POST
/api/user/mfa/totp/enrollAuthenticatedStart a TOTP enrollment
Creates a pending authenticator-app factor for the caller and returns the secret, the otpauth:// URL and its QR code. Confirm it with POST /api/user/mfa/totp/verify-enrollment. Refused while the caller already has a verified factor; abandoned enrollments are swept first. Any request body is ignored. Rate limited per user.
operationId
post_api_user_mfa_totp_enrollMulti-factor authenticationAuthentication & permissionsAuthenticated
Any authenticated user
- Accepted credentials
- Auth server session (refresh token cookie)
cookie "refresh_token_<auth_server_app_id>" - Access token (cookie)
cookie "access_token_<auth_server_app_id>" - Access token (Bearer)
Authorization: Bearer <JWT>
- Auth server session (refresh token cookie)
- Who may call
- Any authenticated user
Responses
application/json
MfaTotpEnrollmentA pending TOTP enrollment: the base32 secret, the
otpauth:// URL and a PNG data URL of its QR code to show the user, plus the factor_id to confirm the enrollment with.| Property | Type | Description |
|---|---|---|
| factor_id* | string (uuid) | |
| factor_type* | "totp" | |
| otpauth_url* | string (uri) | |
| qr_code_data_url* | string | minLength: 1 |
| secret* | string | minLength: 16 |
JSONExample
"factor_id""123e4567-e89b-12d3-a456-426614174000"
"factor_type""totp"
"otpauth_url""https://example.com"
"qr_code_data_url""string"
"secret""string"
Example request
bashcurl
curl -X POST 'https://auth.schemavaults.com/api/user/mfa/totp/enroll' \
-b 'refresh_token_<auth_server_app_id>=<value>'