# Authentication Factors

Manage user authentication factors, including passwords and device-based factors (OTP and push).

 - [POST /passwords/{user_id}/create](https://api.weavr.io/products/multi/openapi/authentication-factors/passwordcreate.md): Create a new password for the user identified by the `user_id` path parameter.
 - [POST /passwords/update](https://api.weavr.io/products/multi/openapi/authentication-factors/passwordupdate.md): Update the password for the logged-in user.
 - [POST /passwords/validate](https://api.weavr.io/products/multi/openapi/authentication-factors/passwordvalidate.md): Check that a password adheres to all complexity checks.
 - [POST /passwords/lost_password/start](https://api.weavr.io/products/multi/openapi/authentication-factors/lostpasswordinitiate.md): Initiate the lost password process. If the email address provided is associated with an active user, an email will be sent, containing a URL that redirects the user to change their password. The URL c
 - [POST /passwords/lost_password/resume](https://api.weavr.io/products/multi/openapi/authentication-factors/lostpasswordresume.md): This is the second and final step in updating the password of a user who forgot their password.
 - [GET /authentication_factors](https://api.weavr.io/products/multi/openapi/authentication-factors/authfactorsget.md): Retrieves the list of authentication factors that can be used to verify the logged-in user.
 - [POST /authentication_factors/otp/{channel}](https://api.weavr.io/products/multi/openapi/authentication-factors/enroldeviceusingotpstepone.md): This is the first step in enrolling the logged-in user's mobile device, where a one-time password is sent to the device. *Note that on the Sandbox Environment, text messages are not sent and the one-t
 - [POST /authentication_factors/otp/{channel}/verify](https://api.weavr.io/products/multi/openapi/authentication-factors/enroldeviceusingotpsteptwo.md): The second step in enrolling the logged-in user (root or authorised user) to use one-time-passwords to enable verification of transactions. The challenge expires after 5 minutes and the number of inco
 - [POST /authentication_factors/push/{channel}](https://api.weavr.io/products/multi/openapi/authentication-factors/enroldeviceusingpush.md): This is the first step in enrolling the logged-in user's mobile device, where a push notification is sent to the device.
 - [DELETE /authentication_factors/push/{channel}](https://api.weavr.io/products/multi/openapi/authentication-factors/unlinkdeviceusingpush.md): Unlink a user device for authentication using push notifications