From 3d19fa54458a52a98e2ba2111e8d197518f70aa7 Mon Sep 17 00:00:00 2001
From: Brady Wied <brady.wied@fusionauth.io>
Date: Thu, 20 Nov 2025 20:55:55 -0700
Subject: [PATCH 01/11] first lambda type

---
 .../domain/io/fusionauth/domain/LambdaType.cs                  | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/LambdaType.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/LambdaType.cs
index 2d90d354..d72cef5e 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/LambdaType.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/LambdaType.cs
@@ -52,6 +52,7 @@ public enum LambdaType {
         SCIMServerUserResponseConverter, 
         SelfServiceRegistrationValidation, 
         UserInfoPopulate, 
-        LoginValidation
+        LoginValidation, 
+        MFARequirement
   }
 }

From 7b6ae6b1b2716fd4deba8d8378fa69bb50382c4c Mon Sep 17 00:00:00 2001
From: Brady Wied <wied03@users.noreply.github.com>
Date: Tue, 25 Nov 2025 07:33:34 -0700
Subject: [PATCH 02/11] reduce client blast radius (#157)

---
 .../fusionauth/domain/MultiFactorContext.cs   | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/MultiFactorContext.cs

diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/MultiFactorContext.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/MultiFactorContext.cs
new file mode 100644
index 00000000..c3f05201
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/MultiFactorContext.cs
@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain
+{
+
+  /**
+   * Communicate various contexts in which multi-factor authentication can be used.
+   */
+  public enum MultiFactorContext {
+        changePassword, 
+        login, 
+        stepUp
+  }
+}

From e6e5ac80c39cde82336155da1162ae92b1ed3a63 Mon Sep 17 00:00:00 2001
From: Jaret Hendrickson <jaret.hendrickson+github@fusionauth.io>
Date: Tue, 2 Dec 2025 20:33:36 -0600
Subject: [PATCH 03/11] MFA lambda configuration (#158)

---
 .../domain/io/fusionauth/domain/LambdaConfiguration.cs          | 2 ++
 .../domain/io/fusionauth/domain/TenantLambdaConfiguration.cs    | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/LambdaConfiguration.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/LambdaConfiguration.cs
index 9ffae52a..7a17bd80 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/LambdaConfiguration.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/LambdaConfiguration.cs
@@ -27,6 +27,8 @@ public class LambdaConfiguration {
 
     public Guid? idTokenPopulateId;
 
+    public Guid? multiFactorRequirementId;
+
     public Guid? samlv2PopulateId;
 
     public Guid? selfServiceRegistrationValidationId;
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/TenantLambdaConfiguration.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/TenantLambdaConfiguration.cs
index 9c68037c..577343d4 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/TenantLambdaConfiguration.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/TenantLambdaConfiguration.cs
@@ -28,6 +28,8 @@ public class TenantLambdaConfiguration {
 
     public Guid? loginValidationId;
 
+    public Guid? multiFactorRequirementId;
+
     public Guid? scimEnterpriseUserRequestConverterId;
 
     public Guid? scimEnterpriseUserResponseConverterId;

From d46327e7c97fd8ed943846fbf4633c356873efb9 Mon Sep 17 00:00:00 2001
From: Spencer Witt <3409780+spwitt@users.noreply.github.com>
Date: Fri, 5 Dec 2025 12:14:34 -0600
Subject: [PATCH 04/11] ENG-3487: Tenant-scoped IdPs (#156)

* update domain for tenantId on IdPs (#153)
* add tenantId to IdP lookup by managed domain response (#155)
---
 .../domain/api/identityProvider/IdentityProviderDetails.cs      | 2 ++
 .../io/fusionauth/domain/provider/BaseIdentityProvider.cs       | 2 ++
 .../fusionauth/domain/search/IdentityProviderSearchCriteria.cs  | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/identityProvider/IdentityProviderDetails.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/identityProvider/IdentityProviderDetails.cs
index eb0d65dc..e4170bb8 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/identityProvider/IdentityProviderDetails.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/identityProvider/IdentityProviderDetails.cs
@@ -34,6 +34,8 @@ public class IdentityProviderDetails {
 
     public IdentityProviderOauth2Configuration oauth2;
 
+    public Guid? tenantId;
+
     public IdentityProviderType type;
 
     public IdentityProviderDetails with(Action<IdentityProviderDetails> action) {
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/provider/BaseIdentityProvider.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/provider/BaseIdentityProvider.cs
index 1383d64e..44b45eae 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/provider/BaseIdentityProvider.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/provider/BaseIdentityProvider.cs
@@ -46,6 +46,8 @@ public class BaseIdentityProvider<D>: Enableable, IdentityProvider {
 
     public IDictionary<Guid, IdentityProviderTenantConfiguration> tenantConfiguration;
 
+    public Guid? tenantId;
+
     public IdentityProviderType type;
   }
 }
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/search/IdentityProviderSearchCriteria.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/search/IdentityProviderSearchCriteria.cs
index 2e22cf6c..fe201e03 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/search/IdentityProviderSearchCriteria.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/search/IdentityProviderSearchCriteria.cs
@@ -33,6 +33,8 @@ public class IdentityProviderSearchCriteria: BaseSearchCriteria {
 
     public string name;
 
