Tolgee Octri Demo
PUT/v2/user/mfa/totp

Enable TOTP-based multi-factor authentication

Enables TOTP-based multi-factor authentication for the authenticated user's account. Provide the account password, the six-character otp, and the 16-character totpKey that matches the specified pattern. Successful requests invalidate all previous sessions and return a new access token.

3 body fields

Credentials and TOTP details used to enable multi-factor authentication.

otpstringrequired
The one-time password. Must be exactly 6 characters.
passwordstringrequired
The account password. Must be no more than 50 characters.
totpKeystringrequired
The TOTP key. Must be exactly 16 characters and match `^(?:[a-z2-7]{8})*$`.

5 status codes
200Returns an object containing the new `accessToken` and its `tokenType`.
accessTokenstringoptional
tokenTypestringoptional
400Returned when a required credential is missing or a value fails validation.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional
401Returned when the password or OTP is rejected.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional
403Returned when the authenticated user is not permitted to change MFA settings.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional
404Returned when the associated user or resource cannot be found.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional

Error handling

A 400 is returned when a required credential is missing or a value fails validation. A 401 is returned when the password or OTP is rejected, a 403 when the authenticated user is not permitted to change MFA settings, and a 404 when the associated user or resource cannot be found. otp must be exactly 6 characters, totpKey exactly 16 characters matching ^(?:[a-z2-7]{8})*$, and password no more than 50 characters.