Start MFA enrolment (step one of two)

POST 
/auth/setup-mfa

Begins enrolling a second factor on the authenticated user's own account (#2500). Nothing is enabled by this call. For authenticator a TOTP secret is stored and returned with its otpauth URI; for email or sms a code is sent to the verified contact. Call POST /auth/confirm-mfa with a code from the method to enable it. The user is taken from the JWT; a body-supplied userId is ignored.

Request

Responses

200

Enrolment started. data carries mfa_enabled and mfa_methods (both unchanged), pending_methods, totp { secret, otpauthUri } when authenticator was requested, and delivery [{ method, delivered, expiresAt }] for email/sms.

400

A requested method is already enabled on the account, its contact is not verified, or the code could not be sent.