> ## Documentation Index > Fetch the complete documentation index at: https://docs.m1amdocs.com/llms.txt > Use this file to discover all available pages before exploring further. # Onboard and Authenticate Process Step Interfaces The following step interfaces may be used throughout the user journey depending on your feature flags, app settings and user inputs. ## Onboard and Authenticate Process Step Interfaces The step interfaces listed below can be used in the **Onboard and Authenticate** Process. Step - StartStep | Name | Data Type | Validation rule | Optional | Source | Description | | - | - | - | - | - | - | | `productId` | String |   | yes | UI input | This parameter can be passed in as the initial argument to the the process start. | | `purchase-prompt` | Boolean |   | yes | UI input | Default is true. | | `create-password-prompt` | Boolean |   | yes | UI input | Default is true. | | `ui-flow-type` | String |   | yes | UI input | Login/onboard flows combined. The default flow is combined. | | `client-id` | String |   | yes | UI input | OIDC client id that is used to extract RP specific app settings in the `clientConfiguration` json file. | UI Output | Name | Data Type | Description | | - | - | - | | NA | NA | NA | Step - IdentifierPrompt | Name | Data Type | Validation rule | Optional | Source | Description | | - | - | - | - | - | - | | `identifier` | String | NotEmpty ValidAuthnIdentifier(supportedIdentifiers = \{"mobiles", "emails"\}) | No | UI input | Storefront Gateway uses `process.validPhonePattern` and `process.validEmailPattern` app setting to determine if the email/mobile are valid entries. ValidAuthnIdentifier uses `system.security.emailDomainBlacklist` app setting to determine if the email domain is blacklisted. This check is only used if the identifier is an email. | | Name | Data Type | Optional | Description | | | | ---- | --------- | -------- | ----------- | | | | `productDetailsDTO` | ProductDetailsDTO | yes | UI output for product details. | | | Step - PasswordPrompt | Name | Data Type | Validation rule | Optional | Source | Description | | - | - | - | - | - | - | | `password` | String | NotEmpty | No | UI input | Backend request for either an OTP or password. | | Name | Data Type | Description | | - | - | - | |   |   |   | Step - TwoFAMethodPrompt | Name | Data Type | Validation rule | Optional | Source | Description | | - | - | - | - | - | - | | `twoFAMethodOptionId` | String | NotEmpty | no | user input | ID of the selected 2FA method option list. This setting is an email or SMS authentication identifier. | | Name | Data Type | Description | | - | - | - | | `twoFAMethods` | Map\ | This is a map of the 2FA available methods. The map contains the user's verified email, SMS authentication identifiers or TOTP with their corresponding values, which is mapped or keyed to an ID the user can choose to select. | | Name | Data Type | Output type | Optional | Description | | - | - | - | - | - | | `message` | NotificationMessage | ServiceOutput | yes | Required for email and SMS. | | `shortToken` | String | ServiceOutput | yes | Required for email and SMS. | | `pkat` | String | ServiceOutput | yes | Required for email and SMS. | | `totpSecret` | String | ServiceOutput | yes | Required for TOTP. | Step - TwoFASetupMethodPrompt | Name | Data Type | Validation rule | Optional | Source | Description | | - | - | - | - | - | - | | `twoFASetupMethodOptionId` | String | NotEmpty | no | user input | ID of the select MFA registration method option list: verified athentication identifiers (not marked as 2FA) or TOTP. | | Name | Data Type | Description | | - | - | - | | `MFASetupMethods` | Map\ | Map of valid obfuscated methods for 2FA, paired with an id the user can use to select. | | Name | Data Type | Output type | Optional | Description | | - | - | - | - | - | | `messages` | List\ | ServiceOutput | yes | Messages for debugging. | | `shortToken` | String | ServiceOutput | yes | If 2FA AuthnIdentifier registration selected - OTP value. | | `pkat` | String | ServiceOutput | yes | If 2FA AuthnIdentifier registration selected - pkat for action token. | | `selectedTwoFAMethod` | Pair\ | ServiceOutput | yes | If 2FA AuthnIdentifier registration selected - a pair of selected AuthnIdentifier and it's type. | | `totpSecret` | String | ServiceOutput | yea | If App MFA registration selected - generated secret code for TOTP. | Step - TwoFACodePrompt | Name | Data Type | Validation rule | Optional | Source | Description | | - | - | - | - | - | - | | `code` | String | NotEmpty | no | user input |   | | `pkat` | String | NotEmpty | no | user input |   | | `trustedDevice` | Boolean |   | yes |   | user input | | Name | Data Type | Output type | Optional | Description | | - | - | - | - | - | | `message` | NotificationMessage | ServiceOutput | yes | 2FA message. Optionally returned when the debugging process User data is enabled (requires `X-Process-Debug` request header and Spring profile `with-process-debug-header`). | | `shortToken` | String | ServiceOutput | yes | This object is the actual Short Token. Optionally returned when debugging process User data is enabled (requires `X-Process-Debug` request header and Spring profile `with-process-debug-header`). | | `pkat` | String | ServiceOutput | no | | | `attemptsRemaining` | Integer | UserData | no | The number of times the user may attempt to enter the code at this prompt. This setting is decremented by 1 on each invalid attempt. | | Name | Data Type | Output type | Optional | Description | | ---- | --------- | ----------- | -------- | ----------- | | `trustedDevice` | Boolean | ServiceOutput | yes |   | | `messages` | List\ | ServiceOutput | yes | Messages for debugging. | Step - Totp VerificationPrompt | Name | Data Type | Validation rule | Optional | Source | | - | - | - | - | - | | `code` | String | NotEmpty | no | user input | | `trustedDevice` | Boolean |   | yes | user input | | Name | Data Type | Output type | Optional | Description | | - | - | - | - | - | | `attemptsRemaining` | Integer | UserData | no | The number of times the user may attempt to enter the code at this prompt. The valude is decremented by 1 on each invalid attempt. | | `qrUrl` | String | UserData | no | QR URL that produces a QR code to be scanned by Authenticator app. Example: [otpauth://totp/RandomUserEmail0.2982349114456946%40operator.com?secret=IjbSzotYts](otpauth://totp/RandomUserEmail0.2982349114456946%40operator.com?secret=IjbSzotYts) | | Name | Data Type | Output type | Optional | | | ---- | --------- | ----------- | -------- | | | `trustedDevice` | Boolean | ServiceOutput | yes | | Step - UpdatePassword | Name | Data Type | Validation rule | Optional | Source | Description | | - | - | - | - | - | - | | `newPassword` | String | NotEmpty | No | UI input | Backend request to update expired password. | | Name | Data Type | Description | | - | - | - | |   |   |   | Step - AccountIdentifierPrompt | Name | Data Type | Validation rule | Optional | Source | | - | - | - | - | - | | `accountIdentifier` | String | NotEmpty | No | UI input | | Name | Data Type | Description | | - | - | - | |   |   |   | Step - EndStep | Name | Data Type | Validation rule | Optional | Source | | - | - | - | - | - | |   |   |   |   |   | | Name | Data Type | Optional | Description | | - | - | - | - | | `pkat` | String | Yes | Needed for UI OTP redemption. Only required if notification was sent. | | `shortToken` | String | Yes | Used for debug information only. | | `tokenSeries` | String | Yes | Used for debug information only. | | `purchasePromptFlag` | Boolean | No | If a purchase prompt is needed, enable or set to true. | | `productDetailsDTO` | ProductDetailsDTO | yes | If productId is provided. | | `userId` | Long | yes | If the user exists. | ## Onboard, Authenticate, and Activate Process Step Interfaces The following step interfaces are used in the **Onboard, Authenticate, and Activate** Process ( also known as the **Finish Login and Enroll** Process) Step 0 - StartStep | Name | Data Type | Validation rule | Optional | Source | Description | | - | - | - | - | - | - | | `userId` | Long |   | yes | actionToken context | If not provided then Storefront Gateway needs to create user. | | `actionData` | BaseActionData | NotNull | no | actionToken context | Content persisted in action token. | | Name | Data Type | Output type | Optional | Description | | - | - | - | - | - | | `productDetailsDTO` | ProductDetailsDTO | ServiceOutput | yes | Information about product retrieved from actionData. | | `plmCode` | String | ServiceOutput | yes | PLM code extracted from productDetailsDTO. | Step 1 - PasswordPrompt | Name | Data Type | Validation rule | Optional | Source | Description | | - | - | - | - | - | - | | `password` | String | NotWeakPassword | Yes | UI input | Null or empty password indicates that user skips this step. The app settings used to validate the user