feat: add guardian (MFA) command group

README.md

@@ -274,6 +274,7 @@ Select **y** to proceed with your default tenant, or **N** to choose a different
 - [auth0 domains](https://auth0.github.io/auth0-cli/auth0_domains.html) - Manage custom domains
 - [auth0 email](https://auth0.github.io/auth0-cli/auth0_email.html) - Manage email settings
 - [auth0 flows](https://auth0.github.io/auth0-cli/auth0_flows.html) - Manage Flows
+- [auth0 guardian](https://auth0.github.io/auth0-cli/auth0_guardian.html) - Manage multi-factor authentication (Guardian)
 - [auth0 login](https://auth0.github.io/auth0-cli/auth0_login.html) - Authenticate the Auth0 CLI
 - [auth0 logout](https://auth0.github.io/auth0-cli/auth0_logout.html) - Log out of a tenant's session
 - [auth0 logs](https://auth0.github.io/auth0-cli/auth0_logs.html) - View tenant logs

docs/auth0_guardian.md

@@ -0,0 +1,14 @@
+---
+layout: default
+has_toc: false
+---
+# auth0 guardian
+
+Manage Auth0 multi-factor authentication (MFA), also known as Guardian. Configure MFA policies, factors and their providers, and manage user enrollments.
+
+## Commands
+
+- [auth0 guardian enrollments](auth0_guardian_enrollments.md) - Manage multi-factor authentication enrollments
+- [auth0 guardian factors](auth0_guardian_factors.md) - Manage multi-factor authentication factors
+- [auth0 guardian policies](auth0_guardian_policies.md) - Manage multi-factor authentication policies
+

docs/auth0_guardian_enrollments.md

@@ -0,0 +1,15 @@
+---
+layout: default
+has_toc: false
+has_children: true
+---
+# auth0 guardian enrollments
+
+Manage user multi-factor authentication (MFA) enrollments and enrollment tickets.
+
+## Commands
+
+- [auth0 guardian enrollments create-ticket](auth0_guardian_enrollments_create-ticket.md) - Create a multi-factor authentication enrollment ticket
+- [auth0 guardian enrollments delete](auth0_guardian_enrollments_delete.md) - Delete a multi-factor authentication enrollment
+- [auth0 guardian enrollments show](auth0_guardian_enrollments_show.md) - Show a multi-factor authentication enrollment
+

docs/auth0_guardian_enrollments_create-ticket.md

@@ -0,0 +1,58 @@
+---
+layout: default
+parent: auth0 guardian enrollments
+has_toc: false
+---
+# auth0 guardian enrollments create-ticket
+
+Create an MFA enrollment ticket for a user and, optionally, email it to them.
+
+The returned ticket URL is the link the user follows to enroll.
+
+## Usage
+```
+auth0 guardian enrollments create-ticket [flags]
+```
+
+## Examples
+
+```
+  auth0 guardian enrollments create-ticket --user-id "auth0|123"
+  auth0 guardian enrollments create-ticket --user-id "auth0|123" --factor push-notification
+  auth0 guardian enrollments create-ticket --user-id "auth0|123" --send-email --email me@example.com
+  auth0 guardian enrollments create-ticket --user-id "auth0|123" --allow-multiple --json
+```
+
+
+## Flags
+
+```
+      --allow-multiple        Allow a user who has previously enrolled in MFA to enroll with additional factors. Universal Login only.
+      --email string          Alternate email address to send the enrollment email to. Defaults to the user's email.
+      --email-locale string   Locale of the enrollment email. Used with --send-email.
+  -f, --factor string         Factor the user must enroll with, e.g. push-notification, sms, email, otp, webauthn-roaming, webauthn-platform, recovery-code, duo.
+      --json                  Output in json format.
+      --json-compact          Output in compact json format.
+      --send-email            Send an email to the user to start the enrollment.
+  -u, --user-id string        User ID to create the enrollment ticket for.
+```
+
+
+## Inherited Flags
+
+```
+      --agent-mode      Output JSON, disable prompts and colors. Auto-enabled for AI agents; set AUTH0_AGENT_MODE=false to disable.
+      --debug           Enable debug mode.
+      --no-color        Disable colors.
+      --no-input        Disable interactivity.
+      --tenant string   Specific tenant to use.
+```
+
+
+## Related Commands
+
+- [auth0 guardian enrollments create-ticket](auth0_guardian_enrollments_create-ticket.md) - Create a multi-factor authentication enrollment ticket
+- [auth0 guardian enrollments delete](auth0_guardian_enrollments_delete.md) - Delete a multi-factor authentication enrollment
+- [auth0 guardian enrollments show](auth0_guardian_enrollments_show.md) - Show a multi-factor authentication enrollment
+
+

