Onboard and Authenticate Process Step Interfaces

The following step interfaces may be used throughout the user journey depending on your feature flags, app settings and user inputs.

The step interfaces listed below can be used in the Onboard and Authenticate Process. Step - StartStep

Name	Data Type	Optional	Source	Description
`productId`	String	yes	UI input	This parameter can be passed in as the initial argument to the the process start.
`purchase-prompt`	Boolean	yes	UI input	Default is true.
`create-password-prompt`	Boolean	yes	UI input	Default is true.
`ui-flow-type`	String	yes	UI input	Login/onboard flows combined. The default flow is combined.
`client-id`	String	yes	UI input	OIDC client id that is used to extract RP specific app settings in the `clientConfiguration` json file.

UI Output

Name	Data Type	Description
NA	NA	NA

Step - IdentifierPrompt

Name	Data Type	Validation rule	Optional	Source	Description
`identifier`	String	NotEmpty ValidAuthnIdentifier(supportedIdentifiers = {“mobiles”, “emails”})	No	UI input	Storefront Gateway uses `process.validPhonePattern` and `process.validEmailPattern` app setting to determine if the email/mobile are valid entries. ValidAuthnIdentifier uses `system.security.emailDomainBlacklist` app setting to determine if the email domain is blacklisted. This check is only used if the identifier is an email.
Name	Data Type	Optional	Description
----	---------	--------	-----------
`productDetailsDTO`	ProductDetailsDTO	yes	UI output for product details.

Step - PasswordPrompt

Name	Data Type	Validation rule	Optional	Source	Description
`password`	String	NotEmpty	No	UI input	Backend request for either an OTP or password.

Name	Data Type	Description

Step - TwoFAMethodPrompt

Name	Data Type	Validation rule	Optional	Source	Description
`twoFAMethodOptionId`	String	NotEmpty	no	user input	ID of the selected 2FA method option list. This setting is an email or SMS authentication identifier.

Name	Data Type	Description
`twoFAMethods`	Map<String,TwoFAMethodHolder>	This is a map of the 2FA available methods. The map contains the user’s verified email, SMS authentication identifiers or TOTP with their corresponding values, which is mapped or keyed to an ID the user can choose to select.

Name	Data Type	Output type	Optional	Description
`message`	NotificationMessage	ServiceOutput	yes	Required for email and SMS.
`shortToken`	String	ServiceOutput	yes	Required for email and SMS.
`pkat`	String	ServiceOutput	yes	Required for email and SMS.
`totpSecret`	String	ServiceOutput	yes	Required for TOTP.

Step - TwoFASetupMethodPrompt

Name	Data Type	Validation rule	Optional	Source	Description
`twoFASetupMethodOptionId`	String	NotEmpty	no	user input	ID of the select MFA registration method option list: verified athentication identifiers (not marked as 2FA) or TOTP.

Name	Data Type	Description
`MFASetupMethods`	Map<String, String>	Map of valid obfuscated methods for 2FA, paired with an id the user can use to select.

Name	Data Type	Output type	Optional	Description
`messages`	List<NotificationMessage>	ServiceOutput	yes	Messages for debugging.
`shortToken`	String	ServiceOutput	yes	If 2FA AuthnIdentifier registration selected - OTP value.
`pkat`	String	ServiceOutput	yes	If 2FA AuthnIdentifier registration selected - pkat for action token.
`selectedTwoFAMethod`	Pair<String, Type>	ServiceOutput	yes	If 2FA AuthnIdentifier registration selected - a pair of selected AuthnIdentifier and it’s type.
`totpSecret`	String	ServiceOutput	yea	If App MFA registration selected - generated secret code for TOTP.

Step - TwoFACodePrompt

Name	Data Type	Validation rule	Optional	Source	Description
`code`	String	NotEmpty	no	user input
`pkat`	String	NotEmpty	no	user input
`trustedDevice`	Boolean		yes		user input

Name	Data Type	Output type	Optional	Description
`message`	NotificationMessage	ServiceOutput	yes	2FA message. Optionally returned when the debugging process User data is enabled (requires `X-Process-Debug` request header and Spring profile `with-process-debug-header`).
`shortToken`	String	ServiceOutput	yes	This object is the actual Short Token. Optionally returned when debugging process User data is enabled (requires `X-Process-Debug` request header and Spring profile `with-process-debug-header`).
`pkat`	String	ServiceOutput	no
`attemptsRemaining`	Integer	UserData	no	The number of times the user may attempt to enter the code at this prompt. This setting is decremented by 1 on each invalid attempt.
Name	Data Type	Output type	Optional	Description
----	---------	-----------	--------	-----------
`trustedDevice`	Boolean	ServiceOutput	yes
`messages`	List<NotificationMessage>	ServiceOutput	yes	Messages for debugging.

Step - Totp VerificationPrompt

Name	Data Type	Validation rule	Optional	Source
`code`	String	NotEmpty	no	user input
`trustedDevice`	Boolean		yes	user input

Name	Data Type	Output type	Optional	Description
`attemptsRemaining`	Integer	UserData	no	The number of times the user may attempt to enter the code at this prompt. The valude is decremented by 1 on each invalid attempt.
`qrUrl`	String	UserData	no	QR URL that produces a QR code to be scanned by Authenticator app. Example: otpauth://totp/RandomUserEmail0.2982349114456946%40operator.com?secret=IjbSzotYts
Name	Data Type	Output type	Optional
----	---------	-----------	--------
`trustedDevice`	Boolean	ServiceOutput	yes

Step - UpdatePassword

Name	Data Type	Validation rule	Optional	Source	Description
`newPassword`	String	NotEmpty	No	UI input	Backend request to update expired password.