+    public Guid? tenantId;
+
     public IdentityProviderType type;
 
     public IdentityProviderSearchCriteria with(Action<IdentityProviderSearchCriteria> action) {

From 65105791b3f8cd31787b6e5d12669f84a209bd08 Mon Sep 17 00:00:00 2001
From: Brady Wied <wied03@users.noreply.github.com>
Date: Mon, 8 Dec 2025 16:50:05 -0700
Subject: [PATCH 05/11] Merge wied03/ENG-3602/mfa-lambda-invocation (#159)

* propagate client changes

* propagate client changes 2

* client code update from Javadoc
---
 ...iFactorContext.cs => MultiFactorAction.cs} |  4 +-
 .../domain/lambda/parameters/MFAContext.cs    | 43 +++++++++++++++
 .../domain/lambda/parameters/MFAPolicies.cs   | 41 +++++++++++++++
 .../parameters/MFARequiredLambdaResult.cs     | 36 +++++++++++++
 .../domain/lambda/parameters/MFATrust.cs      | 52 +++++++++++++++++++
 .../domain/lambda/parameters/StartInstant.cs  | 35 +++++++++++++
 6 files changed, 209 insertions(+), 2 deletions(-)
 rename fusionauth-netcore-client/domain/io/fusionauth/domain/{MultiFactorContext.cs => MultiFactorAction.cs} (86%)
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAContext.cs
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAPolicies.cs
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFARequiredLambdaResult.cs
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFATrust.cs
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/StartInstant.cs

diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/MultiFactorContext.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/MultiFactorAction.cs
similarity index 86%
rename from fusionauth-netcore-client/domain/io/fusionauth/domain/MultiFactorContext.cs
rename to fusionauth-netcore-client/domain/io/fusionauth/domain/MultiFactorAction.cs
index c3f05201..39a211c9 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/MultiFactorContext.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/MultiFactorAction.cs
@@ -22,9 +22,9 @@ namespace io.fusionauth.domain
 {
 
   /**
-   * Communicate various contexts in which multi-factor authentication can be used.
+   * Communicate various actions/contexts in which multi-factor authentication can be used.
    */
-  public enum MultiFactorContext {
+  public enum MultiFactorAction {
         changePassword, 
         login, 
         stepUp
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAContext.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAContext.cs
new file mode 100644
index 00000000..aabd9f0b
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAContext.cs
@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using io.fusionauth.domain;
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.lambda.parameters
+{
+
+  /**
+   * Represents the inbound lambda parameter 'context' for MFA Required lambdas.
+   */
+  public class MFAContext {
+
+    public List<AuthenticationThreats> authenticationThreats;
+
+    public EventInfo @eventInfo;
+
+    public MFATrust mfaTrust;
+
+    public UserRegistration registration;
+
+    public MFAContext with(Action<MFAContext> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAPolicies.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAPolicies.cs
new file mode 100644
index 00000000..17a75209
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAPolicies.cs
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using io.fusionauth.domain;
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.lambda.parameters
+{
+
+  /**
+   * Represents the inbound lambda parameter 'policies' for MFA Required lambdas.
+   */
+  public class MFAPolicies {
+
+    public MultiFactorLoginPolicy applicationLoginPolicy;
+
+    public ApplicationMultiFactorTrustPolicy applicationMultiFactorTrustPolicy;
+
+    public MultiFactorLoginPolicy tenantLoginPolicy;
+
+    public MFAPolicies with(Action<MFAPolicies> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFARequiredLambdaResult.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFARequiredLambdaResult.cs
new file mode 100644
index 00000000..6070069b
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFARequiredLambdaResult.cs
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.lambda.parameters
+{
+
+  /**
+   * Represents the inbound lambda parameter 'result' for MFA Required lambdas.
+   */
+  public class MFARequiredLambdaResult {
+
+    public bool? required;
+
+    public MFARequiredLambdaResult with(Action<MFARequiredLambdaResult> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFATrust.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFATrust.cs
new file mode 100644
index 00000000..836ff87c
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFATrust.cs
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.lambda.parameters
+{
+
+  /**
+   * Represents the inbound lambda parameter 'mfaTrust' inside the 'context' parameter for MFA Required lambdas.
+   */
+  public class MFATrust {
+
+    public Guid? applicationId;
+
+    public IDictionary<string, string> attributes;
+
+    public DateTimeOffset? expirationInstant;
+
+    public string id;
+
+    public DateTimeOffset? insertInstant;
+
+    public StartInstant startInstants;
+
+    public IDictionary<string, object> state;
+
+    public Guid? tenantId;
+
+    public Guid? userId;
+
+    public MFATrust with(Action<MFATrust> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/StartInstant.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/StartInstant.cs
new file mode 100644
index 00000000..0a5bb23d
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/StartInstant.cs
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.lambda.parameters
+{
+
+  public class StartInstant {
+
+    public IDictionary<Guid, DateTimeOffset> applications;
+
+    public DateTimeOffset? tenant;
+
+    public StartInstant with(Action<StartInstant> action) {
+      action(this);
+      return this;
+    }
+  }
+}

