Registers a TOTP authenticator for a user from the shared secret returned by GET /login/two-factor/secret, and returns that user's recovery codes. This is a one-time step per user: calling it again for an enrolled user returns 409. The recovery codes are returned only by this call and cannot be retrieved later, so store them before discarding the response. Errors raised by the identity provider rather than by this endpoint are passed through with their original status and a generic body of the form {"message":"Request failed with status code
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Invalid request. Returned when the Authorization header is absent, when a required body field is missing, when mfaSecretB32 is not Base32 (for example the raw secret value from GET /login/two-factor/secret, or a lowercased string), or when mfaCode is not exactly six digits. Field errors return {"message":"
Authorization header present but empty, or rejected by the identity provider.
The username or password was not accepted. The identity provider does not distinguish an unknown user from a wrong password, and the passed-through body carries no detail.
MFA is already enabled for this user. Enrolment is one-time; removing an existing authenticator so a user can re-enrol requires AUDD.
The mfaCode did not match mfaSecretB32. Six well-formed but incorrect digits produce this status, passed through from the identity provider. Retry with a freshly generated code; if it keeps failing, check the client clock for drift.