Confirm MFA enrolment (step two of two)
POST/auth/confirm-mfa
Enables the pending method on the authenticated user's own account once the submitted code checks out: a TOTP from the secret returned by /auth/setup-mfa, or the code it sent by email or SMS. A wrong code answers 400 MFA_CONFIRM_FAILED and changes nothing. Rate limited to 5 attempts per 15 minutes per user and 30 per hour per IP.
Request
Responses
- 200
- 400
- 401
- 429
MFA enabled. data carries mfa_enabled (true) and mfa_methods.
The code did not check out (error.code MFA_CONFIRM_FAILED), or no enrolment is pending for the method.
Not authenticated
Too many attempts; see Retry-After