From 07ce3548ebbd5b4bdaa886f94ef694da1a08d6a6 Mon Sep 17 00:00:00 2001
From: Brady Wied <wied03@users.noreply.github.com>
Date: Mon, 8 Dec 2025 21:25:35 -0700
Subject: [PATCH 06/11] Merge wied03/ENG-3603/mfa-retrieve-status-post (#160)

* propagate client changes

* propagate client changes 2

* client code update from Javadoc

* client generation/new method

* better method name
---
 .../api/twoFactor/TwoFactorStatusRequest.cs   | 46 +++++++++++++++++++
 .../domain/lambda/parameters/MFAContext.cs    |  2 +
 .../src/io/fusionauth/FusionAuthClient.cs     |  9 ++++
 .../src/io/fusionauth/FusionAuthSyncClient.cs |  5 ++
 .../src/io/fusionauth/IFusionAuthClient.cs    | 33 +++++++++++++
 5 files changed, 95 insertions(+)
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/api/twoFactor/TwoFactorStatusRequest.cs

diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/twoFactor/TwoFactorStatusRequest.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/twoFactor/TwoFactorStatusRequest.cs
new file mode 100644
index 00000000..f00051cc
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/twoFactor/TwoFactorStatusRequest.cs
@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using io.fusionauth.domain.api;
+using io.fusionauth.domain;
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.api.twoFactor
+{
+
+  /**
+   * Check the status of two-factor authentication for a user, with more options than on a GET request.
+   */
+  public class TwoFactorStatusRequest: BaseEventRequest {
+
+    public Guid? userId;
+
+    public MultiFactorAction action;
+
+    public Guid? applicationId;
+
+    public string token;
+
+    public string twoFactorTrustId;
+
+    public TwoFactorStatusRequest with(Action<TwoFactorStatusRequest> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAContext.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAContext.cs
index aabd9f0b..b017dff7 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAContext.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAContext.cs
@@ -31,6 +31,8 @@ public class MFAContext {
 
     public EventInfo @eventInfo;
 
+    public IDictionary<string, object> jwt;
+
     public MFATrust mfaTrust;
 
     public UserRegistration registration;
diff --git a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
index aa91203a..0c718a46 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
@@ -2418,6 +2418,15 @@ public Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusAsyn
           .goAsync<TwoFactorStatusResponse>();
     }
 
+    /// <inheritdoc/>
+    public Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusUsingAsync(TwoFactorStatusRequest request) {
+      return buildClient()
+          .withUri("/api/two-factor/status")
+          .withJSONBody(request)
+          .withMethod("Post")
+          .goAsync<TwoFactorStatusResponse>();
+    }
+
     /// <inheritdoc/>
     public Task<ClientResponse<UserResponse>> RetrieveUserAsync(Guid? userId) {
       return buildClient()
diff --git a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
index eaefffd0..f98b57d7 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
@@ -1264,6 +1264,11 @@ public ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatus(Guid? use
       return client.RetrieveTwoFactorStatusAsync(userId, applicationId, twoFactorTrustId).GetAwaiter().GetResult();
     }
 
+    /// <inheritdoc/>
+    public ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatusUsing(TwoFactorStatusRequest request) {
+      return client.RetrieveTwoFactorStatusUsingAsync(request).GetAwaiter().GetResult();
+    }
+
     /// <inheritdoc/>
     public ClientResponse<UserResponse> RetrieveUser(Guid? userId) {
       return client.RetrieveUserAsync(userId).GetAwaiter().GetResult();
diff --git a/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs b/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
index 92866107..058cd124 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
@@ -3418,6 +3418,23 @@ public interface IFusionAuthAsyncClient {
     /// </returns>
     Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusAsync(Guid? userId, Guid? applicationId, string twoFactorTrustId);
 
+    /// <summary>
+    /// Retrieve a user's two-factor status.
+    /// 
+    /// This can be used to see if a user will need to complete a two-factor challenge to complete a login,
+    /// and optionally identify the state of the two-factor trust across various applications. This operation
+    /// provides more payload options than retrieveTwoFactorStatus.
+    /// This is an asynchronous method.
+    /// </summary>
+    /// <param name="request"> The request object that contains all the information used to check the status.</param>
+    /// <returns>
+    /// When successful, the response will contain the log of the action. If there was a validation error or any
+    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+    /// IOException.
+    /// </returns>
+    Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusUsingAsync(TwoFactorStatusRequest request);
+
     /// <summary>
     /// Retrieves the user for the given Id.
     /// This is an asynchronous method.
@@ -8254,6 +8271,22 @@ public interface IFusionAuthSyncClient {
    /// </returns>
    ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatus(Guid? userId, Guid? applicationId, string twoFactorTrustId);
 
