---
updatedAt: 2026-06-05T04:33:13.000Z
---
# Deprecated - Get the password policy for a specified tenant.
Deprecated: This API is deprecated and might be removed after July 2027. Use the Version 3.0 API: GET /v3.0/PasswordPolicies/{id}
Entitlement required: readPwdPolicy (Read password policy) or managePwdPolicy (Manage password policy).
Note: You only need one entitlement, but you can have more than one.
# OpenAPI definition
```json
{
"openapi": "3.0.1",
"info": {
"version": "1.0.0",
"description": "Users & Groups",
"title": "Users & Groups"
},
"servers": [
{
"url": "https://{tenanturl}",
"variables": {
"tenanturl": {
"default": "{tenant_url}",
"description": "URL of your IBM Security Verify tenant"
}
}
}
],
"tags": [
{
"name": "Password Policy Management 2.0",
"description": ""
}
],
"paths": {
"/v2.0/PasswordPolicies": {
"get": {
"tags": [
"Password Policy Management 2.0"
],
"summary": "Deprecated - Get the password policy for a specified tenant.",
"description": "Deprecated: This API is deprecated and might be removed after July 2027. Use the Version 3.0 API: GET /v3.0/PasswordPolicies/{id}
Entitlement required: readPwdPolicy (Read password policy) or managePwdPolicy (Manage password policy). \n
Note: You only need one entitlement, but you can have more than one.",
"operationId": "getPasswordPolicy",
"responses": {
"200": {
"description": "The operation was successful.",
"content": {
"application/scim+json": {
"schema": {
"$ref": "#/components/schemas/PasswordPolicyResponse"
}
}
}
},
"400": {
"description": "The request was incorrect.",
"content": {
"application/scim+json": {
"schema": {
"$ref": "#/components/schemas/ExternalErrorMessage_1"
}
}
}
},
"500": {
"description": "An internal server error occurred.",
"content": {
"application/scim+json": {
"schema": {
"$ref": "#/components/schemas/ExternalErrorMessage_1"
}
}
}
}
},
"deprecated": true,
"x-category": "Users & Groups",
"x-publicAPI": "true"
}
}
},
"components": {
"schemas": {
"PasswordPolicyResponse": {
"required": [
"schemas"
],
"type": "object",
"properties": {
"schemas": {
"type": "array",
"description": "An array of strings that contain the URIs that indicate the namespaces of the SCIM schemas that define the attributes in the current JSON structure. The schema \"urn:ietf:params:scim:schemas:ibm:core:2.0:policy:Password\"is returned.",
"items": {
"type": "string"
}
},
"passwordMinAlphaChars": {
"type": "integer",
"description": "Specifies the minimum number of alphabetic characters that the password string must have. If the server is unable to check the number of alphabetic characters, then the server continues processing depending on the value of the pwdCheckSyntax attribute.",
"format": "int32"
},
"passwordMinOtherChars": {
"type": "integer",
"description": "Specifies the minimum number of numeric and special characters that the password string must have. If the server is unable to check the number of other characters, then the server continues processing depending on the value of the pwdCheckSyntax attribute.",
"format": "int32"
},
"pwdMinAge": {
"type": "integer",
"description": "Specifies the number of days before a password can be modified again.",
"format": "int32"
},
"pwdExpireWarning": {
"type": "integer",
"description": "Specifies the maximum number of days before a password expires that an expiration warning message is returned to an authenticating user.",
"format": "int32"
},
"pwdInHistory": {
"type": "integer",
"description": "Specifies the number of passwords that are stored in the pwdHistory attribute.",
"format": "int32"
},
"pwdLockout": {
"type": "boolean",
"description": "Indicates whether a password can be used to authenticate after a specified number of consecutive failed bind attempts. If the attribute is not provided, the behavior defaults to false."
