GET /admin/v1/TrustedDevices/{userId} Returns an Empty Collection

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

When invoking the admin REST API to retrieve a user's trusted devices using the endpoint below, the response returns an empty collection ([]) even though the user is expected to have registered trusted devices:

GET https://${SSP_FQDN}/{tenantName}/admin/v1/TrustedDevices/{userId}

This article explains the prerequisite conditions that must be met before trusted device records are created and returned by this API, and provides step-by-step guidance for resolving the empty collection response.

Environment

Symantec Identity Security Platform (IDSP) 4.0

Cause

The GET /admin/v1/TrustedDevices/{userId} endpoint will return an empty collection if any of the following conditions are not satisfied:

#	Condition	Impact
1	isTrustedDeviceEnabled is false in Tenant Config	No trusted devices can be registered for any user
2	The Authentication Policy does not have mfaFrequency: OnceForTrustedDevice	The "Remember This Device" checkbox is never shown to the user
3	The user has not completed MFA and selected "Remember This Device"	No trusted device record is written to the system
4	The device-tag browser cookie has been cleared	The device is de-registered and removed from trusted status
5	The trusted device record has expired (trustedDeviceExpiryDays elapsed)	Expired devices are purged and no longer returned
6	An incorrect or invalid userId is supplied in the path	The lookup finds no user match, returning an empty set
7	The VIP IA Risk SDK was not invoked correctly to capture the device fingerprint	The device fingerprint is absent from the authentication call, so no trusted device entry is created

Resolution

Verify the steps below to make sure Trusted Device feature works in the environment.

1. Enabling the feature flag in Tenant Config (isTrustedDeviceEnabled: true)
2. Setting the Authentication Policy to mfaFrequency: OnceForTrustedDevice
3. Confirming the user completed the full device registration flow (including the "Remember This Device" checkbox and the correct SDK calls)
4. Checking that browser device-tag cookies have not been cleared
5. Validating the userId value

Additional Information

• Configuring Trusted Devices — Identity Security Platform 4.0