02 February 2022 (v2.66)

ReachFive v2.66 focuses primarily on improving our Audit logs and Multi-factor Authentication (MFA) modules as well as various Security and Integration improvements.

Authentication

Release highlight

Email MFA credential (second factor)

You can now use email as a second factor authentication for MFA flows. Users can choose to set their email identifier as an MFA credential and use it to complete the stepup flow.

For security reasons, only the email identifier can be set as a second factor. Other emails cannot be used as MFA credentials.

Management API new MFA endpoints:

initiate MFA activation flows for phone numbers and emails.
list and view MFA credentials

For more details on Multi-factor Authentication, check out our MFA Guide.

Security

Audit logs

We have improved our Audit log module to immediately detect any login in the ReachFive Console.

You now easily view your audit logs with the new retrieve audit logs Management endpoint.

Make sure to add the new scope read:audit-logs if you want to use this endpoint.

For more information, check out our Audit logs page.

reCaptcha V3

We have adjusted the configuration of reCaptcha V3 based on the bot activity we have observed on our platform.

Integration

Export jobs filters

We have added the since criteria for date fields used in filters configured in export jobs. You can now target users that haven’t been updated or haven’t logged in since a predefined ammount of time thanks to this criteria.

For more information, check out our export user profiles page.

User update

The update user endpoint now supports the redirect_url parameter which overrides any redirect_url set in the ReachFive Console.

Fixes

Item	Fixed
Two consecutive passwordless flows resulted in an expired code.	✓
The update a LITE profile endpoint didn’t merge the Lite profile if the updated identifier matched an existing identifier.	✓
It was possible to erase consent information when updating a lite profile using the update a LITE profile endpoint.	✓
We have improved our second factor Management to be sure that the correct number is added as the second factor.	✓
It was possible to grant an archived consent.	✓
In some limited cases, it was not possible to log in to the ReachFive Console.	✓

Item

Fixed

Two consecutive passwordless flows resulted in an expired code.

✓

The update a LITE profile endpoint didn’t merge the Lite profile if the updated identifier matched an existing identifier.

✓

It was possible to erase consent information when updating a lite profile using the update a LITE profile endpoint.

✓

We have improved our second factor Management to be sure that the correct number is added as the second factor.

✓

It was possible to grant an archived consent.

✓

In some limited cases, it was not possible to log in to the ReachFive Console.

✓