POST/api/user/mfa/totp/verify-enrollmentAuthenticated

Confirm a TOTP enrollment

Activates the pending authenticator-app factor named by factor_id once the caller submits a current code from it. Recovery codes are minted only when this becomes the caller's first verified factor (recovery_codes_issued); a security alert e-mail is sent.

operationId post_api_user_mfa_totp_verify_enrollmentMulti-factor authentication

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user

Request body

Required

application/json
MfaVerifyTotpEnrollmentRequest
PropertyTypeDescription
factor_id*string (uuid)
code*string

pattern: ^\d{6}$/u

JSONExample
"factor_id""123e4567-e89b-12d3-a456-426614174000"
"code""string"

Responses

application/json
MfaVerifyEnrollmentResultOutcome of confirming a factor (or regenerating recovery codes). recovery_codes_issued tells whether recovery_codes carries freshly minted codes to display; when false the user's existing codes still apply and the array is empty.
PropertyTypeDescription
success*true
recovery_codes*string[]
recovery_codes_issued*boolean
JSONExample
"success"true
"recovery_codes"
"string"
"recovery_codes_issued"true

Example request

bashcurl
curl -X POST 'https://auth.schemavaults.com/api/user/mfa/totp/verify-enrollment' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "factor_id": "123e4567-e89b-12d3-a456-426614174000",
  "code": "string"
}'