MFA Policy Validator

identity.mfa_policy_validate

ProductionBounded custom (Class B)Deterministicstrictfastv1.0.0

No network

Overview

You send methods as objects with a type from TOTP, WEBAUTHN, PUSH, SMS, EMAIL or RECOVERY_CODE. Optional recovery and stepUpMethods use the same shape. minFactors defaults to 1, requireEnrollment to true, baseline to NONE. Diagnostics report contradictions. The call does not authenticate a user or claim regulatory compliance.

A policy that lists only recovery codes looks complete while leaving no primary factor.

Reliability

Duplicate types are refused. MFA_POLICY_INVALID — trigger: a duplicate or unknown method type; retryable: no; next: send unique published types. IDENTITY_LIMIT_EXCEEDED — trigger: more than 16 methods; retryable: no; next: shorten the list.

Context footprint

Normalized types and diagnostics only. A successful call costs 1 execution credit.

When to use it

When a declared MFA method list must be checked for internal contradictions.

When a live authenticator must be challenged or a vendor must be ranked.

Scope

Note

Validates an MFA method list against enrollment, recovery, step-up and baseline rules.

Non-goals

Does not authenticate a user
Does not claim regulatory compliance
Does not rank vendors

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

validation

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call1 credit

File handling

Accepts file_refProduces file_refMax input2 MB

How we handle your data

Sensitive processing

What this means

This skill is designed to detect, mask, redact, validate, or otherwise process sensitive data.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
Targets sensitive data
The response does not contain submitted content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
methods	array	Yes	Bounded array of 1 through 17 closed method objects; runtime accepts at most 16 unique types.
minFactors	integer	No	Minimum factors the policy requires. Omit it for 1.
requireEnrollment	boolean	No	Whether enrollment is required. Omit it for true.
recovery	array	No	Bounded array of 0 through 17 closed recovery-method objects. Omit it for none.
stepUpMethods	array	No	Bounded array of 0 through 17 closed step-up method objects. Omit it for none.
baseline	string	No	NONE, STANDARD or HIGH_ASSURANCE. Omit it for NONE.

Output schema

Field	Type	Required	Description
valid	boolean	Yes	True when no diagnostic has severity ERROR.
methods	array	Yes	Bounded array of 0 through 16 unique published method types in declaration order.
recovery	array	Yes	Bounded array of 0 through 16 unique published method types in declaration order.
stepUpMethods	array	Yes	Bounded array of 0 through 16 unique published method types in declaration order.
minFactors	integer	Yes	Applied minimum factor count.
requireEnrollment	boolean	Yes	Whether enrollment is required.
baseline	string	Yes	Applied baseline NONE, STANDARD or HIGH_ASSURANCE.
rulesetVersion	string	Yes	Pinned MFA-policy ruleset identifier.
diagnostics	array	Yes	Bounded array of 0 through 500 closed findings, each with code, severity, message, path, source and details.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"identity.mfa_policy_validate","input":{"methods":[{"type":"TOTP"}]}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("identity.mfa_policy_validate", {"methods":[{"type":"TOTP"}]});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.
MFA_POLICY_INVALID	400	No	The request payload failed this skill's input validation.
IDENTITY_LIMIT_EXCEEDED	429	No	A size, quota, rate, or time limit was exceeded.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not authenticate a user
Does not claim regulatory compliance
Does not rank vendors
Issuing a challenge
Checking a live authenticator

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "identity.mfa_policy_validate",
  "input": {
    "methods": [
      {
        "type": "TOTP"
      }
    ]
  }
}

Examples

A TOTP-only policy under NONE is valid

Inputjson

{
  "methods": [
    {
      "type": "TOTP"
    }
  ]
}

Expected outputjson

{
  "baseline": "NONE",
  "methods": [
    "TOTP"
  ],
  "stepUpMethods": [],
  "diagnostics": [],
  "valid": true,
  "rulesetVersion": "identity.mfa_policy.v1",
  "requireEnrollment": true,
  "minFactors": 1,
  "recovery": []
}

Tip

valid is true and methods contains TOTP.

Recovery codes cannot be the only method