+   /// <summary>
+   /// Retrieve a user's two-factor status.
+   /// 
+   /// This can be used to see if a user will need to complete a two-factor challenge to complete a login,
+   /// and optionally identify the state of the two-factor trust across various applications. This operation
+   /// provides more payload options than retrieveTwoFactorStatus.
+   /// </summary>
+   /// <param name="request"> The request object that contains all the information used to check the status.</param>
+   /// <returns>
+   /// When successful, the response will contain the log of the action. If there was a validation error or any
+   /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+   /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+   /// IOException.
+   /// </returns>
+   ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatusUsing(TwoFactorStatusRequest request);
+
    /// <summary>
    /// Retrieves the user for the given Id.
    /// </summary>

From f4119b8db5dab07411736e2961a46743f3063b61 Mon Sep 17 00:00:00 2001
From: Brady Wied <brady.wied@fusionauth.io>
Date: Mon, 8 Dec 2025 22:39:24 -0700
Subject: [PATCH 07/11] missing client stuff

---
 .../api/twoFactor/TwoFactorStatusRequest.cs   | 46 +++++++++++++++++++
 .../domain/lambda/parameters/MFAContext.cs    |  2 +
 .../parameters/MFARequiredLambdaResult.cs     |  2 +
 3 files changed, 50 insertions(+)
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/api/twoFactor/TwoFactorStatusRequest.cs

diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/twoFactor/TwoFactorStatusRequest.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/twoFactor/TwoFactorStatusRequest.cs
new file mode 100644
index 00000000..f00051cc
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/twoFactor/TwoFactorStatusRequest.cs
@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using io.fusionauth.domain.api;
+using io.fusionauth.domain;
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.api.twoFactor
+{
+
+  /**
+   * Check the status of two-factor authentication for a user, with more options than on a GET request.
+   */
+  public class TwoFactorStatusRequest: BaseEventRequest {
+
+    public Guid? userId;
+
+    public MultiFactorAction action;
+
+    public Guid? applicationId;
+
+    public string token;
+
+    public string twoFactorTrustId;
+
+    public TwoFactorStatusRequest with(Action<TwoFactorStatusRequest> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAContext.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAContext.cs
index aabd9f0b..b017dff7 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAContext.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFAContext.cs
@@ -31,6 +31,8 @@ public class MFAContext {
 
     public EventInfo @eventInfo;
 
+    public IDictionary<string, object> jwt;
+
     public MFATrust mfaTrust;
 
     public UserRegistration registration;
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFARequiredLambdaResult.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFARequiredLambdaResult.cs
index 6070069b..dd4008c9 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFARequiredLambdaResult.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/lambda/parameters/MFARequiredLambdaResult.cs
@@ -28,6 +28,8 @@ public class MFARequiredLambdaResult {
 
     public bool? required;
 
+    public bool? sendSuspiciousLoginEvent;
+
     public MFARequiredLambdaResult with(Action<MFARequiredLambdaResult> action) {
       action(this);
       return this;

From 0486de746c1d43b813bac4fbe147bef98393bc76 Mon Sep 17 00:00:00 2001
From: Brady Wied <brady.wied@fusionauth.io>
Date: Tue, 9 Dec 2025 07:44:27 -0700
Subject: [PATCH 08/11] redo client again

---
 .../src/io/fusionauth/FusionAuthClient.cs     |  9 +++++
 .../src/io/fusionauth/FusionAuthSyncClient.cs |  5 +++
 .../src/io/fusionauth/IFusionAuthClient.cs    | 33 +++++++++++++++++++
 3 files changed, 47 insertions(+)

diff --git a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
index aa91203a..0c718a46 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
@@ -2418,6 +2418,15 @@ public Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusAsyn
           .goAsync<TwoFactorStatusResponse>();
     }
 
+    /// <inheritdoc/>
+    public Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusUsingAsync(TwoFactorStatusRequest request) {
+      return buildClient()
+          .withUri("/api/two-factor/status")
+          .withJSONBody(request)
+          .withMethod("Post")
+          .goAsync<TwoFactorStatusResponse>();
+    }
+
     /// <inheritdoc/>
     public Task<ClientResponse<UserResponse>> RetrieveUserAsync(Guid? userId) {
       return buildClient()
diff --git a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
index eaefffd0..f98b57d7 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
@@ -1264,6 +1264,11 @@ public ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatus(Guid? use
       return client.RetrieveTwoFactorStatusAsync(userId, applicationId, twoFactorTrustId).GetAwaiter().GetResult();
     }
 
+    /// <inheritdoc/>
+    public ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatusUsing(TwoFactorStatusRequest request) {
+      return client.RetrieveTwoFactorStatusUsingAsync(request).GetAwaiter().GetResult();
+    }
+
     /// <inheritdoc/>
     public ClientResponse<UserResponse> RetrieveUser(Guid? userId) {
       return client.RetrieveUserAsync(userId).GetAwaiter().GetResult();
diff --git a/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs b/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
index 92866107..058cd124 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
@@ -3418,6 +3418,23 @@ public interface IFusionAuthAsyncClient {
     /// </returns>
     Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusAsync(Guid? userId, Guid? applicationId, string twoFactorTrustId);
 
