Security settings
Tenant-wide security controls in Pact — session timeouts, SSO enforcement, break-glass access, IP allowlists, and per-user biometric gating on mobile.
Security settings
This page is a map of the tenant-wide security controls Pact exposes and where each one is configured. Every setting below is backed by an enforced code path — none are cosmetic.
Session lifecycle
Idle and absolute session timeouts are stored under your tenant's org settings and enforced on every request by core/auth/session_expiry.py:
PATCH /v1/admin/settings
{ "session_idle_timeout_minutes": 30,
"session_absolute_timeout_hours": 12 }
session_idle_timeout_minutes accepts 0–525600; session_absolute_timeout_hours accepts 0–8760. A value of 0 disables that dimension. Per-role overrides are set via PUT /v1/iam/role-sessions/{role}. See Sessions for the full model.
SSO enforcement and break-glass
PATCH /v1/admin/sso/mode sets sso_required (block password login tenant-wide) and sso_domain_auto_join. When SSO is enforced, keep at least one break-glass account with a working password login, managed under /v1/admin/sso/break-glass. Full detail on the SSO page.
Network / IP allowlist
Tenant-scoped IP allowlist and denylist policies (tenant_ip_policies) are enforced by a middleware on every authenticated route. Configure them under /v1/admin/network/policies — see Network & IP allowlist.
Mobile biometric gate
The mobile shell can require a biometric unlock, gated in two stages. The tenant-wide mobile_biometric_gate feature flag is the outer gate: when it's off, GET /v1/me/security-prefs returns 403 and the mobile shell never offers the toggle. When it's on, each user opts in per-device:
PUT /v1/me/security-prefs
{ "biometric_gate_enabled": true,
"biometric_per_action_enabled": true }
biometric_gate_enabled adds a cold-start prompt; biometric_per_action_enabled additionally re-authenticates before sensitive actions. There is no admin override endpoint — admins set tenant-wide policy via the feature flag, and each user controls their own device preference (api/routes/security_prefs.py).
Where destructive-op approval lives
Two-person review on destructive operations (delete contact, mass-erase) is a separate org setting — approval_workflow_enabled under PATCH /v1/admin/settings — rather than part of this security page. Toggle it there when you need dual control.
Everything is audited
Every mutation on these surfaces writes to the append-only audit log: auth.sso.* for SSO, auth.ip_policy.* for network policy, auth.session.revoked for session revocation, and settings changes on save. Review them under Audit log.