},
"pwdLockoutDuration": {
"type": "integer",
"description": "Specifies the number of minutes that the password cannot be used to authenticate due to the specified 'pwdMaxFailure' failed bind attempts.",
"format": "int32"
},
"pwdMaxAge": {
"type": "integer",
"description": "Specifies the number of days after which a password expires. (A value of 0 means that the password does not expire.)",
"format": "int32"
},
"pwdMaxFailure": {
"type": "integer",
"description": "Specifies the maximum number of consecutive failed bind attempts after which the password will not be used for authentication. If a value of 0 is set for the pwdMaxFailure attribute, the value of pwdLockout is ignored.",
"format": "int32"
},
"pwdMinLength": {
"type": "integer",
"description": "Specifies the minimum length for the password string. The server checks the minimum length depending upon the value of the pwdCheckSyntax attribute.",
"format": "int32"
},
"pwdGraceLoginLimit": {
"type": "integer",
"description": "Specifies the number of times an expired password can be used to authenticate user. This value is read-only and is ignored on the PUT operation.",
"format": "int32",
"readOnly": true
},
"pwdMustChange": {
"type": "boolean",
"description": "Specifies whether the users must change their passwords when they first bind to the directory after the administrator has reset their passwords. This value is read-only and is ignored on the PUT operation.",
"readOnly": true
},
"pwdAllowUserChange": {
"type": "boolean",
"description": "Specifies whether the users are allowed to change their own passwords. This value is read-only and is ignored on the PUT operation.",
"readOnly": true
},
"pwdFailureCountInterval": {
"type": "integer",
"description": "Specifies the number of seconds after which the password failures are removed from the failure counter even if no successful authentication has occurred. This value is read-only and is ignored on the PUT operation.",
"format": "int32",
"readOnly": true
},
"passwordMaxRepeatedChars": {
"type": "integer",
"description": "Specifies the maximum number of times a character can be used in a password. If the server is unable to check the actual password characters, then the server continues processing depending on the value of the pwdCheckSyntax attribute. This value is read-only and is ignored on the PUT operation.",
"format": "int32",
"readOnly": true
},
"pwdSafeModify": {
"type": "boolean",
"description": "Specifies whether the existing password must be sent when changing a password. This value is read-only and is ignored on the PUT operation.",
"readOnly": true
},
"passwordMaxConsecutiveRepeatedChars": {
"type": "integer",
"description": "Used to restrict the maximum successive repetitions of a character in the password. This value is read-only and is ignored on the PUT operation.",
"format": "int32",
"readOnly": true
},
"passwordMinDiffChars": {
"type": "integer",
"description": "Specifies the minimum number of characters in the new password that must be different from the characters in the old password, and any passwords stored in the pwdHistory. If the password was one-way encrypted, the server cannot check actual password characters. The server continues processing depending on the value of the pwdCheckSyntax attribute. This value is read-only and is ignored on the PUT operation.",
"format": "int32",
"readOnly": true
},
"pwdCheckSyntax": {
"type": "integer",
"description": "Indicates whether the password is checked for syntax. The values of the pwdCheckSynatx attribute are: '0' means that syntax checking is not enforced. '1' means that the server checks the syntax. If the server cannot check the syntax (for example, because of a hashed password), the password is accepted. '2' means that the server checks the syntax. If the server cannot check the syntax (for example, because of a hashed password), it returns an error and the password is rejected. This value is read-only and is ignored on the PUT operation.",
"format": "int32",
"readOnly": true
},
"ibm_pwdPolicy": {
"type": "boolean",
"description": "Specifies whether to turn the password policy on or off. This value is read-only and is ignored on the PUT operation.",
"readOnly": true
}
}
},
"ExternalErrorMessage_1": {
"required": [
"schemas",
"status"
],
"type": "object",
"properties": {
"schemas": {
"type": "array",
"description": "An array of strings that contain the URIs that indicate the namespaces of the SCIM schemas that define the attributes in the current JSON structure. The schema \"urn:ietf:params:scim:api:messages:2.0:Error\" is the URI as required by the SCIM specification.",
"items": {
"type": "string"
}
},
"status": {
"type": "string",
"description": "The HTTP status code expressed as a JSON string."
},
"detail": {
"type": "string",
"description": "A detailed human-readable message."
}
}
}
}
},
"x-original-swagger-version": "2.0",
"x-explorer-enabled": false
}
```