docs/auth0_guardian_enrollments_delete.md

@@ -0,0 +1,53 @@
+---
+layout: default
+parent: auth0 guardian enrollments
+has_toc: false
+---
+# auth0 guardian enrollments delete
+
+Delete an MFA enrollment, allowing the user to re-enroll.
+
+To delete interactively, use `auth0 guardian enrollments delete` with no arguments.
+
+To delete non-interactively, supply the enrollment id and the `--force` flag to skip confirmation.
+
+## Usage
+```
+auth0 guardian enrollments delete [flags]
+```
+
+## Examples
+
+```
+  auth0 guardian enrollments delete
+  auth0 guardian enrollments rm
+  auth0 guardian enrollments delete <enrollment-id>
+  auth0 guardian enrollments delete <enrollment-id> --force
+```
+
+
+## Flags
+
+```
+      --force   Skip confirmation.
+```
+
+
+## Inherited Flags
+
+```
+      --agent-mode      Output JSON, disable prompts and colors. Auto-enabled for AI agents; set AUTH0_AGENT_MODE=false to disable.
+      --debug           Enable debug mode.
+      --no-color        Disable colors.
+      --no-input        Disable interactivity.
+      --tenant string   Specific tenant to use.
+```
+
+
+## Related Commands
+
+- [auth0 guardian enrollments create-ticket](auth0_guardian_enrollments_create-ticket.md) - Create a multi-factor authentication enrollment ticket
+- [auth0 guardian enrollments delete](auth0_guardian_enrollments_delete.md) - Delete a multi-factor authentication enrollment
+- [auth0 guardian enrollments show](auth0_guardian_enrollments_show.md) - Show a multi-factor authentication enrollment
+
+

docs/auth0_guardian_enrollments_show.md

@@ -0,0 +1,48 @@
+---
+layout: default
+parent: auth0 guardian enrollments
+has_toc: false
+---
+# auth0 guardian enrollments show
+
+Display the status, type and details of an MFA enrollment.
+
+## Usage
+```
+auth0 guardian enrollments show [flags]
+```
+
+## Examples
+
+```
+  auth0 guardian enrollments show <enrollment-id>
+  auth0 guardian enrollments show <enrollment-id> --json
+```
+
+
+## Flags
+
+```
+      --json           Output in json format.
+      --json-compact   Output in compact json format.
+```
+
+
+## Inherited Flags
+
+```
+      --agent-mode      Output JSON, disable prompts and colors. Auto-enabled for AI agents; set AUTH0_AGENT_MODE=false to disable.
+      --debug           Enable debug mode.
+      --no-color        Disable colors.
+      --no-input        Disable interactivity.
+      --tenant string   Specific tenant to use.
+```
+
+
+## Related Commands
+
+- [auth0 guardian enrollments create-ticket](auth0_guardian_enrollments_create-ticket.md) - Create a multi-factor authentication enrollment ticket
+- [auth0 guardian enrollments delete](auth0_guardian_enrollments_delete.md) - Delete a multi-factor authentication enrollment
+- [auth0 guardian enrollments show](auth0_guardian_enrollments_show.md) - Show a multi-factor authentication enrollment
+
+

docs/auth0_guardian_factors.md

@@ -0,0 +1,18 @@
+---
+layout: default
+has_toc: false
+has_children: true
+---
+# auth0 guardian factors
+
+Manage multi-factor authentication (MFA) factors and their providers.
+
+## Commands
+
+- [auth0 guardian factors duo](auth0_guardian_factors_duo.md) - Manage the Duo multi-factor authentication factor
+- [auth0 guardian factors list](auth0_guardian_factors_list.md) - List multi-factor authentication factors
+- [auth0 guardian factors phone](auth0_guardian_factors_phone.md) - Manage the phone multi-factor authentication factor
+- [auth0 guardian factors push](auth0_guardian_factors_push.md) - Manage the push-notification multi-factor authentication factor
+- [auth0 guardian factors set](auth0_guardian_factors_set.md) - Enable or disable a multi-factor authentication factor
+- [auth0 guardian factors sms](auth0_guardian_factors_sms.md) - Manage the SMS multi-factor authentication factor (legacy)
+

docs/auth0_guardian_factors_duo.md

@@ -0,0 +1,12 @@
+---
+layout: default
+has_toc: false
+---
+# auth0 guardian factors duo
+
+Manage the Duo MFA factor settings.
+
+## Commands
+
+- [auth0 guardian factors duo settings](auth0_guardian_factors_duo_settings.md) - Manage the Duo settings
+

docs/auth0_guardian_factors_duo_settings.md

@@ -0,0 +1,15 @@
+---
+layout: default
+has_toc: false
+has_children: true
+---
+# auth0 guardian factors duo settings
+
+Manage the Duo MFA factor settings.
+
+## Commands
+
+- [auth0 guardian factors duo settings set](auth0_guardian_factors_duo_settings_set.md) - Set the Duo settings
+- [auth0 guardian factors duo settings show](auth0_guardian_factors_duo_settings_show.md) - Show the Duo settings
+- [auth0 guardian factors duo settings update](auth0_guardian_factors_duo_settings_update.md) - Update the Duo settings
+

