How to configure Account Lockout Policy

This guide walks you through configuring the Account Lockout Policy to protect your account from unauthorized access.

View as Markdown
Preview

The Account Lockout Policy allows you to define the maximum number of failed attempts a user can complete before blocking the access, for a predefined period. During this period, the user can’t attempt to log in again, preventing unauthorized access.

This guide walks you through configuring the Account Lockout Policy.

Go to Account Lockout Policy reference

When an organization sets up the Account Lockout Policy, it applies to all account levels.

It’s available by default to customers with Enterprise and Mission-Critical Support.

Configuring an account lockout policy

To configure the Account Lockout Policy, you must have Account Owner privileges.

If you aren’t an Account Owner or if the account doesn’t have the policy activated, the system returns an Error 403.

  1. Run the following GET request in your terminal to obtain the current status of the Account Lockout Policy in your account.
    • By default, it’s inactive.
curl --request GET \
--url https://api.azion.com/v4/auth/policies/lockout \
--header 'Accept: application/json' \
--header 'Authorization: 123'
  1. You’ll receive a response similar to this:
{
"data": {
"active": false,
"max_attempts": 1,
"blocking_period": 0
}
}
  1. Run the following PUT request in your terminal to update the status of the Account Lockout Policy in your account.
curl --request PUT \
--url https://api.azion.com/v4/auth/policies/lockout \
--header 'Accept: application/json' \
--header 'Authorization: 123' \
--header 'Content-Type: application/json' \
--data {
"active": true,
"max_attempts": 1,
"blocking_period": 0
}

Where:

KeyTypeDescription
activeBooleanDefines the status of the policy. Accepted values: true and false. Default value: false
max_attemptsIntegerDefines the maximum number of failed attempts before lockout. Default value: 3
blocking_periodIntegerDefines the time a user account remains locked after reaching the maximum number of failed login attempts. During this period, the user can’t attempt to log in again, preventing unauthorized access. Default value: 1440, equivalent to 24 hours in minutes
  1. You’ll receive a response similar to this:
{
"state": "executed",
"data": {
"active": true,
"max_attempts": 1,
"blocking_period": 0
}
}

To confirm the status of your Account Lockout Policy, run a GET request as explained in Step 1.

Done. Account Lockout Policy is now active in your account. Now, users will be blocked if exceeding the maximum allowed number of failed login attempt, for the defined period.

Check the Azion API documentation to know more about all features available via API.