password are `**process.passwordDictionary**` and `process.passwordComplexityRules` | | `firstName` | String | | Yes | UI input | The user's first name. | | `lastName` | String | | Yes | UI input | The user's last name. | | `displayName` | String | | Yes | UI input | The user's name that is shown on the UI. | | `lang` | String | | Yes | UI input | The default language shown on the UI. | | Name | Data Type | Output type | Optional | Description | | | ---- | --------- | ----------- | -------- | ----------- | | | `userId` | long | ServiceOutput | no | User ID. | | | `twoFAEligibleAuthnIdentifiers` | Map\> | ServiceOutput | no | Map of available Authentication Identifiers. The key is an index and the value is a pair of Authentication Identifier and its type. | | | `nextStepId` | String | ConditionalOutput | no | Defines the next step in the process. | | | `newUser` | boolean | ServiceOutput | no | Indicates is the user already exists. | | Step 2 - TwoFAMethodPrompt | Name | Data Type | Validation rule | Optional | Source | Description | | - | - | - | - | - | - | | `twoFAMethodOptionId` | String | NotEmpty | No | User input | ID of the select MFA method option list. Authenticator identifier or TOTP. Storefront Gateway parses this value to determine which method is to be used. | | Name | Data Type | Optional | Description | | - | - | - | - | | `twoFAMethods` | Map\ | no | Map of valid obfuscated available MFA methods, keyed with an index. | | Name | Data Type | Output type | Optional | Description | | - | - | - | - | - | | `messages` | NotificationMessage | ServiceOutput | yes | Message for debugging. | | `shortToken` | String | ServiceOutput | yes | If 2FA AuthnIdentifier selected - OTP value. | | `pkat` | String | ServiceOutput | yes | If 2FA AuthnIdentifier selected - pkat for action token. | | `twoFAMethod` | String | ServiceOutput | yes | If the 2FA AuthnIdentifier selected - selected AuthnIdentifier. | | `totpSecret` | String | ServiceOutput | yea | If App MFA selected - generated secret code for TOTP. | | `nextStepId` | String | ConditionalOutput | no | Defines the next step in the process. | Step 3 - TwoFACodePrompt | Name | Data Type | Validation rule | Optional | Source | Description | | - | - | - | - | - | - | | `code` | String | NotEmpty | No | User input | The 2FA code. | | `pkat` | String | NotEmpty | No | User input | This is the auto-generated pkat for action token. | | Name | Data Type | Optional | Description | | - | - | - | - | | `shortToken` | String | no | Generated OTP. | | `pkat` | String | no | Generated pkat for action token. | | `attemptNumber` | Integer | no | Count of invalid input attempts by the user. | | `message` | NotificationMessage | no | Message for debugging. | | Name | Data Type | Output type | Optional | Description | | - | - | - | - | - | | `nextStepId` | String | ServiceOutput | yes | Defines the next step in the process. | Step 4 - TotpVerificationPrompt | Name | Data Type | Validation rule | Optional | Source | Description | | - | - | - | - | - | - | | `code` | String | NotNull | no | User input | TOTP code given by Authenticator app. | | Name | Data Type | Optional | Description | | - | - | - | - | | `attemptNumber` | Integer | no | Count of invalid input attempts by user. | | Name | Data Type | Output type | Optional | Description | | - | - | - | - | - | | `nextStepId` | String | ServiceOutput | yes | Defines the next step in the process. | Step 5 - AccountIdentifierPrompt | Name | Data Type | Validation rule | Optional | Source | | - | - | - | - | - | | `accountIdentifier` | String | NotEmpty | No | UI input. | | Name | Data Type | Optional | Description | | - | - | - | - | | `shortToken` | String | no | Generated OTP. | | `pkat` | String | no | Generated pkat for action token. | | `tokenSeries` | String | no | Token series. | | `messages` | NotificationMessage | no | Notification message. | Step 6 - EndStep | Name | Data Type | Validation rule | Optional | Source | Description | | - | - | - | - | - | - | |   |   |   |   |   |   | | Name | Data Type | Optional | | - | - | - | | `productDetailsDTO` | ProductDetailsDTO | yes | | `purchasePromptFlag` | Boolean | no | | `tokenSeries` | String |   | | `shortToken` | String |   | | `message` | NotificationMessage |   | | `pkat` | String |   | | `userId` | Long |   | **Parent topic:**[Onboard and Authenticate Process](onboardAuthenticateUserV2) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.