docs/auth0_guardian_factors_duo_settings_set.md

@@ -0,0 +1,50 @@
+---
+layout: default
+parent: auth0 guardian factors duo settings
+has_toc: false
+---
+# auth0 guardian factors duo settings set
+
+Replace the Duo MFA factor settings. This overwrites all Duo settings, so the host, integration key and secret key are all required. To change a single field without clearing the others, use `auth0 guardian factors duo settings update` instead.
+
+## Usage
+```
+auth0 guardian factors duo settings set [flags]
+```
+
+## Examples
+
+```
+  auth0 guardian factors duo settings set --ikey <ikey> --skey <skey> --host api-xxxx.duosecurity.com
+```
+
+
+## Flags
+
+```
+      --host string    Duo API hostname.
+      --ikey string    Duo integration key.
+      --json           Output in json format.
+      --json-compact   Output in compact json format.
+      --skey string    Duo secret key.
+```
+
+
+## Inherited Flags
+
+```
+      --agent-mode      Output JSON, disable prompts and colors. Auto-enabled for AI agents; set AUTH0_AGENT_MODE=false to disable.
+      --debug           Enable debug mode.
+      --no-color        Disable colors.
+      --no-input        Disable interactivity.
+      --tenant string   Specific tenant to use.
+```
+
+
+## Related Commands
+
+- [auth0 guardian factors duo settings set](auth0_guardian_factors_duo_settings_set.md) - Set the Duo settings
+- [auth0 guardian factors duo settings show](auth0_guardian_factors_duo_settings_show.md) - Show the Duo settings
+- [auth0 guardian factors duo settings update](auth0_guardian_factors_duo_settings_update.md) - Update the Duo settings
+
+

docs/auth0_guardian_factors_duo_settings_show.md

@@ -0,0 +1,47 @@
+---
+layout: default
+parent: auth0 guardian factors duo settings
+has_toc: false
+---
+# auth0 guardian factors duo settings show
+
+Display the Duo MFA factor settings.
+
+## Usage
+```
+auth0 guardian factors duo settings show [flags]
+```
+
+## Examples
+
+```
+  auth0 guardian factors duo settings show --json
+```
+
+
+## Flags
+
+```
+      --json           Output in json format.
+      --json-compact   Output in compact json format.
+```
+
+
+## Inherited Flags
+
+```
+      --agent-mode      Output JSON, disable prompts and colors. Auto-enabled for AI agents; set AUTH0_AGENT_MODE=false to disable.
+      --debug           Enable debug mode.
+      --no-color        Disable colors.
+      --no-input        Disable interactivity.
+      --tenant string   Specific tenant to use.
+```
+
+
+## Related Commands
+
+- [auth0 guardian factors duo settings set](auth0_guardian_factors_duo_settings_set.md) - Set the Duo settings
+- [auth0 guardian factors duo settings show](auth0_guardian_factors_duo_settings_show.md) - Show the Duo settings
+- [auth0 guardian factors duo settings update](auth0_guardian_factors_duo_settings_update.md) - Update the Duo settings
+
+

docs/auth0_guardian_factors_duo_settings_update.md

@@ -0,0 +1,50 @@
+---
+layout: default
+parent: auth0 guardian factors duo settings
+has_toc: false
+---
+# auth0 guardian factors duo settings update
+
+Partially update the Duo MFA factor settings. Only the fields you provide are changed; the rest keep their current values. Run without flags to be prompted for each field, pre-filled with the current value (leave the secret key blank to keep it unchanged).
+
+## Usage
+```
+auth0 guardian factors duo settings update [flags]
+```
+
+## Examples
+
+```
+  auth0 guardian factors duo settings update --host api-xxxx.duosecurity.com
+```
+
+
+## Flags
+
+```
+      --host string    Duo API hostname.
+      --ikey string    Duo integration key.
+      --json           Output in json format.
+      --json-compact   Output in compact json format.
+      --skey string    Duo secret key.
+```
+
+
+## Inherited Flags
+
+```
+      --agent-mode      Output JSON, disable prompts and colors. Auto-enabled for AI agents; set AUTH0_AGENT_MODE=false to disable.
+      --debug           Enable debug mode.
+      --no-color        Disable colors.
+      --no-input        Disable interactivity.
+      --tenant string   Specific tenant to use.
+```
+
+
+## Related Commands
+
+- [auth0 guardian factors duo settings set](auth0_guardian_factors_duo_settings_set.md) - Set the Duo settings
+- [auth0 guardian factors duo settings show](auth0_guardian_factors_duo_settings_show.md) - Show the Duo settings
+- [auth0 guardian factors duo settings update](auth0_guardian_factors_duo_settings_update.md) - Update the Duo settings
+
+