+    /// <summary>
+    /// Retrieve a user's two-factor status.
+    /// 
+    /// This can be used to see if a user will need to complete a two-factor challenge to complete a login,
+    /// and optionally identify the state of the two-factor trust across various applications. This operation
+    /// provides more payload options than retrieveTwoFactorStatus.
+    /// This is an asynchronous method.
+    /// </summary>
+    /// <param name="request"> The request object that contains all the information used to check the status.</param>
+    /// <returns>
+    /// When successful, the response will contain the log of the action. If there was a validation error or any
+    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+    /// IOException.
+    /// </returns>
+    Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusUsingAsync(TwoFactorStatusRequest request);
+
     /// <summary>
     /// Retrieves the user for the given Id.
     /// This is an asynchronous method.
@@ -8254,6 +8271,22 @@ public interface IFusionAuthSyncClient {
    /// </returns>
    ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatus(Guid? userId, Guid? applicationId, string twoFactorTrustId);
 
+   /// <summary>
+   /// Retrieve a user's two-factor status.
+   /// 
+   /// This can be used to see if a user will need to complete a two-factor challenge to complete a login,
+   /// and optionally identify the state of the two-factor trust across various applications. This operation
+   /// provides more payload options than retrieveTwoFactorStatus.
+   /// </summary>
+   /// <param name="request"> The request object that contains all the information used to check the status.</param>
+   /// <returns>
+   /// When successful, the response will contain the log of the action. If there was a validation error or any
+   /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+   /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+   /// IOException.
+   /// </returns>
+   ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatusUsing(TwoFactorStatusRequest request);
+
    /// <summary>
    /// Retrieves the user for the given Id.
    /// </summary>

From 02d91f5068c969fdbac5ee6bb29b1fbf026e10b8 Mon Sep 17 00:00:00 2001
From: Brady Wied <wied03@users.noreply.github.com>
Date: Tue, 9 Dec 2025 19:13:45 -0700
Subject: [PATCH 09/11] Merge wied03/ENG-3608/mfa-change-password (#164)

* add IP address client overload

* forgot to update method names
---
 .../src/io/fusionauth/FusionAuthClient.cs     |  41 +++++
 .../src/io/fusionauth/FusionAuthSyncClient.cs |  20 +++
 .../src/io/fusionauth/IFusionAuthClient.cs    | 142 ++++++++++++++++++
 3 files changed, 203 insertions(+)

diff --git a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
index 0c718a46..38cf44f5 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
@@ -192,6 +192,16 @@ public Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingIdAsync(string cha
           .goAsync<RESTVoid>();
     }
 
+    /// <inheritdoc/>
+    public Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingIdAndIPAddressAsync(string changePasswordId, string ipAddress) {
+      return buildAnonymousClient()
+          .withUri("/api/user/change-password")
+          .withUriSegment(changePasswordId)
+          .withParameter("ipAddress", ipAddress)
+          .withMethod("Get")
+          .goAsync<RESTVoid>();
+    }
+
     /// <inheritdoc/>
     public Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingJWTAsync(string encodedJWT) {
       return buildAnonymousClient()
@@ -201,6 +211,16 @@ public Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingJWTAsync(string en
           .goAsync<RESTVoid>();
     }
 
+    /// <inheritdoc/>
+    public Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingJWTAndIPAddressAsync(string encodedJWT, string ipAddress) {
+      return buildAnonymousClient()
+          .withUri("/api/user/change-password")
+          .withAuthorization("Bearer " + encodedJWT)
+          .withParameter("ipAddress", ipAddress)
+          .withMethod("Get")
+          .goAsync<RESTVoid>();
+    }
+
     /// <inheritdoc/>
     public Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingLoginIdAsync(string loginId) {
       return buildClient()
@@ -210,6 +230,16 @@ public Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingLoginIdAsync(strin
           .goAsync<RESTVoid>();
     }
 
+    /// <inheritdoc/>
+    public Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingLoginIdAndIPAddressAsync(string loginId, string ipAddress) {
+      return buildClient()
+          .withUri("/api/user/change-password")
+          .withParameter("loginId", loginId)
+          .withParameter("ipAddress", ipAddress)
+          .withMethod("Get")
+          .goAsync<RESTVoid>();
+    }
+
     /// <inheritdoc/>
     public Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingLoginIdAndLoginIdTypesAsync(string loginId, List<string> loginIdTypes) {
       return buildClient()
@@ -220,6 +250,17 @@ public Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingLoginIdAndLoginIdT
           .goAsync<RESTVoid>();
     }
 
+    /// <inheritdoc/>
+    public Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingLoginIdAndLoginIdTypesAndIPAddressAsync(string loginId, List<string> loginIdTypes, string ipAddress) {
+      return buildClient()
+          .withUri("/api/user/change-password")
+          .withParameter("loginId", loginId)
+          .withParameter("loginIdTypes", loginIdTypes)
+          .withParameter("ipAddress", ipAddress)
+          .withMethod("Get")
+          .goAsync<RESTVoid>();
+    }
+
     /// <inheritdoc/>
     public Task<ClientResponse<AccessToken>> ClientCredentialsGrantAsync(string client_id, string client_secret, string scope) {
       var body = new Dictionary<string, string> {
diff --git a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
index f98b57d7..56ea0fe0 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
@@ -107,21 +107,41 @@ public ClientResponse<RESTVoid> CheckChangePasswordUsingId(string changePassword
       return client.CheckChangePasswordUsingIdAsync(changePasswordId).GetAwaiter().GetResult();
     }
 