Name	Data Type	Description

Step - AccountIdentifierPrompt

Name	Data Type	Validation rule	Optional	Source
`accountIdentifier`	String	NotEmpty	No	UI input

Name	Data Type	Description

Step - EndStep

Name	Data Type	Validation rule	Optional	Source

Name	Data Type	Optional	Description
`pkat`	String	Yes	Needed for UI OTP redemption. Only required if notification was sent.
`shortToken`	String	Yes	Used for debug information only.
`tokenSeries`	String	Yes	Used for debug information only.
`purchasePromptFlag`	Boolean	No	If a purchase prompt is needed, enable or set to true.
`productDetailsDTO`	ProductDetailsDTO	yes	If productId is provided.
`userId`	Long	yes	If the user exists.

Onboard, Authenticate, and Activate Process Step Interfaces

The following step interfaces are used in the Onboard, Authenticate, and Activate Process ( also known as the Finish Login and Enroll Process) Step 0 - StartStep

Name	Data Type	Validation rule	Optional	Source	Description
`userId`	Long		yes	actionToken context	If not provided then Storefront Gateway needs to create user.
`actionData`	BaseActionData	NotNull	no	actionToken context	Content persisted in action token.

Name	Data Type	Output type	Optional	Description
`productDetailsDTO`	ProductDetailsDTO	ServiceOutput	yes	Information about product retrieved from actionData.
`plmCode`	String	ServiceOutput	yes	PLM code extracted from productDetailsDTO.

Step 1 - PasswordPrompt

Name	Data Type	Validation rule	Optional	Source	Description
`password`	String	NotWeakPassword	Yes	UI input	Null or empty password indicates that user skips this step. The app settings used to validate the user password are `process.passwordDictionary` and `process.passwordComplexityRules`
`firstName`	String		Yes	UI input	The user’s first name.
`lastName`	String		Yes	UI input	The user’s last name.
`displayName`	String		Yes	UI input	The user’s name that is shown on the UI.
`lang`	String		Yes	UI input	The default language shown on the UI.
Name	Data Type	Output type	Optional	Description
----	---------	-----------	--------	-----------
`userId`	long	ServiceOutput	no	User ID.
`twoFAEligibleAuthnIdentifiers`	Map<String, Pair<String, Type>>	ServiceOutput	no	Map of available Authentication Identifiers. The key is an index and the value is a pair of Authentication Identifier and its type.
`nextStepId`	String	ConditionalOutput	no	Defines the next step in the process.
`newUser`	boolean	ServiceOutput	no	Indicates is the user already exists.

Step 2 - TwoFAMethodPrompt

Name	Data Type	Validation rule	Optional	Source	Description
`twoFAMethodOptionId`	String	NotEmpty	No	User input	ID of the select MFA method option list. Authenticator identifier or TOTP. Storefront Gateway parses this value to determine which method is to be used.

Name	Data Type	Optional	Description
`twoFAMethods`	Map<String, TwoFAMethodHolder>	no	Map of valid obfuscated available MFA methods, keyed with an index.

Name	Data Type	Output type	Optional	Description
`messages`	NotificationMessage	ServiceOutput	yes	Message for debugging.
`shortToken`	String	ServiceOutput	yes	If 2FA AuthnIdentifier selected - OTP value.
`pkat`	String	ServiceOutput	yes	If 2FA AuthnIdentifier selected - pkat for action token.
`twoFAMethod`	String	ServiceOutput	yes	If the 2FA AuthnIdentifier selected - selected AuthnIdentifier.
`totpSecret`	String	ServiceOutput	yea	If App MFA selected - generated secret code for TOTP.
`nextStepId`	String	ConditionalOutput	no	Defines the next step in the process.

Step 3 - TwoFACodePrompt

Name	Data Type	Validation rule	Optional	Source	Description
`code`	String	NotEmpty	No	User input	The 2FA code.
`pkat`	String	NotEmpty	No	User input	This is the auto-generated pkat for action token.

Name	Data Type	Optional	Description
`shortToken`	String	no	Generated OTP.
`pkat`	String	no	Generated pkat for action token.
`attemptNumber`	Integer	no	Count of invalid input attempts by the user.
`message`	NotificationMessage	no	Message for debugging.

Name	Data Type	Output type	Optional	Description
`nextStepId`	String	ServiceOutput	yes	Defines the next step in the process.

Step 4 - TotpVerificationPrompt

Name	Data Type	Validation rule	Optional	Source	Description
`code`	String	NotNull	no	User input	TOTP code given by Authenticator app.

Name	Data Type	Optional	Description
`attemptNumber`	Integer	no	Count of invalid input attempts by user.

Name	Data Type	Output type	Optional	Description
`nextStepId`	String	ServiceOutput	yes	Defines the next step in the process.

Step 5 - AccountIdentifierPrompt

Name	Data Type	Validation rule	Optional	Source
`accountIdentifier`	String	NotEmpty	No	UI input.

Name	Data Type	Optional	Description
`shortToken`	String	no	Generated OTP.
`pkat`	String	no	Generated pkat for action token.
`tokenSeries`	String	no	Token series.
`messages`	NotificationMessage	no	Notification message.

Step 6 - EndStep

Name	Data Type	Validation rule	Optional	Source	Description

Name	Data Type	Optional
`productDetailsDTO`	ProductDetailsDTO	yes
`purchasePromptFlag`	Boolean	no
`tokenSeries`	String
`shortToken`	String
`message`	NotificationMessage
`pkat`	String
`userId`	Long

Parent topic:Onboard and Authenticate Process

Home

Introduction

For Merchants

For Resellers

Partner Ecosystem Management

Commerce Engine

Storefront Experience

APIs

Onboard and Authenticate Process Step Interfaces