum number of failed login attempts. During this period, the user can't attempt to log in again, preventing unauthorized access. Default value: `1440`, equivalent to *24 hours in minutes* |

4. You'll receive a response similar to this:

```bash
{
  "state": "executed",
  "data": {
    "active": true,
    "max_attempts": 1,
    "blocking_period": 0
  }
}
```

:::tip
To confirm the status of your Account Lockout Policy, run a GET request as explained in Step 1.
:::

Done. Account Lockout Policy is now active in your account. Now, users will be blocked if exceeding the maximum allowed number of failed login attempt, for the defined period.

:::tip
Check the [Azion API documentation](https://api.azion.com/) to know more about all features available via API.
:::