+    /// <inheritdoc/>
+    public ClientResponse<RESTVoid> CheckChangePasswordUsingIdAndIPAddress(string changePasswordId, string ipAddress) {
+      return client.CheckChangePasswordUsingIdAndIPAddressAsync(changePasswordId, ipAddress).GetAwaiter().GetResult();
+    }
+
     /// <inheritdoc/>
     public ClientResponse<RESTVoid> CheckChangePasswordUsingJWT(string encodedJWT) {
       return client.CheckChangePasswordUsingJWTAsync(encodedJWT).GetAwaiter().GetResult();
     }
 
+    /// <inheritdoc/>
+    public ClientResponse<RESTVoid> CheckChangePasswordUsingJWTAndIPAddress(string encodedJWT, string ipAddress) {
+      return client.CheckChangePasswordUsingJWTAndIPAddressAsync(encodedJWT, ipAddress).GetAwaiter().GetResult();
+    }
+
     /// <inheritdoc/>
     public ClientResponse<RESTVoid> CheckChangePasswordUsingLoginId(string loginId) {
       return client.CheckChangePasswordUsingLoginIdAsync(loginId).GetAwaiter().GetResult();
     }
 
+    /// <inheritdoc/>
+    public ClientResponse<RESTVoid> CheckChangePasswordUsingLoginIdAndIPAddress(string loginId, string ipAddress) {
+      return client.CheckChangePasswordUsingLoginIdAndIPAddressAsync(loginId, ipAddress).GetAwaiter().GetResult();
+    }
+
     /// <inheritdoc/>
     public ClientResponse<RESTVoid> CheckChangePasswordUsingLoginIdAndLoginIdTypes(string loginId, List<string> loginIdTypes) {
       return client.CheckChangePasswordUsingLoginIdAndLoginIdTypesAsync(loginId, loginIdTypes).GetAwaiter().GetResult();
     }
 
+    /// <inheritdoc/>
+    public ClientResponse<RESTVoid> CheckChangePasswordUsingLoginIdAndLoginIdTypesAndIPAddress(string loginId, List<string> loginIdTypes, string ipAddress) {
+      return client.CheckChangePasswordUsingLoginIdAndLoginIdTypesAndIPAddressAsync(loginId, loginIdTypes, ipAddress).GetAwaiter().GetResult();
+    }
+
     /// <inheritdoc/>
     public ClientResponse<AccessToken> ClientCredentialsGrant(string client_id, string client_secret, string scope) {
       return client.ClientCredentialsGrantAsync(client_id, client_secret, scope).GetAwaiter().GetResult();
diff --git a/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs b/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
index 058cd124..db01ea6a 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
@@ -191,6 +191,24 @@ public interface IFusionAuthAsyncClient {
     /// </returns>
     Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingIdAsync(string changePasswordId);
 
+    /// <summary>
+    /// Check to see if the user must obtain a Trust Token Id in order to complete a change password request.
+    /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
+    /// your password, you must obtain a Trust Token by completing a Two-Factor Step-Up authentication.
+    /// 
+    /// An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API.
+    /// This is an asynchronous method.
+    /// </summary>
+    /// <param name="changePasswordId"> The change password Id used to find the user. This value is generated by FusionAuth once the change password workflow has been initiated.</param>
+    /// <param name="ipAddress"> (Optional) IP address of the user changing their password. This is used for MFA risk assessment.</param>
+    /// <returns>
+    /// When successful, the response will contain the log of the action. If there was a validation error or any
+    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+    /// IOException.
+    /// </returns>
+    Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingIdAndIPAddressAsync(string changePasswordId, string ipAddress);
+
     /// <summary>
     /// Check to see if the user must obtain a Trust Token Id in order to complete a change password request.
     /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
@@ -208,6 +226,24 @@ public interface IFusionAuthAsyncClient {
     /// </returns>
     Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingJWTAsync(string encodedJWT);
 
+    /// <summary>
+    /// Check to see if the user must obtain a Trust Token Id in order to complete a change password request.
+    /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
+    /// your password, you must obtain a Trust Token by completing a Two-Factor Step-Up authentication.
+    /// 
+    /// An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API.
+    /// This is an asynchronous method.
+    /// </summary>
+    /// <param name="encodedJWT"> The encoded JWT (access token).</param>
+    /// <param name="ipAddress"> (Optional) IP address of the user changing their password. This is used for MFA risk assessment.</param>
+    /// <returns>
+    /// When successful, the response will contain the log of the action. If there was a validation error or any
+    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+    /// IOException.
+    /// </returns>
+    Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingJWTAndIPAddressAsync(string encodedJWT, string ipAddress);
+
     /// <summary>
     /// Check to see if the user must obtain a Trust Request Id in order to complete a change password request.
     /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
@@ -225,6 +261,24 @@ public interface IFusionAuthAsyncClient {
     /// </returns>
     Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingLoginIdAsync(string loginId);
 
+    /// <summary>
+    /// Check to see if the user must obtain a Trust Request Id in order to complete a change password request.
+    /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
+    /// your password, you must obtain a Trust Request Id by completing a Two-Factor Step-Up authentication.
+    /// 
+    /// An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API.
+    /// This is an asynchronous method.
+    /// </summary>
+    /// <param name="loginId"> The loginId (email or username) of the User that you intend to change the password for.</param>
+    /// <param name="ipAddress"> (Optional) IP address of the user changing their password. This is used for MFA risk assessment.</param>
+    /// <returns>
+    /// When successful, the response will contain the log of the action. If there was a validation error or any
+    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+    /// IOException.
+    /// </returns>
+    Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingLoginIdAndIPAddressAsync(string loginId, string ipAddress);
+
     /// <summary>
     /// Check to see if the user must obtain a Trust Request Id in order to complete a change password request.
     /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
@@ -243,6 +297,25 @@ public interface IFusionAuthAsyncClient {
     /// </returns>
     Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingLoginIdAndLoginIdTypesAsync(string loginId, List<string> loginIdTypes);
 
+    /// <summary>
+    /// Check to see if the user must obtain a Trust Request Id in order to complete a change password request.
+    /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
+    /// your password, you must obtain a Trust Request Id by completing a Two-Factor Step-Up authentication.
+    /// 
+    /// An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API.
+    /// This is an asynchronous method.
+    /// </summary>
+    /// <param name="loginId"> The loginId of the User that you intend to change the password for.</param>
+    /// <param name="loginIdTypes"> The identity types that FusionAuth will compare the loginId to.</param>
+    /// <param name="ipAddress"> (Optional) IP address of the user changing their password. This is used for MFA risk assessment.</param>
+    /// <returns>
+    /// When successful, the response will contain the log of the action. If there was a validation error or any
+    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+    /// IOException.
+    /// </returns>
+    Task<ClientResponse<RESTVoid>> CheckChangePasswordUsingLoginIdAndLoginIdTypesAndIPAddressAsync(string loginId, List<string> loginIdTypes, string ipAddress);
+
     /// <summary>
     /// Make a Client Credentials grant request to obtain an access token.
     /// This is an asynchronous method.
@@ -5275,6 +5348,23 @@ public interface IFusionAuthSyncClient {
    /// </returns>
    ClientResponse<RESTVoid> CheckChangePasswordUsingId(string changePasswordId);
 
+   /// <summary>
+   /// Check to see if the user must obtain a Trust Token Id in order to complete a change password request.
+   /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
+   /// your password, you must obtain a Trust Token by completing a Two-Factor Step-Up authentication.
+   /// 
+   /// An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API.
+   /// </summary>
+   /// <param name="changePasswordId"> The change password Id used to find the user. This value is generated by FusionAuth once the change password workflow has been initiated.</param>
+   /// <param name="ipAddress"> (Optional) IP address of the user changing their password. This is used for MFA risk assessment.</param>
+   /// <returns>
+   /// When successful, the response will contain the log of the action. If there was a validation error or any
+   /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+   /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+   /// IOException.
+   /// </returns>
+   ClientResponse<RESTVoid> CheckChangePasswordUsingIdAndIPAddress(string changePasswordId, string ipAddress);
+
    /// <summary>
    /// Check to see if the user must obtain a Trust Token Id in order to complete a change password request.
    /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
@@ -5291,6 +5381,23 @@ public interface IFusionAuthSyncClient {
    /// </returns>
    ClientResponse<RESTVoid> CheckChangePasswordUsingJWT(string encodedJWT);
 
+   /// <summary>
+   /// Check to see if the user must obtain a Trust Token Id in order to complete a change password request.
+   /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
+   /// your password, you must obtain a Trust Token by completing a Two-Factor Step-Up authentication.
+   /// 
+   /// An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API.
+   /// </summary>
+   /// <param name="encodedJWT"> The encoded JWT (access token).</param>
+   /// <param name="ipAddress"> (Optional) IP address of the user changing their password. This is used for MFA risk assessment.</param>
+   /// <returns>
+   /// When successful, the response will contain the log of the action. If there was a validation error or any
+   /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+   /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+   /// IOException.
+   /// </returns>
+   ClientResponse<RESTVoid> CheckChangePasswordUsingJWTAndIPAddress(string encodedJWT, string ipAddress);
+
    /// <summary>
    /// Check to see if the user must obtain a Trust Request Id in order to complete a change password request.
    /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
@@ -5307,6 +5414,23 @@ public interface IFusionAuthSyncClient {
    /// </returns>
    ClientResponse<RESTVoid> CheckChangePasswordUsingLoginId(string loginId);
 
+   /// <summary>
+   /// Check to see if the user must obtain a Trust Request Id in order to complete a change password request.
+   /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
+   /// your password, you must obtain a Trust Request Id by completing a Two-Factor Step-Up authentication.
+   /// 
+   /// An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API.
+   /// </summary>
+   /// <param name="loginId"> The loginId (email or username) of the User that you intend to change the password for.</param>
+   /// <param name="ipAddress"> (Optional) IP address of the user changing their password. This is used for MFA risk assessment.</param>
+   /// <returns>
+   /// When successful, the response will contain the log of the action. If there was a validation error or any
+   /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+   /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+   /// IOException.
+   /// </returns>
+   ClientResponse<RESTVoid> CheckChangePasswordUsingLoginIdAndIPAddress(string loginId, string ipAddress);
+
    /// <summary>
    /// Check to see if the user must obtain a Trust Request Id in order to complete a change password request.
    /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
@@ -5324,6 +5448,24 @@ public interface IFusionAuthSyncClient {
    /// </returns>
    ClientResponse<RESTVoid> CheckChangePasswordUsingLoginIdAndLoginIdTypes(string loginId, List<string> loginIdTypes);
 
+   /// <summary>
+   /// Check to see if the user must obtain a Trust Request Id in order to complete a change password request.
+   /// When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change
+   /// your password, you must obtain a Trust Request Id by completing a Two-Factor Step-Up authentication.
+   /// 
+   /// An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API.
+   /// </summary>
+   /// <param name="loginId"> The loginId of the User that you intend to change the password for.</param>
+   /// <param name="loginIdTypes"> The identity types that FusionAuth will compare the loginId to.</param>
+   /// <param name="ipAddress"> (Optional) IP address of the user changing their password. This is used for MFA risk assessment.</param>
+   /// <returns>
+   /// When successful, the response will contain the log of the action. If there was a validation error or any
+   /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+   /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+   /// IOException.
+   /// </returns>
+   ClientResponse<RESTVoid> CheckChangePasswordUsingLoginIdAndLoginIdTypesAndIPAddress(string loginId, List<string> loginIdTypes, string ipAddress);
+
    /// <summary>
    /// Make a Client Credentials grant request to obtain an access token.
    /// </summary>

From cea3932967dce0d7c2827396ceacbaf0b467fc86 Mon Sep 17 00:00:00 2001
From: Brady Wied <brady.wied@fusionauth.io>
Date: Wed, 10 Dec 2025 16:53:32 -0700
Subject: [PATCH 10/11] naming advice

---
 .../src/io/fusionauth/FusionAuthClient.cs                     | 2 +-
 .../src/io/fusionauth/FusionAuthSyncClient.cs                 | 4 ++--
 .../src/io/fusionauth/IFusionAuthClient.cs                    | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
index 13c85334..abf71661 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
@@ -2469,7 +2469,7 @@ public Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusAsyn
     }
 
     /// <inheritdoc/>
-    public Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusUsingAsync(TwoFactorStatusRequest request) {
+    public Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusWithRequestAsync(TwoFactorStatusRequest request) {
       return buildClient()
           .withUri("/api/two-factor/status")
           .withJSONBody(request)
diff --git a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
index 340d1a99..53bac6ce 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
@@ -1290,8 +1290,8 @@ public ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatus(Guid? use
     }
 
     /// <inheritdoc/>
-    public ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatusUsing(TwoFactorStatusRequest request) {
-      return client.RetrieveTwoFactorStatusUsingAsync(request).GetAwaiter().GetResult();
+    public ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatusWithRequest(TwoFactorStatusRequest request) {
+      return client.RetrieveTwoFactorStatusWithRequestAsync(request).GetAwaiter().GetResult();
     }
 
     /// <inheritdoc/>
diff --git a/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs b/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
index 7135225e..9cb52861 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
@@ -3519,7 +3519,7 @@ public interface IFusionAuthAsyncClient {
     /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
     /// IOException.
     /// </returns>
-    Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusUsingAsync(TwoFactorStatusRequest request);
+    Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusWithRequestAsync(TwoFactorStatusRequest request);
 
     /// <summary>
     /// Retrieves the user for the given Id.
@@ -8452,7 +8452,7 @@ public interface IFusionAuthSyncClient {
    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
    /// IOException.
    /// </returns>
-   ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatusUsing(TwoFactorStatusRequest request);
+   ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatusWithRequest(TwoFactorStatusRequest request);
 
    /// <summary>
    /// Retrieves the user for the given Id.

From 2beccb41e9a7f5dbb7cb5fe2224d622746711812 Mon Sep 17 00:00:00 2001
From: Jaret Hendrickson <jaret.hendrickson@fusionauth.io>
Date: Fri, 12 Dec 2025 12:50:33 -0600
Subject: [PATCH 11/11] mfa lambda

---
 .../domain/io/fusionauth/domain/reactor/ReactorStatus.cs        | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/reactor/ReactorStatus.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/reactor/ReactorStatus.cs
index 93096309..38d03b05 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/reactor/ReactorStatus.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/reactor/ReactorStatus.cs
@@ -56,6 +56,8 @@ public class ReactorStatus {
 
     public bool? licensed;
 
+    public ReactorFeatureStatus multiFactorLambdas;
+
     public ReactorFeatureStatus scimServer;
 
     public ReactorFeatureStatus tenantManagerApplication;